Skip to main content

Release 2026.44.0

· 15 min read
meshcloud

Release period: 2026-10-21 to 2026-10-28

This release includes the following issues:

  • Consistent Event Titles for Building Blocks and Communication Definitions
  • Building Blocks That Need the Platform Tenant ID Now Run When It Is Reported
  • No Operator Input E-Mail When the Operator Input Is Already Set
  • meshObject API Changes That Can Affect Your Integration
  • New meshObject API Reference, Clearer Errors and More Sort Options
  • Tenant Usage Reports Without Tags No Longer Block the Report API
  • Fix meshStack CLI Browser Login Still Failing for Some Users
  • Aborted Building Block Runs Show the Review Aborted Run Action
  • Add Only Permissions to an API Key That You Hold Yourself
  • Tenant Usage Reports Open Again in meshStacks That Had GitHub Platforms
  • Payment Method Usage Percentage Updates Right After an Amount Change
  • Building Block Runner API Reports Runner Activity in status
  • Faster and More Reliable CSV Export of Chargeback Statements
  • See Which Users Are Disabled in User Bindings and User Groups
  • Workspace User Counts Update Right After Access Changes
  • No More False Unsaved Changes Warning on Building Block Definition Tags
  • Long Workspace Names Show in Full in the Context Switcher
  • ISO 8601 Dates in meshObject Content of Event Logs
  • resolutionHint in API Error Responses Is Now terraformProviderVersionHint
  • Create API Keys With meshStack CLI Credentials Like in the Panel
  • Custom Platform Tenants Fail When No Platform Tenant ID Can Arrive
  • Mention Building Block Definitions in Building Block Summaries
  • Fixed SCIM Group Membership Changes That Were Not Audited or Replicated
  • Hub Import Respects the Logo
  • Deactivated Users No Longer Receive Emails About Expiring API Keys
  • Run Control Decides Who Triggers and Aborts Building Block Runs

Ticket Details​

Consistent Event Titles for Building Blocks and Communication Definitions​

Audience: User

Description​

Event log entries for changes to building blocks, building block definitions and communication definitions now use the same words as all other events, such as "Changed" for a modification. Their descriptions now name the changed object first, as for all other events. We renamed the titles of existing event log entries as well, so a filter on the new title finds all of them. If you filter the meshEventLog API by title, use the new titles:

  • "Building Block Definition Modified" is now "Building Block Definition Changed"
  • "Building Block Definition Version Modified" is now "Building Block Definition Version Changed"
  • "Building Block Definition Version Dependencies Modified" is now "Building Block Definition Version Dependencies Changed"
  • "Building Block Definition Tags Edited" is now "Building Block Definition Tags Changed"
  • "Building Block Definition Version Added" is now "Building Block Definition Version Created"
  • "Building Block Definition Marketplace Publication Request" is now "Building Block Definition Marketplace Publication Submitted"
  • "Building Block Inputs Updated" is now "Building Block Inputs Changed"
  • "Communication Definition Updated" is now "Communication Definition Changed"

Building Blocks That Need the Platform Tenant ID Now Run When It Is Reported​

Audience: User

Description​

On a custom platform, a building block can report the platform tenant ID of its tenant. Other building blocks of that tenant can take this ID as an input. Until now, these building blocks stayed waiting for dependent input after the ID was reported, until something else in the workspace changed, for example another building block provided an output they depend on, or a new workspace member was added. They now start as soon as the building block that reports the ID succeeds.

No Operator Input E-Mail When the Operator Input Is Already Set​

Audience: User

Description​

When you create a building block and already set its operator inputs, for example with an API key or in Terraform, we no longer e-mail the building block definition's notification subscribers to ask for these inputs. We now only send this e-mail when a required operator input still has no value.

meshObject API Changes That Can Affect Your Integration​

Audience: User

Description​

The meshObject API now answers more consistently. Check these changes if your integration relies on the old answers:

  • A UUID in a path, filter or request body that is not a valid UUID gets 400. Before, you got 404, 409, 500, an empty page, or the value was ignored.
  • Deleting a tag definition that a policy still uses gets 409. Before, you got 500.
  • Creating or updating a building block definition version with a permission that does not exist gets 400. Before, you got 500.
  • Deleting a built-in integration gets 400. Before, you got 500.
  • Updating a building block definition with PUT and a UUID that does not exist gets 404. Before, it created a new building block definition with another UUID.
  • An unknown value in these filters gets 400: status and reportCategory of tenant usage reports, resolutionStatus of communications, targetRefKind of building blocks, and lifecycleState of landing zones and platforms. Before, you got an empty page, all results or 500.
  • An unknown sort key for building blocks in version 1 and tenant usage reports in version 2 gets 400.
  • Sorting workspace bindings by createdAt and communications by resolvedAt now works. Before, it had no effect.
  • The metering API returns 50 items per page by default and at most 350. Before, you got 20 and at most 200.
  • Deleting a building block definition version still gets 501, now with an error body.
  • Every error response, including every 404, has an error body with errorCode, message and errorId. An errorCode that was empty is now InternalError.
  • Error messages for invalid requests have new text, and some have a more specific errorCode.
  • The status filter of building blocks in version 1 and 2 and the status.status field of building blocks in version 2 are deprecated. Use healthStatus and action.

New meshObject API Reference, Clearer Errors and More Sort Options​

Audience: User

Description​

The meshObject API reference at https://docs.meshcloud.io/api/introduction/ now comes from the meshStack code, so it shows exactly what the API accepts and returns. You can pick the API version on each page and link to it with ?version=v2. Each page shows a realistic example for each type and the key that the path takes, such as :uuid. The tables of deprecated versions and the OpenAPI specifications and Postman collections that you can download, including the metering API, come from the same source.

When a request is invalid, the error names the field or parameter that is wrong. For the target of a building block, it names the missing field: name for a workspace, uuid for a tenant.

You can sort building blocks in version 2 by the same keys as in version 1, and platforms, landing zones and payment methods by createdAt.

Tenant Usage Reports Without Tags No Longer Block the Report API​

Audience: User

Description​

Some older tenant usage reports have no tags stored for their project. Such a report could stop tenant usage reports from reaching the meshTenantUsageReport API, so the API returned no reports for your meshStack. We now treat these reports as reports with empty tags, and the API returns all your tenant usage reports again.

Fix meshStack CLI Browser Login Still Failing for Some Users​

Audience: User

Description​

On some meshStack instances, users still got the error "Offline tokens not allowed for the user or client" when they logged in with the meshStack CLI through the browser, even after the fix in 2026.41.0. Their Keycloak realm did not give users the default roles they need for a CLI login. This update repairs the default roles for all existing and new users. The repair takes effect within a week after your meshStack is updated. Logins with an API key were not affected.

Aborted Building Block Runs Show the Review Aborted Run Action​

Audience: User

Description​

When the latest run of a Building Block is aborted, including a run whose approval you rejected, the Building Block now shows the "Review Aborted Run" action. The meshObject API reports it as REVIEW_ABORTED_RUN. The health status stays as it was.

Add Only Permissions to an API Key That You Hold Yourself​

Audience: User

Description​

When you create or edit an API key in the panel, or with your meshStack CLI login, you can now only add permissions that you hold yourself. Before, the panel let you add any permission that API keys support, even one that your role does not have.

A few permissions exist for automation only and no role holds them, for example the permissions for Terraform state or for importing tenants. You can still add these to an API key, as before.

When you edit an API key, you can keep or remove every permission that is already on it, even one that you do not hold. The panel only offers the permissions that you can add.

Organization admins now hold the admin permission to create and update users, so that they can still add it to API keys for user provisioning.

Tenant Usage Reports Open Again in meshStacks That Had GitHub Platforms​

Audience: User

Description​

If your meshStack had GitHub platforms before we retired that platform type, meshStack stopped updating the tenant properly. Since then, workspace and project members could not open the tenant usage reports of new tenants. Tenants that became managed could also still show up as unmanaged tenants. We fixed the stored data of your former GitHub tenants.

Payment Method Usage Percentage Updates Right After an Amount Change​

Audience: User

Description​

When you change the amount of a payment method, the used and remaining percentage now reflect the new amount right away. Before, the percentage kept using the old amount for up to two hours, so it did not match the remaining amount shown next to it. This applies to changes in the admin area and through the meshObject API.

Building Block Runner API Reports Runner Activity in status​

Audience: User

Description​

Breaking Change (Preview API): The meshBuildingBlockRunner API now returns lastSeen and lastKnownVersion in a new status section instead of in metadata. metadata now holds only what identifies a runner, and status holds what meshStack knows of it: when the runner was created (status.lifecycle.createdOn), when it last polled for work and which version it reported. If you read lastSeen or lastKnownVersion from metadata, read it from status instead. metadata.createdOn stays for now but is deprecated, so read the creation time from status.lifecycle.createdOn.

How to use​

terraform-provider-meshstack 0.26.8 and earlier read metadata.last_seen, which stays empty against this meshStack version. Update the provider to 0.27.0 or later, which reads status.last_seen and status.last_known_version.

Faster and More Reliable CSV Export of Chargeback Statements​

Audience: User

Description​

You can now export all your chargeback statements to CSV at once, also when your organization has several years of chargeback data. Before, a large export could take minutes or not complete at all. We changed how meshStack builds the export, so that it is several times faster.

See Which Users Are Disabled in User Bindings and User Groups​

Audience: User

Description​

Project user bindings, workspace user bindings and workspace user groups in the meshObject API now tell you which users are disabled, for example by SCIM provisioning. A disabled user keeps their bindings and group memberships, so that their access returns when the user is enabled again. Until then, the user has no access.

Until now, workspace API keys and building block runs could read these bindings and groups, but could not see that a user was disabled, because reading users needs an administrator permission. A building block that copies project members into another system could therefore sync users that no longer have access. Now it can skip them.

Workspace User Counts Update Right After Access Changes​

Audience: User

Description​

When you invite users, change a role or remove a user in the access management of your workspace, the user counts in the Access Management tab and on the Users card of the workspace overview now update right away. Before, you had to reload the page to see the new numbers.

No More False Unsaved Changes Warning on Building Block Definition Tags​

Audience: User

Description​

When you opened the Tags tab of a Building Block Definition and left it without editing anything, meshStack could still ask whether you want to discard your changes. This happened when a multi-select tag had no value, when a number tag was stored, when the stored tags were in a different order than the tag schema, or when a stored tag was no longer part of the tag schema. You now only get the warning after you actually change a tag.

Long Workspace Names Show in Full in the Context Switcher​

Audience: User

Description​

We now show long workspace and project names in the top navigation in full when the navigation bar has room. Before, these names were cut off with an ellipsis after a fixed width, even when there was plenty of space left. Names are shortened only when the navigation bar is too narrow or a name is very long.

ISO 8601 Dates in meshObject Content of Event Logs​

Audience: User

Description​

Event logs that contain a meshObject in their content now write dates such as createdOn and deletedOn as ISO 8601 strings, for example "2026-10-19T14:42:20.462Z". This is the same format the meshObject API uses, so you can parse the event content with the meshObject API schema. Before this fix, these dates were written as epoch numbers. This affects events of workspaces, projects, tenants, platforms, platform types, landing zones, tag definitions, payment methods, integrations and building block runners.

How to use​

If your client reads these dates as numbers, change it to read ISO 8601 strings. Events that were created before this fix keep their epoch numbers, so a client that reads older events needs to accept both formats.

resolutionHint in API Error Responses Is Now terraformProviderVersionHint​

Audience: User

Description​

We renamed the resolutionHint field of meshStack API error responses to terraformProviderVersionHint, because it only tells you that your terraform-provider-meshstack version is too old for the resource you use. Error responses without such a hint no longer include the field.

Create API Keys With meshStack CLI Credentials Like in the Panel​

Audience: User

Description​

When you log in with the meshStack CLI and use these credentials for the meshObject API, for example with tofu plan or tofu apply, you can now create and update API keys with the same permissions that you can assign in the panel. Before, the API rejected some permissions, for example the admin permissions to delete payment methods or to manage project role bindings, even though the panel accepted them.

This needs the full access level in the CLI login. With a lower access level, and for API keys that manage other API keys, you can only assign permissions that you hold yourself.

Custom Platform Tenants Fail When No Platform Tenant ID Can Arrive​

Audience: User

Description​

A tenant on a custom platform no longer stays in progress forever when its Platform Tenant ID never arrives. The replication of the tenant now fails when the Building Block that reports the Platform Tenant ID fails, or when the tenant has no such Building Block at all. During the first 30 minutes after the tenant was created, the tenant stays in progress and already shows the reason. You see the reason in the replication status of the tenant and in the tenant overview of the admin area. Once you fix the Building Block and run it again, the tenant replicates successfully.

Mention Building Block Definitions in Building Block Summaries​

Audience: User

Description​

You can now mention a building block definition in a building block summary with @buildingblockdefinition[]. It shows the definition's symbol, name and owning workspace, just like the mentions of building blocks, projects and tenants. Every mention now opens the view that fits you, for example the definition in your marketplace, or its management view when your workspace owns the definition.

Fixed SCIM Group Membership Changes That Were Not Audited or Replicated​

Audience: User

Description​

When your identity provider sent many SCIM group membership changes in a short time, meshStack could skip some of them. For a skipped change, we did not write the audit event, did not trigger the building block runs of the affected workspaces, and did not replicate the new membership. We now process every membership change that arrives via SCIM, also while we are still processing earlier ones.

Audience: User

Description​

When you import a building block definition from the meshStack Hub, we now fill in the logo the module declares in its symbol field.

Deactivated Users No Longer Receive Emails About Expiring API Keys​

Audience: User

Description​

We already stopped sending workspace emails to users who were deactivated in meshStack, for example by your identity provider via SCIM, and to invited users who have not accepted their invitation yet. Until now, the email about API keys that expire soon was an exception and still went to these users. This is no longer the case: we now send this email only to active users who are Workspace Owner, Workspace Manager or Organization Admin of the API key's workspace, also when they have the role through a user group.

Run Control Decides Who Triggers and Aborts Building Block Runs​

Audience: User

Description​

The run control setting of a building block definition now decides who may trigger and abort its runs. With "Platform Team and Workspace Users", workspace users can do both, and meshPanel shows them the "Abort run" button. With "Platform Team Only", only the platform team can, so Workspace Owners and Managers can no longer abort these runs. Approving or rejecting a run that waits for approval always stays with the platform team.