Skip to main content

Release 2026.46.0

· 16 min read
meshcloud

Release period: 2026-11-04 to 2026-11-11

This release includes the following issues:

  • Go Back to the Building Block Definitions List From the Breadcrumb
  • Purge Service Instances via the meshObject API
  • Find the Actions of a meshBuildingBlock in the API Response
  • Platform Teams Can Purge Their Building Blocks Through the meshObject API
  • meshStack CLI Hints Name Your Workspace and Show the Setup for Pipelines
  • Manage Published Service Brokers After Deactivating Your Private Service Broker
  • Retired meshObject API Endpoints Answer the Same Way for Every Caller
  • New Overview Tab for Projects
  • Add Building Blocks on One Page as a Feature Preview
  • Building Block Definitions in Platform Team Automation Only
  • Building Blocks Can Read the Landing Zone of Their Tenant
  • Workspaces Owning Runners or Integrations Can No Longer Be Deleted
  • Workspaces Owning Platforms or Landing Zones Can No Longer Be Deleted
  • Security Fix: Access Control Issue (SA-2026-03)
  • Pick Single Landing Zones for a Building Block Definition in the Panel
  • Projects and Building Blocks Stay Out of Your Admin Workspace
  • AI Agents Find the Agent Context From meshPanel and the API
  • Deprecated Fields Removed from the meshBuildingBlockDefinition v1-preview API
  • Deprecated Fields Removed from the meshBuildingBlock v2-preview API
  • Faster Runs After a Bulk Upgrade of Many Building Blocks
  • Fix Platform Contributor Permissions on Landing Zones
  • Publication Status of Definitions on the Platform Builder Dashboard
  • meshCommunication List Includes Workspace-Level Building Blocks
  • New Projects First in the Marketplace Project Selection
  • Longer Building Block Names in the Tenant List
  • Simplified Project Creation
  • Building Block Dependencies with a Single Option Are Selected Automatically
  • Restrict Building Block Definitions to Single Landing Zones
  • Recommendation for the Execution Mode of Terraform Building Blocks
  • See All Building Block Runs When Run Control Is Open to Your Workspace

Ticket Details​

Go Back to the Building Block Definitions List From the Breadcrumb​

Audience: User

Description​

When you look at a building block definition, the breadcrumb now has a "Definitions Overview" step. Click it to go straight back to the list of building block definitions. Before, the "Building Blocks" step took you to the list of building blocks instead. This works in the Platform Builder and in the Administration area.

Purge Service Instances via the meshObject API​

Audience: User

Description​

You can now purge service instances via the meshObject API. Use this to clean up service instances whose service broker is no longer available: meshStack removes the service instance and its service bindings right away and does not call the service broker. Until now, you could only do this in meshPanel.

How to use​

Delete the service instance with the purge option set. Your API key needs the permission to purge service instances of service brokers owned by your workspace. API keys with the admin permission to delete service instances can purge any service instance. Purging does not clean up the resources that the service broker created, so remove them separately if needed.

Find the Actions of a meshBuildingBlock in the API Response​

Audience: User

Description​

A meshBuildingBlock (v2-preview) in the meshObject API now carries links for its actions (triggerRun and forcePurge) whenever you may take them, as a meshBuildingBlockRun does for approve and abort. Your scripts can tell from a missing link that you may not take the action.

Platform Teams Can Purge Their Building Blocks Through the meshObject API​

Audience: User

Description​

The workspace that owns a building block definition can now purge its building blocks through the meshObject API. Before, only admins could. A purge leaves the resources of the building block in place.

meshStack CLI Hints Name Your Workspace and Show the Setup for Pipelines​

Audience: User

Description​

The meshStack CLI login command that meshPanel suggests now includes the workspace you are working in, so the CLI no longer asks you for one. You find this command on the API keys pages, on the CLI logins page of your profile and next to the OpenTofu snippet of a building block in the marketplace.

When you create an API key, meshPanel now also shows the environment variables that a CI/CD pipeline sets to use the key with the meshStack CLI and the meshStack Terraform provider, and how to check that the pipeline can log in.

Manage Published Service Brokers After Deactivating Your Private Service Broker​

Audience: User

Description​

We fixed a bug where published service brokers could stay active with no way to deactivate them. When you deactivated your private service broker, the "Service Broker" list showed the whole entry as deactivated and disabled the link to its published service brokers. The published service brokers were not deactivated, so their services stayed available in their marketplaces. You can now open the published service brokers of a deactivated private service broker and deactivate them there. To prevent this, you can now only deactivate a private service broker after you have deactivated all of its approved published service brokers. You also can no longer publish a deactivated private service broker.

Retired meshObject API Endpoints Answer the Same Way for Every Caller​

Audience: User

Description​

When you call a retired meshObject API endpoint, you now always get a 406 response that names the version to upgrade to, whatever permissions your API key or user has. Before, a caller without the permission of the old endpoint got a 403 instead and did not see the upgrade hint.

New Overview Tab for Projects​

Audience: User

Description​

Every project now has an Overview tab next to the Tenants tab. It shows you the project's tenants with their building blocks in one place, so you no longer have to open each tenant to see what runs in it. Workspace managers also see the costs of last month and the actions that need their attention, such as waiting access requests or a missing payment method. When you open a project, you still land on the Tenants tab, and you can switch to the Overview at any time.

Add Building Blocks on One Page as a Feature Preview​

Audience: User

Description​

You can now add a building block or a marketplace service on one page instead of going through the three-step wizard. Pick the project and one of its tenants, fill in the inputs and add it. The name is suggested from your inputs and shown in the page title as you type. The form shows right away which projects and tenants cannot take the building block and why, for example a violated policy or a platform or landing zone the building block does not support. Workspace building blocks use the same page without the project and tenant fields.

How to use​

Open a service in the marketplace, click "Add to project" or "Add to workspace", and click "Try the new experience" at the top of the page. You can switch back to the wizard at any time with "Back to old experience".

Building Block Definitions in Platform Team Automation Only​

Audience: User

Description​

The setting "Use in Landing Zones only" of a building block definition is now called "Use in platform team automation only", and you can now set it for workspace building block definitions too. Such a definition stays hidden from the marketplace, and the meshBuildingBlockDefinition API now leaves it out of the list of other workspaces. Besides a landing zone that lists it as a mandatory or recommended building block, a composition building block definition of the same workspace can now add a building block of it. A composition building block definition is a building block definition that creates other building blocks. Application teams cannot add such a building block on their own, neither in meshPanel nor with their own API key, the meshStack CLI or Terraform.

How to use​

Turn on "Use in platform team automation only" in the general settings of the building block definition. Landing zones that use the definition as a mandatory or recommended building block keep working as before. In the meshBuildingBlockDefinition API, the field keeps its name useInLandingZonesOnly.

Building Blocks Can Read the Landing Zone of Their Tenant​

Audience: User

Description​

A new input source, "Landing Zone Identifier", gives a tenant building block the identifier of the landing zone of the tenant it is added to. You can now write one building block definition that acts differently per landing zone, for example create a network only on a "networked" landing zone, instead of asking users to pick the landing zone again as an input. When a tenant moves to another landing zone, its building blocks that read the identifier or a landing zone tag run again with the new values. These runs are labelled "Landing zone changed" in the run list, and you can filter for them there.

How to use​

When you add an input to a tenant-level building block definition, pick "Landing Zone Identifier" as its source. In the meshObject API, use the assignment type LANDING_ZONE_IDENTIFIER. Workspace-level building block definitions do not offer this source, because only a tenant has a landing zone.

Workspaces Owning Runners or Integrations Can No Longer Be Deleted​

Audience: User

Description​

A workspace can now only be deleted once it owns no building block runners and no integrations. Before, deleting such a workspace left them behind without an owner. Deletion now fails with a message that names each runner and integration in the way, both in meshPanel and in the meshObject API. In the admin area, the workspace deletion dialog lists them before you confirm. Delete the integrations first, then the runners they use.

Workspaces Owning Platforms or Landing Zones Can No Longer Be Deleted​

Audience: User

Description​

A workspace can now only be deleted once it owns no platforms and no landing zones. Before, deleting such a workspace left its platforms and landing zones behind without an owner, so only an admin could still manage them. Deletion now fails with a message that names each platform and landing zone in the way, both in meshPanel and in the meshObject API. In the admin area, the workspace deletion dialog lists them before you confirm.

How to use​

Delete the platforms and landing zones first, or transfer the ownership of a platform to another workspace. Deleting a platform also removes its landing zones.

Security Fix: Access Control Issue (SA-2026-03)​

Audience: User

Description​

We fixed an access control issue in meshStack. No specific action is required: upgrade at your next maintenance window as usual. meshStack SaaS customers receive this fix automatically. See security advisory SA-2026-03 for details: https://feedback.meshcloud.io/knownissues/

Pick Single Landing Zones for a Building Block Definition in the Panel​

Audience: User

Description​

When you choose the supported platforms of a building block definition, you can now expand each platform and tick single landing zones. Your definition is then offered only to tenants in those landing zones. Ticking the whole platform still covers all its landing zones, including landing zones added later.

Projects and Building Blocks Stay Out of Your Admin Workspace​

Audience: User

Description​

Your admin workspace is where you manage meshStack, so it does not run workloads of its own. We now enforce this for workspace building blocks too: you can no longer create a workspace building block in your admin workspace. Creating a project there was already refused.

AI Agents Find the Agent Context From meshPanel and the API​

Audience: User

Description​

An AI agent that you give only the URL of your meshStack now finds our agent context on its own, before it changes anything. Every response of meshPanel and of the meshStack API, error responses such as a failed login included, links the agent context in its HTTP headers. The agent context tells the agent how to log in as you and which rules to follow.

Deprecated Fields Removed from the meshBuildingBlockDefinition v1-preview API​

Audience: User

Description​

We removed the fields that the meshBuildingBlockDefinition and meshBuildingBlockDefinitionVersion v1-preview APIs kept for compatibility, so their contracts are ready for General Availability. The media types stay v1-preview for now.

  • A definition version names its dependencies only in spec.dependencyDefinitionRefs, which holds {uuid, kind} objects. The deprecated spec.dependencyDefinitionUuids, a plain array of UUIDs, is gone.
  • A meshPlatform entry in spec.supportedPlatforms requires uuid. The undocumented name alias is gone.
  • Deleting a definition answers 204 No Content, because the definition is gone once the request returns.
  • Listing the versions of a definition that does not exist or that you may not read gives an empty page. It used to answer 404 Not Found or 403 Forbidden.

Deprecated Fields Removed from the meshBuildingBlock v2-preview API​

Audience: User

Description​

We removed the fields that the meshBuildingBlock v2-preview API kept for compatibility, so its contract is ready for General Availability. The media type stays v2-preview for now.

  • Parents are named only by spec.parentBuildingBlockRefs, which is now required. Each entry is a meshObject reference with kind and uuid. The deprecated spec.parentBuildingBlocks is gone.
  • spec.buildingBlockDefinitionVersionRef requires kind next to uuid.
  • The deprecated status.status field, the status list filter and the status sort key are gone. Read status.healthStatus and status.action, and filter with healthStatus and action. To wait for a run that your request triggered, follow Waiting for a Run. The meshBuildingBlock v1 API keeps its status field, filter and sort key.
  • A platform team that may delete the building blocks of its definitions can now do so through the API as well, in any workspace, as it already can in the Panel.

Terraform users: you need meshStack Terraform provider v0.27.1 or later for building blocks. Releases before v0.24.4 do not send spec.parentBuildingBlockRefs, so meshStack rejects their writes with 400 Bad Request. Releases before v0.27.1 wait for a building block run through status.status.

Faster Runs After a Bulk Upgrade of Many Building Blocks​

Audience: User

Description​

When you bulk upgrade many building blocks and let them run afterwards, we now hand their runs to the building block runners in one batch per workspace. Until now we did this once per upgraded building block, so a bulk upgrade of a thousand building blocks in one workspace created a large backlog and their runs started late. In rare cases a building block could also run twice. If we cannot start the runs, the summary now says which building blocks were upgraded without a run, so you can trigger a run for them.

Fix Platform Contributor Permissions on Landing Zones​

Audience: User

Description​

We fixed a permission check in the meshLandingZone API. A workspace that contributes landing zones to a platform could update and delete every landing zone on that platform, including those that it does not own. We also tightened the permissions for creating landing zones. Before, platform owners and contributors could create landing zones and assign them to another workspace. To create a landing zone for another workspace, use an API key with admin rights. If your automation used the API in one of these ways, it now gets a 403 response.

Publication Status of Definitions on the Platform Builder Dashboard​

Audience: User

Description​

The Building Block Definitions card on the Platform Builder dashboard now shows the publication status next to each definition, for example Published or Draft. You can now see at a glance which definitions are live for your users, without opening the definitions overview.

meshCommunication List Includes Workspace-Level Building Blocks​

Audience: User

Description​

When you list meshCommunications with an API key of your workspace, the list now also contains the communications that target a workspace-level building block of your workspace. Before, you could fetch such a communication by its UUID, but it was missing from the list.

New Projects First in the Marketplace Project Selection​

Audience: User

Description​

When you add a service from the marketplace to a project, the project selection now lists the projects you created within the last day first and marks them as "NEW", like the workspace overview does. So you find a project you have just created right away.

Longer Building Block Names in the Tenant List​

Audience: User

Description​

The building block badges in the tenant list now show as much of the name as the column has room for. Before, every name was cut off after 12 characters. You can still hover a badge to see the full name.

Simplified Project Creation​

Audience: User

Description​

With the new feature preview "Simplified project and tenant creation", "Create Project" opens one dialog right where you are instead of the step-by-step wizard. To try it, select "Try the new experience" in the Create Project wizard. Stay tuned for the simplified tenant creation dialog.

Building Block Dependencies with a Single Option Are Selected Automatically​

Audience: User

Description​

When you order a building block that depends on another building block, and exactly one matching building block exists, we now select it for you. You no longer have to pick it from a list with a single entry. This also applies when you upgrade a building block or change its dependencies. If several building blocks match, you still choose one yourself.

Restrict Building Block Definitions to Single Landing Zones​

Audience: User

Description​

You can now restrict a building block definition to single landing zones, next to platform types and platforms. In the meshBuildingBlockDefinition API, spec.supportedPlatforms accepts meshLandingZone references as a third kind of entry.

A platform type or platform you name still covers every landing zone of it, including landing zones added later. A landing zone you name allows only tenants in that landing zone. The marketplace and the add building block dialog now offer only the tenants your definition supports, and we reject adding a building block to any other tenant.

How to use​

Reference a landing zone by its identifier, the metadata.name of the meshLandingZone:

"supportedPlatforms": [ { "kind": "meshLandingZone", "name": "my-landing-zone" } ]

Recommendation for the Execution Mode of Terraform Building Blocks​

Audience: User

Description​

Asynchronous Terraform is an advanced option for custom runners and workarounds. Prefer synchronous runs. For an asynchronous pipeline, use a GitHub workflow, Azure DevOps pipeline or GitLab pipeline implementation. The Panel and the docs now show this recommendation.

See All Building Block Runs When Run Control Is Open to Your Workspace​

Audience: User

Description​

When a Building Block Definition sets its run control to "Platform Team and Workspace Users", you now see every run of your Building Block, not only the latest one. The new Building Block view in your Workspace and Tenant shows a Runs tab, and you can open each run to read its logs, inputs and outputs, or abort it while it is in progress.

When the run control is set to "Platform Team Only", nothing changes: you keep seeing only the latest run on the Overview tab.

How to use​

Open a Building Block from your Workspace or Tenant overview in the new Building Block view and select the Runs tab. Select a run to open its details.