This release includes the following issues:

• Fix Table Overflow in Admin Area Tenant List
• Fixed Building Block Definition Creation Failures for SSH Git Repositories
• Loading Indicator for Building Block Inputs in the Marketplace
• Building Block Definition Can No Longer Be Added as Its Own Dependency
• Building Block Runs Now Support Incremental Output Delivery
• Fix AWS Platform Config Flag Not Round-Tripped
• Remove Non-Functional AzureRG Platform Config Flag
• Hide Access Request Tabs and Actions if Four-Eye Principle Is Disabled
• Added STACKIT Storage Bucket to Getting Started Experience
• STACKIT Is Now Available as a Platform Type
• New Favicon for the meshStack Panel

Ticket Details​

Fix Table Overflow in Admin Area Tenant List​

Audience: User

Description​

We fixed a display bug in the admin area tenant list where the table would break the page layout on smaller screens. When the table ran out of space to compact further, it overflowed its container and caused a broken horizontal scrollbar across the whole page. The table now scrolls horizontally within its own container, keeping the rest of the layout intact.

Fixed Building Block Definition Creation Failures for SSH Git Repositories​

Audience: User

Description​

A third-party dependency contained a bug that caused git access checks to fail with "Connection reset" errors on certain container environments. This could prevent users from creating or testing building block definitions that use SSH-based git repositories. We have updated the dependency to a version that fixes this issue.

Loading Indicator for Building Block Inputs in the Marketplace​

Audience: User

Description​

When configuring a building block in the marketplace, the inputs screen now shows a loading indicator while fetching the configuration data. Previously, the screen would appear blank with no feedback during loading, which could be confusing.

Building Block Definition Can No Longer Be Added as Its Own Dependency​

Audience: User

Description​

When configuring dependencies for a building block definition, you can no longer select the definition itself as a dependency option. The building block definition is now excluded from the dependency selection list, making it clearer upfront that self-referencing is not allowed. The backend has always prevented this configuration - this is purely a UI improvement.

Building Block Runs Now Support Incremental Output Delivery​

Audience: User

Description​

Building block runners can now send outputs incrementally across multiple updates and then send a final status change without re-sending all outputs. This resolves issues where runs were incorrectly marked as failed when the runner sent outputs in separate API calls during execution.

Fix AWS Platform Config Flag Not Round-Tripped​

Audience: User

Description​

We fixed an issue where the allowHierarchicalOrganizationalUnitAssignment flag on AWS platform configurations was not correctly returned when reading platforms via the meshObject API. This caused API clients like the Terraform provider to report inconsistencies after applying a configuration.

Remove Non-Functional AzureRG Platform Config Flag​

Audience: User

Description​

We removed the allowHierarchicalManagementGroupAssignment field from the AzureRG platform configuration in the meshObject API. This field was never operational for AzureRG platforms and was always returned as false. If you are setting this field in your API requests for AzureRG platforms, you can safely remove it.

Hide Access Request Tabs and Actions if Four-Eye Principle Is Disabled​

Audience: User

Description​

We now hide all access request-related tabs and actions when the Four-Eye Principle (4EP) is not enabled in your meshStack deployment. This keeps the UI clean and avoids confusion by only showing features that are actually available.

The following items are now hidden when 4EP is not enabled:

• The "Access Requests" tab in the workspace access control area
• The "Project Access Requests" tab in the workspace access control area
• The "Access Requests" sub-tab under the Projects tab in the workspace control plane
• The "Access Requests" tab in the project control plane
• The "Access Requests" tab in the Admin Area
• The "Pending Access Requests" action in the Workspaces actions dropdown in the Admin Area

Added STACKIT Storage Bucket to Getting Started Experience​

Audience: User

Description​

We added a STACKIT Storage Bucket building block definition to the platform builder getting started page. You can now quickly deploy a STACKIT storage bucket directly from the welcome experience, just like you could already do with AWS, Azure, and GCP storage buckets.

STACKIT Is Now Available as a Platform Type​

Audience: User

Description​

We've added STACKIT to the list of available platform types in meshStack. This means you can now integrate STACKIT as a platform in meshStack and manage your STACKIT resources.

How to use​

When creating a new platform, simply select STACKIT from the list of platform types to get started with your integration.

New Favicon for the meshStack Panel​

Audience: User

Description​

We have updated the meshStack panel favicon to reflect our current product logo.

This release includes the following issues:

• Marketplace No Longer Shows a Platform Builder Banner Above Services
• Improved Visual Design of Featured Service Cards in the Marketplace
• Cleaner Building Block Inputs View
• Fix Saving GitLab Building Block Definitions
• Fix Global Group Binding to Projects via meshObject API
• Fix Sidebar Navigation Collapse/Expand Animation
• Optional Git Reference Support for Azure DevOps Building Block Definitions
• Fix Content Shifting When Opening Modals
• Fix Deploying Draft Building Blocks Without Inputs
• Fix Stale Form Data When Creating a New Building Block Definition
• Skip Workspace Selection When Importing a Building Block Definition
• Redesigned Platform Builder Welcome Experience
• Abort Building Block Runs in Pending, Waiting, or Dependency States
• Show Missing Outputs When Building Block Fails
• Input Validation for CODE Type Inputs in Building Block Definition Versions

Ticket Details​

Marketplace No Longer Shows a Platform Builder Banner Above Services​

Audience: User

Description​

The "Open Platform Builder" banner that used to sit above the services in the marketplace has been removed. Instead, a card now appears at the end of the service list, so you can browse services without a banner pushing everything down.

Improved Visual Design of Featured Service Cards in the Marketplace​

Audience: User

Description​

We've refreshed the look of featured service cards in the marketplace. They now display with a clean white background and a blue border, matching the style of regular service cards while still standing out clearly. We've also removed the service count from the "All Services" heading to keep the interface cleaner and less cluttered.

Cleaner Building Block Inputs View​

Audience: User

Description​

When you view the details of a building block, we now show you only the relevant inputs first, while static inputs (managed automatically by the platform) are hidden by default. Should you need to see the static inputs, you can always reveal them by clicking the corresponding button. This makes it easier to focus on the fields that actually matter to you.

Fix Saving GitLab Building Block Definitions​

Audience: User

Description​

We fixed a bug where updating an existing building block definition with a GitLab implementation would always fail with a "Could not read request body" error. You can now update GitLab building block definitions without errors.

Fix Global Group Binding to Projects via meshObject API​

Audience: User

Description​

We fixed a bug where assigning a global group to a project via the meshObject API always failed with a "group does not exist" error, even though the group existed. You can now successfully assign global groups to projects using the meshObject API.

Fix Sidebar Navigation Collapse/Expand Animation​

Audience: User

Description​

We fixed a visual glitch in the sidebar navigation where collapsing or expanding a section caused a small jump at the end of the animation. The sidebar now collapses and expands smoothly.

Optional Git Reference Support for Azure DevOps Building Block Definitions​

Audience: User

Description​

You can now specify an optional Git reference (e.g. a branch or tag like refs/heads/my-branch) when configuring an Azure DevOps pipeline building block definition. This allows you to pin a building block to a specific branch or tag of your pipeline's repository.

When no Git reference is provided, Azure DevOps uses its default branch as before.

Fix Content Shifting When Opening Modals​

Audience: User

Description​

We fixed a small visual bug where the page content would shift a bit when opening a modal dialog.

Fix Deploying Draft Building Blocks Without Inputs​

Audience: User

Description​

We fixed a bug where the "Deploy building block" button never became active when deploying a draft building block for testing that has no user-configurable inputs (all inputs are set statically by the definition).

Fix Stale Form Data When Creating a New Building Block Definition​

Audience: User

Description​

We fixed a bug where the "General Information" form in the building block definition creation wizard was pre-filled with data from a previously created building block definition.

Skip Workspace Selection When Importing a Building Block Definition​

Audience: User

Description​

When you import a building block definition from the meshStack Hub and you only have access to a single workspace, we now skip the workspace selection step and navigate you directly to the new definition form. This saves you an unnecessary click and makes the import flow faster.

Redesigned Platform Builder Welcome Experience​

Audience: User

Description​

We redesigned the welcome section of the platform builder dashboard to guide you through the initial setup of your platform with a clear, step-by-step onboarding flow. The new experience walks you through creating your first Building Block Definition and integrating your first platform, with quick-start examples for AWS, Azure, and GCP.

How to use​

When you open the platform builder dashboard as a new user, you will see the updated welcome section with guided steps. Each step includes cards that link directly to relevant resources like the meshStack Hub for Building Block examples, or pre-filled platform integration wizards for supported cloud providers.

Abort Building Block Runs in Pending, Waiting, or Dependency States​

Audience: User

Description​

You can now abort building block runs that are pending (queued but not yet started), waiting for input, or waiting for a dependent building block to complete. This gives you full control to abort stuck or unwanted runs, regardless of their current state.

Show Missing Outputs When Building Block Fails​

Audience: User

Description​

When a building block fails because it did not emit all outputs defined in the building block definition, you now see a clear failure reason and which specific outputs are missing. Previously, the building block was just marked as failed without any details, making it hard to understand what went wrong.

Input Validation for CODE Type Inputs in Building Block Definition Versions​

Audience: User

Description​

When creating or updating a building block definition version via the API, we now validate that inputs of type CODE have their argument provided as a JSON-escaped string. If you pass a raw JSON object instead of an escaped string, the API returns a clear error message explaining what went wrong. Please refer to our API documentation for details on the correct format.

This release includes the following issues:

• Improved Building Block Definition Journey Wizard Visibility
• Fix Featured Star Icon not Showing in Workspace Services
• Improve Use of Identifiers in meshStack UI
• Filter Marketplace Catalog by Tags
• Fix Broken Breadcrumb on the Create New Platform Screen
• Fix external links in Building Block Run steps not opening on click
• Building Block Definition Icon Size Validation

Ticket Details​

Improved Building Block Definition Journey Wizard Visibility​

Audience: User

Description​

We moved the building block definition journey wizard to a more prominent position at the top of the control plane page header. This makes it easier for you to follow the three-step process of creating, testing, and publishing your building block definition. The wizard now also features an updated visual style that is consistent with the platform builder dashboard.

Fix Featured Star Icon not Showing in Workspace Services​

Audience: User

Description​

The featured star icon was not appearing next to featured services in the workspace services admin view, even when a service had been marked as featured. We fixed this by correctly including the featured status in the API response, so the star now shows up as expected.

Improve Use of Identifiers in meshStack UI​

Audience: User

Description​

We improved the way identifiers are displayed throughout the meshStack user interface. Identifiers such as project, workspace, tenant, platform, and building block UUIDs are now shown using a new, consistent identifier widget. This makes it easier to recognize, copy, and use these identifiers across the platform.

How to use​

You can now click on any displayed identifier to copy it to your clipboard. The new identifier widget is available in all major areas of the UI where identifiers are shown, providing a more consistent and user-friendly experience.

Filter Marketplace Catalog by Tags​

Audience: User

Description​

You can now filter the marketplace catalog by tags. When browsing the catalog, you can select tags to narrow down the list of building blocks to only those that match specific tag values.

Fix Broken Breadcrumb on the Create New Platform Screen​

Audience: User

Description​

We fixed a bug in the platform builder where the breadcrumb on the "create new platform" screen incorrectly displayed the raw route parameter "New/:platformTypeHref" instead of "New Platform". The breadcrumb now correctly shows "New Platform" when you navigate to create a new platform.

Fix external links in Building Block Run steps not opening on click​

Audience: User

Description​

We fixed a bug where clicking external links (like GitLab CI/CD pipeline links) in building block run steps would not navigate to the URL. The links would only open when using the right-click context menu.

Building Block Definition Icon Size Validation​

Audience: User

Description​

When creating or updating a building block definition via the meshBuildingBlockDefinition API, the icon symbol field now validates that base64-encoded image data does not exceed 100 KiB after decoding. This prevents large icon payloads from consuming excessive server resources. The validation also ensures that base64 data is properly formatted and rejects malformed base64 strings with a clear error message.

How to use​

When providing an icon symbol for your building block definition using a data URI (e.g., data:image/png;base64,...), ensure that the original image file does not exceed 100 KiB in size. If you encounter a validation error indicating that your icon exceeds the size limit, compress or resize your image and re-encode it to base64. HTTPS and HTTP URLs remain unaffected by this validation and can reference icons of any size.

This release includes the following issues:

• Custom Access Information Note for Platforms
• Extend Import Functionality of Hub
• Simplified Workspace Control Plane Feature Preview
• Featured Marketplace Services for Platforms and Building Blocks
• Skip Duplicate Email for Invited Users on Workspace Assignment
• Improved and Polished Tag Appearance
• Clearer Error Message for Building Block Definition Description Length
• Building Block Runs No Longer Block the Queue After Repeated Timeouts
• Fix Platform Identifier Uniqueness Check Across Workspaces
• Workspace Registration Now Works With Duplicate Display Names
• Fix Building Block CODE Output Type not Stored Correctly
• Streamlined Workspace Navigation for New Overview Experience
• Integrate Platforms via Terraform or Manual Setup

Ticket Details​

Custom Access Information Note for Platforms​

Audience: User

Description​

Platform admins can now add a custom free-text note to any platform under Settings > Configuration > Replication Config. This note is displayed to users on the platform access screen, providing a convenient way to share additional guidance, links, or instructions for accessing the platform.

How to use​

Navigate to your platform's control plane, go to Settings > Configuration > Replication Config, and enter your custom message in the "Access Information Note" field. Save your changes - the note will immediately appear for all users when they access a tenant on that platform.

Extend Import Functionality of Hub​

Audience: User

Description​

When importing a building block definition from the meshStack Hub, meshStack now pre-fills significantly more fields in the wizard when the module contains a meshstack_integration.tf file. This file provides a full description of the building block definition, including its variables, and meshStack uses it to populate the wizard automatically.

If a module does not contain a meshstack_integration.tf file, meshStack falls back to the previous behaviour.

Simplified Workspace Control Plane Feature Preview​

Audience: User

Description​

We introduced a new feature preview called "Simplified Workspace Control Plane". When enabled, the workspace control plane hides the separate Projects and Building Blocks tabs, giving you a cleaner and more focused layout for managing your cloud resources.

How to use​

Navigate to your Feature Previews in the user menu to opt in to the "Simplified Workspace Control Plane" feature preview. Once enabled, the Projects and Building Blocks tabs are removed from the workspace control plane, streamlining your navigation.

Featured Marketplace Services for Platforms and Building Blocks​

Audience: User

Description​

We added the ability to feature services in the marketplace. As a meshStack admin, you can now mark platforms and building block definitions as "featured" from the workspace services overview. Featured services appear in a dedicated highlighted section at the top of the marketplace catalog, making it easy for your users to discover recommended services at a glance.

Skip Duplicate Email for Invited Users on Workspace Assignment​

Audience: User

Description​

When you invite a new user to a workspace via invitation token, they now only receive the invitation email. Previously, an additional "Access to Workspace Granted" email was sent alongside the invitation, which was redundant and confusing. We fixed this so that invited users receive a single, clear invitation email until they accept the invite.

Improved and Polished Tag Appearance​

Audience: User

Description​

We refined the visual design of tags throughout meshPanel. Tags now feature a cleaner, more compact look with improved spacing, consistent use of theme colors, and comma-separated values for better readability. The "show more" controls are now styled more subtly to keep the focus on your tag content.

Clearer Error Message for Building Block Definition Description Length​

Audience: User

Description​

When you create or update a building block definition via the meshObject API with a description that exceeds 255 characters, you now receive a clear and actionable error message that tells you exactly what the issue is. Previously, the API would return a cryptic internal error.

Building Block Runs No Longer Block the Queue After Repeated Timeouts​

Audience: User

Description​

We improved how building block runs are prioritized in the execution queue. Previously, a building block run that had repeatedly timed out could block fresh building block runs from other workspaces from being picked up by the runner.

Now, new building block runs (that have never timed out) are always prioritized over runs that have previously timed out. This means a struggling building block no longer prevents other building blocks from being executed. Timed-out runs continue to retry, but with lower priority than fresh runs.

Fix Platform Identifier Uniqueness Check Across Workspaces​

Audience: User

Description​

When creating a new platform, we now correctly detect if the chosen identifier is already used by a platform in another workspace. Previously, the validation silently ignored this case, allowing you to submit the form with an identifier that was already taken (which then failed).

Workspace Registration Now Works With Duplicate Display Names​

Audience: User

Description​

You can now register a workspace even if another workspace already uses the same display name. Previously, workspace registration incorrectly rejected display names that were already in use, even though workspace display names in meshStack do not have to be unique (while identifiers have to be unique).

Fix Building Block CODE Output Type not Stored Correctly​

Audience: User

Description​

We fixed a bug where building block outputs defined with type CODE were incorrectly stored as STRING after a run. This caused the panel to not render the output value with code formatting, even when the building block definition explicitly configured the output as CODE.

Streamlined Workspace Navigation for New Overview Experience​

Audience: User

Description​

We streamlined the workspace navigation for users who opted into the new workspace overview experience. The Projects and Building Blocks tabs are now hidden from the main workspace navigation when you use the new overview, reducing clutter and avoiding redundant navigation options. Instead, you can manage expired project access and project access requests directly under the Access Control section.

Integrate Platforms via Terraform or Manual Setup​

Audience: User

Description​

When integrating a new platform in the Platform Builder, meshStack now guides you through choosing an integration method. If a Terraform module is available for the selected platform type, we show you a dialog with two options: open the meshStack Hub to integrate using the Terraform module, or configure the platform manually via the UI.

For platform types without a Terraform module, we skip the dialog and take you directly to the manual setup.

This release includes the following issues:

• Improved Stability During Nightly Tenant Replications
• Project Quota Tooltip on Workspace Overview
• Fix Tenant Deletion for Non-Marketplace Tenants at Global Location
• Removed Console Redirect for AKS Tenants
• Building Block Runner Simplifies Calling Tofu/Terraform Binary in Pre-Run Script
• Fix the Financials Dashboard Warning When Payment Methods Are Disabled
• Fix AWS Account Access Information in meshPanel When Using AWS Identity Store
• Fix Validation of Building Block Output Input Arguments
• Add Platform Builder Calls-to-Action
• Improved Invitation Acceptance Experience
• Add Myself Now Prompts for Reason with Four-Eye Principle
• Platform Builder Dashboard Cards for Building Block Definitions and Platforms
• API Key Dropdown Workspace List Always Reflects Current State
• Fix SSH Key and Known Hosts Handling in Building Block Implementation
• Platform Field is Now Read-only Text in Landing Zone Edit View

Ticket Details​

Improved Stability During Nightly Tenant Replications​

Audience: User

Description​

We improved the stability and reliability of the nightly tenant replication process by preventing excessive database load caused by unnecessary updates of the event system.

Project Quota Tooltip on Workspace Overview​

Audience: User

Description​

When you reach the project quota limit for your workspace, the "Create Project" button on the workspace overview now shows a popover explaining why project creation is blocked. Previously, the button was silently disabled with no hint about the reason.

Fix Tenant Deletion for Non-Marketplace Tenants at Global Location​

Audience: User

Description​

Previously, you could not delete any tenant at the global location from a project. We fixed this so that only the global marketplace tenant is protected from deletion. You can now remove other tenants at the global location, such as AWS or custom platform tenants, just like tenants at any other location.

Removed Console Redirect for AKS Tenants​

Audience: User

Description​

We removed the console redirect link for AKS tenants. Previously, AKS tenants displayed a sign-in URL that pointed to a non-usable URL. The console redirect is no longer set for AKS tenants.

Building Block Runner Simplifies Calling Tofu/Terraform Binary in Pre-Run Script​

Audience: User

Description​

The Tofu building block runner prepends the directory where the tofu (or legacy terraform) binary is located to the PATH environment variable when the (optional) pre-run script is executed during a building block run. That means you can now simply call tofu or terraform command in your pre-run scripts without resorting to a workaround discovering the binary location first.

Fix the Financials Dashboard Warning When Payment Methods Are Disabled​

Audience: User

Description​

We fixed an issue where the Financials dashboard (Admin Area > Organization > Dashboard) continued to show payment method warnings even when payment methods had been disabled in your meshStack configuration. Now, when payment methods are disabled, we no longer display payment method-related alerts or highlight the Financials section as having issues.

Fix AWS Account Access Information in meshPanel When Using AWS Identity Store​

Audience: User

Description​

Fixed an issue where sign-in information was not properly generated for AWS Accounts when the platform was configured to use the new AWS Identity Store IAM integration method.

Fix Validation of Building Block Output Input Arguments​

Audience: User

Description​

We fixed an issue where configuring a building block input with the "Building Block Output" assignment type could result in cryptic errors. meshStack now validates the argument format and provides clear error messages when the configuration is incorrect - for example, when the argument is missing, has an invalid format, or references an output key that does not exist on the parent building block definition.

Add Platform Builder Calls-to-Action​

Audience: User

Description​

We added some more calls-to-action (CTAs) for the Platform Builder throughout the Panel if the Platform Builder feature is enabled for a workspace. These CTAs make it easier for users to discover and access the Platform Builder when it is enabled for their workspace.

Improved Invitation Acceptance Experience​

Audience: User

Description​

We redesigned the invitation acceptance page with a clearer visual flow when the "User Invitation Tokens" setting is enabled. You now see distinct loading, success, and error states when accepting an invitation, making it easier to understand what is happening. After successfully accepting an invitation, a "Continue" button lets you proceed to meshStack at your own pace.

Add Myself Now Prompts for Reason with Four-Eye Principle​

Audience: User

Description​

When four-eye principle (multi-approval) is enabled in your meshStack instance, the "Add Myself" button in the workspace role mappings interface now proactively prompts you to provide a reason for your access request. Previously, this would fail with a "missing reason" error.

Platform Builder Dashboard Cards for Building Block Definitions and Platforms​

Audience: User

Description​

We added two quick-action cards to the platform builder dashboard. You can now navigate directly to building block definitions and platforms from the dashboard, making it faster to get started with creating infrastructure modules or connecting cloud providers.

API Key Dropdown Workspace List Always Reflects Current State​

Audience: User

Description​

When creating an API key, the workspace dropdown now includes workspaces you have recently created. You no longer need to refresh the page or re-login to see your new workspace in the list.

Fix SSH Key and Known Hosts Handling in Building Block Implementation​

Audience: User

Description​

We fixed some issues with SSH key and known hosts management when editing a building block implementation. The SSH private key was incorrectly shown as invalid after reloading the implementation tab - it now correctly reflects the saved state. Known hosts are now properly cleared when you switch from a custom SSH repository to a public one. Additionally, empty values for repository path and branch/ref are now correctly treated as absent, preventing building block execution failures caused by blank field submissions.

Platform Field is Now Read-only Text in Landing Zone Edit View​

Audience: User

Description​

When editing an existing landing zone, the platform field is now displayed as a read-only text field instead of a disabled dropdown. This makes it clear that the platform cannot be changed after creation and removes any confusion about why the dropdown could not be selected.

This release includes the following issues:

• AWS IAM Identity Center Integration Without SCIM Token
• Fix for Tenant Migration When Payment Methods are Disabled
• Pre-Run Script Support for OpenTofu Building Blocks
• Improved Sorting of Payment Methods by Amount Status
• Redesigned Welcome Experience in the Platform Builder
• Fix Initial Login for New Users
• Hide Actions Needed Card for Workspaces Without Projects
• GitHub Actions Building Blocks Default to Pass Only API URL
• Payment Method CSV Export Now Applies Active Filters and Sorting
• meshLocation API Now Exposes Lifecycle State

Ticket Details​

AWS IAM Identity Center Integration Without SCIM Token​

Audience: User

Description​

We added a new IAM integration option for AWS platforms: the AWS Identity Store API. meshStack integrates with this API using IAM roles, making it compatible with Workload Identity Federation (WIF), whereas the previous SCIM based API required configuration of a long-lived SCIM bearer token.

How to use​

In the AWS platform configuration, you can now select "AWS Identity Store API" as the IAM integration type. Configure your Identity Store ID, SSO Instance ARN, group name pattern, sign-in URL, and role mappings. You will need to update your IAM Policies to whitelist additional API calls for the Identity Store. For setup details, refer to the meshStack documentation at https://docs.meshcloud.io/integrations/aws/sso-setup/

Fix for Tenant Migration When Payment Methods are Disabled​

Audience: User

Description​

When payment methods are disabled in your meshStack setup, moving a tenant to another project that has no payment method set is now correctly allowed. Previously, the migration was incorrectly blocked even though payment methods were not required.

Pre-Run Script Support for OpenTofu Building Blocks​

Audience: User

Description​

You can now configure an optional pre-run script on your OpenTofu building block definition versions. This shell script executes after tofu init in the working directory where source files and tfvars are already in place.

How to use​

Pre-run scripts can set up secrets, generate provider configurations, or run pre-flight validation checks without modifying your OpenTofu module. The script can be set via meshPanel or the meshObject API, and is limited to 16 KiB.

The run log captures your script's stdout and stderr as a system message. You can write user messages for this step to a special file via the MESHSTACK_USER_MESSAGE environment variable. The run mode (APPLY, or DESTROY) is passed as the first argument. The full meshBuildingBlockRun object JSON is available on stdin, so you can use jq to read any field.

Improved Sorting of Payment Methods by Amount Status​

Audience: User

Description​

When sorting payment methods by the "Amount Status" column, we now also consider the total consumption when two payment methods have the same usage percentage. This gives you a more consistent and meaningful ordering when reviewing payment method usage.

Redesigned Welcome Experience in the Platform Builder​

Audience: User

Description​

We've updated the welcome experience in the Platform Builder. The new dashboard greets you with a "Welcome to meshStack" card that gives you a clear starting point: define reusable building blocks, connect cloud platforms, and let your teams self-service the infrastructure they need.

Fix Initial Login for New Users​

Audience: User

Description​

We fixed a race condition that could prevent new users from successfully logging in. Previously, users saw an access denied error on their first login and had to click "Login" again to get in. This is now resolved, so you can log in smoothly on the first attempt.

Hide Actions Needed Card for Workspaces Without Projects​

Audience: User

Description​

The "Actions Needed" card on the workspace overview page is now hidden when your workspace has no projects. This keeps the overview clean and avoids showing actions that are not relevant until you have created at least one project.

GitHub Actions Building Blocks Default to Pass Only API URL​

Audience: User

Description​

When you create a new GitHub Actions building block, we now enable the "Pass only API URL" option by default. This means your workflow receives a buildingBlockRunUrl to fetch building block data from the meshStack API, rather than the full run object as a workflow input.

This is the recommended approach and protects your workflows from failures caused by large payloads exceeding GitHub's 65KB input limit.

Payment Method CSV Export Now Applies Active Filters and Sorting​

Audience: User

Description​

Previously, exporting payment methods to CSV would always download all payment methods, ignoring any search, filters, or sorting you had applied. We fixed this so the CSV export now reflects exactly what you see in the table, including the active filter and the current sort order, making it much easier to export only the payment methods you care about in the order you expect.

meshLocation API Now Exposes Lifecycle State​

Audience: User

Description​

The meshLocation API now returns both active and deleted locations. When a location is deleted, it is now soft-deleted instead of permanently removed, so it remains visible via the API. Each location response now includes a status.lifecycle field with a state value of either ACTIVE or DELETED.

This release includes the following issues:

• Fix Internal Error When Removing a User from a Workspace
• Reverted GitHub Actions Run Tracking Improvement
• Annual Pricing Option for Building Block Definitions
• Fix for Building Block Notifications Not Firing on Run Status Changes
• Fix Azure Subscription Owner Object ID Handling in meshObject API and Panel
• Terraform Building Block Runner Now Respects Custom Variable Definitions
• Removal of the Cloud Universe Feature
• Aborting a Building Block Run Now Returns Correct Response to Runners
• Validation Added for Building Block Definition Symbol Field
• Fix Group Cleanup After Tenant Move on GCP, OpenStack, AWS and Azure
• Improved Reliability of Building Block Runs Job Retries
• Marketplace Service Instance Relation Changes
• Optimized Building Block Triggering and Event Attribution

Ticket Details​

Fix Internal Error When Removing a User from a Workspace​

Audience: User

Description​

We fixed a bug where removing a user from a workspace could result in an internal error in certain edge cases.

Reverted GitHub Actions Run Tracking Improvement​

Audience: User

Description​

We reverted the recently introduced improvement for tracking GitHub Actions building block runs. The new GitHub API for returning the run ID directly on dispatch is not yet available on private GitHub installations, which caused issues for affected customers. meshStack now uses the previous polling-based approach again to ensure compatibility with all GitHub installations. We will reintroduce the improvement once the new API is available and applied for private GitHub installations as well.

Annual Pricing Option for Building Block Definitions​

Audience: User

Description​

You can now configure an annual price for building blocks in addition to the existing daily and monthly options. An annual fee is charged once per year on the anniversary of the building block's creation date. All other monthly billing periods receive no charge, making it ideal for resources with yearly license costs or annual commitments (e.g. AI platform subscriptions or cloud-provider annual agreements).

How to use​

To configure an annual price, go to the building block definition in the platform builder, open the General tab, and select Annually from the recurring fee dropdown. Please note that pricing is only supported on tenant-level building blocks, as all usage-reporting is based on projects and chargeback uses the project's associated payment method.

Fix for Building Block Notifications Not Firing on Run Status Changes​

Audience: User

Description​

We fixed a bug where building block notifications for failed or succeeded runs were not sent when a runner reported the final run status via the meshObject API. This affected platform operators and building block definition owners who rely on notifications to be alerted when a building block run fails or succeeds.

Fix Azure Subscription Owner Object ID Handling in meshObject API and Panel​

Audience: User

Description​

We fixed two issues with the Azure Subscription Owner Object ID configuration. First, the meshObject API now correctly accepts null for the subscriptionOwnerObjectIds field. Previously, sending null resulted in a 400 error even though the API documentation marked the field as optional. Both null and an empty list are now treated as "no subscription owner configured". Second, the panel now correctly persists the "Do not require a Subscription Owner" override setting. Previously, this setting could be lost after saving and reloading the platform configuration because it was derived from the subscription owner list being empty, which was ambiguous.

Terraform Building Block Runner Now Respects Custom Variable Definitions​

Audience: User

Description​

We improved how the Terraform building block runner handles the meshStack-provided variables (e.g. meshstack_building_block_run_b64, meshstack_building_block_id). If you have already defined variable blocks for these in your Terraform configuration, we no longer overwrite them.

In addition, the .auto.tfvars file written by meshStack is now assigned the lowest alphabetical precedence. Any .auto.tfvars files in your repository load after it and can override the meshStack-provided values, following standard Terraform variable precedence rules.

Removal of the Cloud Universe Feature​

Audience: User

Description​

We have removed the Cloud Universe feature from meshStack. The Cloud Universe was a read-only graph visualization of meshStack entities (users, groups, workspaces, projects, and tenants) accessible via the admin "Cloud Foundation" tab. It has been removed as part of our ongoing effort to streamline the product and focus on features that provide the most value to our users.

Aborting a Building Block Run Now Returns Correct Response to Runners​

Audience: User

Description​

We fixed a bug where aborting a building block run could cause runners to receive an unexpected HTTP 500 error instead of the correct response indicating the run was aborted. If you are using custom runners or have built automated pipelines that integrate via the building block run API, this fix ensures your runners now reliably receive the correct runAborted: true response and can handle the abort gracefully.

Validation Added for Building Block Definition Symbol Field​

Audience: User

Description​

The spec.symbol field on building block definitions now validates that the value is a safe image URI. Valid values are inline image data URIs using PNG, JPEG, GIF, or WebP formats (e.g., data:image/png;base64,...) or an http(s):// URL pointing to an image. SVG data URIs and other non-image data URIs are no longer accepted, as they could pose a cross-site scripting (XSS) risk. If you use Terraform or another API client to manage building block definitions with a custom symbol, please ensure your symbol value uses one of the supported formats above.

Fix Group Cleanup After Tenant Move on GCP, OpenStack, AWS and Azure​

Audience: User

Description​

When a tenant was moved to a different workspace, the old platform groups (tied to the previous workspace) could get stuck and never be cleaned up on GCP, OpenStack, AWS and Azure. This happened when the platform was temporarily slow to respond during replication and required manual cleanup. We fixed this so that meshStack now always preserves the old group metadata across failed replication attempts, ensuring the cleanup of stale groups is retried successfully on the next replication cycle.

Improved Reliability of Building Block Runs Job Retries​

Audience: User

Description​

We fixed a bug where building block runs could get stuck or fail unexpectedly when jobs failed to execute (e.g. due to node pressure or resource constraints). In those cases, the retried job would report an incorrect status back to meshStack. The run would then appear failed or stuck without a clear reason.

Marketplace Service Instance Relation Changes​

Audience: User

Description​

We improved the internal architecture of marketplace service instances to better support multiple marketplaces per location. As part of this change, we removed the deprecated tenant-aware service support from the user interface. This change resolves issues that previously occurred when configuring multiple Open Service Broker (OSB) marketplaces within the same location.

Optimized Building Block Triggering and Event Attribution​

Audience: User

Description​

We optimized how building blocks are triggered for execution. Building blocks are now grouped by workspace before triggering, which reduces unnecessary processing and improves overall performance when updating multiple building blocks. Additionally, we improved the event attribution in the building block audit trail.

This release includes the following issues:

• Building Block Control Plane Back Button Navigates to Definition
• Improved Reliability of GitHub Actions building block runs
• Fix Incorrect Change Detection for Building Block Definition Selectable Values
• Fixed Cancel Button in Communication Creation Dialog
• Workspace Deletion No Longer Gets Stuck on Role Remove Errors
• Improved Group Search in Access Control
• Access Control V2 Is Now Available as a Feature Preview
• Building Block Runner Activity Tracking Fixed
• Error Handling of Config Parsing in OpenTofu Building Block Runner
• Run Tokens Can Now Fetch Building Block Runs
• Fetching Terminated Building Block Runs No Longer Fails
• Update Only Apply Once per Tenant Flag in Draft Building Block Definitions
• Fix Publication State Update When Releasing Building Block Draft Versions
• Improved Performance of Building Block Executions

Ticket Details​

Building Block Control Plane Back Button Navigates to Definition​

Audience: User

Description​

We improved the back navigation in the building block control plane. The "Go back" button now consistently navigates you to the corresponding building block definition, instead of attempting to navigate to the previously visited overview page. This makes the navigation more predictable and reliable, regardless of how you reached the control plane (e.g. via deep link, page refresh, or navigating between tabs).

Improved Reliability of GitHub Actions building block runs​

Audience: User

Description​

GitHub recently added API support for returning the run ID directly when dispatching a workflow. We updated our GitHub Actions building block runner to take advantage of this. Previously, meshStack had to poll and guess which run was triggered based on timestamps, which could lead to incorrect run tracking in rare cases. meshStack now receives the run ID directly from GitHub, ensuring the correct run is always tracked and monitored.

Fix Incorrect Change Detection for Building Block Definition Selectable Values​

Audience: User

Description​

We fixed a bug where releasing a new version of a building block definition was incorrectly flagging the selectable values input field as changed when moving from a null to an empty list, or vice versa. To prevent that it is no longer allow to define an empty list of selectable values. The field must now be set to null if there are no selectable values.

Fixed Cancel Button in Communication Creation Dialog​

Audience: User

Description​

We fixed an issue where the cancel button in the communication creation dialog did not work correctly. Previously, clicking "Cancel" could fail to close the dialog. You can now reliably dismiss the dialog using the cancel button at any point during communication creation.

Workspace Deletion No Longer Gets Stuck on Role Remove Errors​

Audience: User

Description​

We fixed a bug where workspace and project deletion could get stuck when removing role bindings from a workspace or project failed with an internal error. If you experienced stuck workspace or project deletions, they will now proceed successfully.

Improved Group Search in Access Control​

Audience: User

Description​

We improved the group search in the access control screens so that exact name matches are now prioritised correctly. This makes it easier to find and add groups, especially when multiple groups share similar names.

Access Control V2 Is Now Available as a Feature Preview​

Audience: User

Description​

We introduced Access Control V2 as a feature preview. You can now try the new access control experience on workspace, project, and admin access pages by opting in via the "Try New Experience" toggle on those pages. Access Control V2 brings a redesigned interface for managing role mappings and permissions. The feature will gradually roll out and eventually replace the current access control experience.

If your meshStack previously had Access Control V2 enforced, it will remain enforced with no option to toggle back. For all other instances, users can try the new experience via the toggle and opt out if needed. The feature will gradually roll out and become mandatory for all instances.

Building Block Runner Activity Tracking Fixed​

Audience: User

Description​

We fixed an issue where building block runners would incorrectly show an error in their activity status, even though the runners were working correctly. The runner activity tracking now properly updates the last seen timestamp.

Error Handling of Config Parsing in OpenTofu Building Block Runner​

Audience: User

Description​

We improved the error handling when a OpenTofu runner fails to parse a incorrect backend.tf file during Terraform based building block execution.

Run Tokens Can Now Fetch Building Block Runs​

Audience: User

Description​

We fixed an issue where run tokens, which are provided to building block runners, lacked sufficient permissions to fetch their own building block runs. This previously prevented runners from checking the current state of their runs via the meshObject API. Run tokens now include the necessary permissions to retrieve building block run information.

Fetching Terminated Building Block Runs No Longer Fails​

Audience: User

Description​

We fixed an issue where fetching terminated building block runs (e.g., runs with status SUCCEEDED, FAILED, or ABORTED) via the meshObject API resulted in an HTTP 500 error. The API now gracefully handles these cases by returning a placeholder value for the run token field, allowing you to successfully retrieve information about terminated building block runs without errors.

Update Only Apply Once per Tenant Flag in Draft Building Block Definitions​

Audience: User

Description​

You can now update the "Only Apply Once per Tenant" setting for building block definitions that are still in their initial draft state. Previously, this setting could only be configured during initial creation and could not be changed afterward, even for drafts.

Fix Publication State Update When Releasing Building Block Draft Versions​

Audience: User

Description​

When releasing a building block definition draft version without requiring admin approval, the publication state is now correctly updated to "Published". Previously, the publication state remained unchanged even though the version was successfully released, which could caused an inconsistent view in the panel.

Improved Performance of Building Block Executions​

Audience: User

Description​

We improved the handling of building block executions by optimizing database queries. This increases stability for building block executions from workspaces and projects with a lot of building blocks attached.

This release includes the following issues:

• MeshLocation API Now Requires Explicit Workspace Ownership
• General Availability for Platform-Related meshObject APIs
• More Reliable and Polished Building Block Definition Editing
• meshServiceInstance API Now Documents Optional Parameters
• Fix Create New Communication Button in Platform Builder Area
• Platform Builder Permissions Excluded from Building Block Definitions
• Platform Tags Now Refresh Automatically After Manual Tenant Replication
• Fixed Error When Creating Landing Zones
• Building Block Dependencies Now Work Correctly with Draft Versions
• Bulk Remove Users and Groups in Access Control V2

Ticket Details​

MeshLocation API Now Requires Explicit Workspace Ownership​

Audience: User

Description​

The meshLocation API now requires specifying which workspace owns a location. This change makes location ownership explicit and enables workspace-scoped users to manage locations within their own workspace. Previously, only administrators could create and manage locations.

General Availability for Platform-Related meshObject APIs​

Audience: User

Description​

The meshObject APIs for meshPlatform (v2), meshLandingZone (v1), meshLocation (v1), meshPlatformType (v1), and meshIntegration (v1) have been promoted from preview to General Availability (GA). These APIs are now considered stable and ready for production use. Breaking changes will follow the standard versioning process for GA APIs.

How to use​

Clients can temporarily continue using the preview media types like application/vnd.meshcloud.api.meshplatform.v2-preview.hal+json for backward compatibility. But this preview version will be removed according to the deprecation policy, so clients are encouraged to switch to the GA media types.

If you keep using a preview Content-Type header, you must also keep sending the matching preview value in the apiVersion field of request bodies (for example, v2-preview). Requests that mix a preview Content-Type header with a GA apiVersion (for example, v2) will fail validation.

To adopt the GA versions, update your API client's Accept and Content-Type headers to use the GA media types without the -preview suffix (for example, application/vnd.meshcloud.api.meshplatform.v2.hal+json), and update the apiVersion field in request bodies to the matching GA version (for example, v2).

More Reliable and Polished Building Block Definition Editing​

Audience: User

Description​

We polished the building block definition editor to make it more reliable and less error-prone. The improved implementation better handles edge cases when updating configuration sections like general information, implementation details, dependencies, inputs, outputs, and tags.

meshServiceInstance API Now Documents Optional Parameters​

Audience: User

Description​

The meshServiceInstance API now documents the optional parameters on the spec of a service instances. These parameters are forwarded to the Service Broker during provisioning or update operations and the last known values are returned when fetching the service instance. The field was already supported before, but documentation was missing.

Fix Create New Communication Button in Platform Builder Area​

Audience: User

Description​

We fixed an issue where clicking the "Create New Communication" button from the Platform Builder area (e.g. from workspaces, building block definitions, or platform instances) caused an error and prevented the communication creation dialog from opening. The button now works correctly across all areas of meshPanel.

Platform Builder Permissions Excluded from Building Block Definitions​

Audience: User

Description​

Platform Builder permissions are now excluded from the available permissions when creating or editing building block definitions. These permissions allow platform teams to manage resources in other workspaces and are not suitable for building blocks running in workspace context.

Building block definitions can now only use workspace-level permissions, ensuring they operate within the appropriate authorization boundaries.

How to use​

If your existing building block definitions already have Platform Builder permissions assigned, they will remain. However, you cannot add new Platform Builder permissions to building block definitions going forward.

Platform Tags Now Refresh Automatically After Manual Tenant Replication​

Audience: User

Description​

Fixed an issue where platform tags displayed in the tenant details page did not refresh automatically when triggering a manual tenant replication. Previously, you had to reload the entire page to see updated tag values after replication completed. Now, the platform tags update automatically when the replication finishes, providing immediate feedback on tag changes.

Fixed Error When Creating Landing Zones​

Audience: User

Description​

We fixed an issue that could cause a 500 error when creating or updating landing zones through the meshPanel.

Building Block Dependencies Now Work Correctly with Draft Versions​

Audience: User

Description​

We fixed an issue where building block dependencies were not displayed correctly when working with draft versions of building block definitions. Previously, the system always queried the latest published version when determining dependencies, which caused confusion and incorrect dependency information during building block configuration. Now, when you configure a building block based on a draft version, you will see the accurate dependencies specific to that draft version. Additionally, we improved the building block configuration dialog to provide a more reliable and maintainable user experience.

Bulk Remove Users and Groups in Access Control V2​

Audience: User

Description​

You can now select and remove multiple users or groups from workspace and project access lists in a single action in the new access control interface (access control v2).

Note: This change only affects customers who have access to the new access control v2 feature. If you are using the standard access control interface, you already have this capability.

This release includes the following issues:

• Fix Building Block Summary Mentions Displaying as Escaped HTML
• Ephemeral API Keys for Azure DevOps Pipelines in Building Block Definitions
• Invalid Currency Codes are Rejected in Resource Usage Reports
• Sensitivity Toggle Disabled for Existing Building Block Inputs
• Ephemeral API Keys for GitHub Actions in Building Block Definitions
• System Generated Inputs for Async Building Blocks
• meshObject API Lifecycle Information Now in Status Section
• Improved Import of Existing Groups Into Azure Administrative Units
• Improvements for Building Block Definition Version API
• Approval Requirement In Access Management v2
• Building Block Run Updates Are No Longer Lost Due to Timing Issues
• Building Block Definition Permissions Preserved When Creating Drafts
• Building Block Input Keys Must Be Unique
• Improved Secret Handling in Building Block Implementation Forms
• Improved Secret Handling in meshIntegration API
• Improved API Key Permission Selection Experience

Ticket Details​

Fix Building Block Summary Mentions Displaying as Escaped HTML​

Audience: User

Description​

We fixed an issue where @buildingblock, @project, and @tenant mentions in building block summary markdown were displayed as escaped HTML text instead of rendered elements. Mentions now correctly display as interactive badges that load and show the referenced resource information.

Ephemeral API Keys for Azure DevOps Pipelines in Building Block Definitions​

Audience: User

Description​

Building block definitions using Azure DevOps Pipelines now support ephemeral API keys when you configure permissions on the building block definition. This enables building blocks to interact with meshStack programmatically without requiring manually managed credentials.

How to use​

When you create or edit a building block definition using Azure DevOps Pipeline implementation and select one or more permissions, meshStack automatically generates a workspace-scoped API key and provides it as the MESHSTACK_API_TOKEN pipeline variable. Your Azure DevOps Pipeline can use this token to authenticate API requests to meshStack.

Additionally, if you enable asynchronous execution mode for your building block definition, meshStack also provides MESHSTACK_RUN_URL and MESHSTACK_RUN_TOKEN as pipeline variables. These allow your Azure DevOps Pipeline to report status updates and results back to meshStack for the specific building block run.

The ephemeral API keys are automatically managed by meshStack - they are created when the building block run starts and have limited scope to ensure security. You don't need to manually create or manage any API keys.

Invalid Currency Codes are Rejected in Resource Usage Reports​

Audience: User

Description​

We now validate currency codes when importing resource usage reports via the meshResourceUsageReport API. Only valid ISO 4217 currency codes (such as USD, EUR, GBP) are accepted. If you submit a usage report with an invalid currency code, the API will return a clear error message indicating which currency code is invalid. This validation prevents data inconsistencies in your billing and chargeback data, ensuring that all financial information uses standardized currency codes.

How to use​

When importing resource usage reports, make sure all line items use valid ISO 4217 currency codes. If you receive an error about an invalid currency code, check the currency field in your usage report and correct it to use a standard three-letter currency code like USD, EUR, or GBP.

Sensitivity Toggle Disabled for Existing Building Block Inputs​

Audience: User

Description​

We strengthened security by preventing changes to the sensitivity setting of existing building block definition inputs. Once an input is marked as sensitive (encrypted), it cannot be downgraded to non-sensitive for security reasons. The sensitivity toggle in the building block definition editor is now automatically disabled for existing inputs to clearly indicate that this setting cannot be changed.

Ephemeral API Keys for GitHub Actions in Building Block Definitions​

Audience: User

Description​

Building block definitions using GitHub Actions now support ephemeral API keys when you configure permissions on the building block definition. When using the "Pass only API URL" mode, the API token is automatically provided as a workflow input variable (MESHSTACK_API_TOKEN), allowing your GitHub Action workflows to authenticate with the meshStack API securely. This enables building blocks to interact with meshStack programmatically without requiring manually managed credentials.

How to use​

When you create or edit a building block definition using GitHub Actions implementation and select one or more permissions, meshStack automatically generates a workspace-scoped API key and provides it as the MESHSTACK_API_TOKEN workflow input. Your GitHub Action workflow can use this token to authenticate API requests to meshStack.

Additionally, if you enable asynchronous execution mode for your building block definition, meshStack also provides MESHSTACK_RUN_URL and MESHSTACK_RUN_TOKEN as workflow inputs. These allow your GitHub Action workflow to report status updates and results back to meshStack for the specific building block run.

The ephemeral API keys are automatically managed by meshStack - they are created when the building block run starts and have limited scope to ensure security. You don't need to manually create or manage any API keys.

System Generated Inputs for Async Building Blocks​

Audience: User

Description​

Asynchronous building block definitions now automatically receive two new system-generated inputs: MESHSTACK_RUN_URL and MESHSTACK_RUN_TOKEN. These inputs enable building block implementations to report status updates and results back to meshStack using the meshObject API without the need of finding the right URL manually and creating an admin scoped API key. This makes updating the run status and results more secure and easier, especially for building block implementations running outside of meshStack (e.g., GitHub Actions, Azure DevOps, or OpenTofu with async enabled).

How to use​

Use the MESHSTACK_RUN_URL and MESHSTACK_RUN_TOKEN environment variables in your async building block implementations to report status and results. For example, in a GitHub workflow or Azure DevOps pipeline, POST to the run URL with the token to update the run status. These variables are automatically available when async mode is enabled. Existing asynchronous building block definitions will receive these inputs upon the next update to their implementation settings.

meshObject API Lifecycle Information Now in Status Section​

Audience: User

Description​

The meshObject API now consistently provides lifecycle information (such as creation and deletion timestamps) in the status.lifecycle section instead of the metadata section. This change affects meshPlatform, meshPlatformType, and meshIntegration objects. The API now follows a clearer separation of concerns: metadata contains identifiers and ownership information, while status contains runtime state and lifecycle information.

Improved Import of Existing Groups Into Azure Administrative Units​

Audience: User

Description​

We fixed an issue where existing Azure groups could not be correctly imported into an administrative unit (AU). The fix also adds better error handling and reporting for edge cases like missing or duplicate groups.

Improvements for Building Block Definition Version API​

Audience: User

Description​

We improved the API for Building Block Definition Versions so you can manage permissions for ephemeral API keys that are used when running Building Blocks based on a specific Building Block Definition Version. Furthermore, we added lifecycle information to the status subsection of Building Block Definition Versions.

Approval Requirement In Access Management v2​

Audience: User

Description​

If your organization has enabled 4EyePrinciple, you will now be prompted to provide a reason when adding or editing user access to workspaces and projects. This approval workflow (also known as the 4-eye principle) ensures that access changes are reviewed and authorized by multiple people for better security and governance. When 4EyePrinciple is enabled, a "Reason" field automatically appears in the add and edit user forms, requiring you to explain why the access change is needed. Your request will then need to be approved by a workspace or project owner before the access change takes effect. This works for both adding individual users and adding multiple users at once, where a single reason applies to all users being added. If approval requirements are not enabled for your organization, users are added or edited immediately without requiring a reason.

Note: This change only affects customers who have access to the new access control v2 feature. If you are using the standard access control interface, this change does not apply to you.

Building Block Run Updates Are No Longer Lost Due to Timing Issues​

Audience: User

Description​

Fixed a bug where building block run updates could be lost when a late update from the coordinator arrived shortly after a runner had already registered its execution status. This could lead into seemingly stuck building blocks.

Building Block Definition Permissions Preserved When Creating Drafts​

Audience: User

Description​

Building block definition permissions (ephemeral API keys) are now correctly preserved when creating draft versions from published versions. Previously, these permissions were silently lost during the draft creation process, requiring manual reconfiguration.

Building Block Input Keys Must Be Unique​

Audience: User

Description​

Building block definition inputs now require unique input keys. When creating or editing building block definitions, the system validates that no two inputs share the same key, both in the panel and via the API. This prevents configuration errors and ensures clear, unambiguous input references.

Improved Secret Handling in Building Block Implementation Forms​

Audience: User

Description​

We improved the way you manage secrets (like SSH private keys) when configuring building block definitions. The new implementation now properly handles secret data using a secure embedded format, ensuring that existing secrets are preserved when you update other properties without re-uploading them.

How to use​

When editing a building block definition with Terraform implementation, you can now see a clear indication when an existing SSH private key is configured (displayed as "*****"). You only need to upload a new key if you want to change it - otherwise, the existing key will be preserved automatically. This makes it easier and safer to update other implementation settings without accidentally removing or exposing sensitive credentials.

Improved Secret Handling in meshIntegration API​

Audience: User

Description​

The meshIntegration API now uses an improved secret handling approach for integration secrets like GitHub App private keys and Azure DevOps personal access tokens. Previously, GET responses returned a placeholder value for secrets, which made it impossible to detect configuration drift. Now, secrets are returned with a hash value that enables drift detection while maintaining security by never exposing actual secret values. This uses the same concept as meshPlatform configurations and building block definitions. This is a breaking change, so existing API clients need to adapt to the new secret representation structure.

Improved API Key Permission Selection Experience​

Audience: User

Description​

We have redesigned the API Key permission selection experience to make it much easier for you to browse and pick the right permissions for your Workspace or Admin API keys. The new interface groups permissions more clearly and provides helpful descriptions, so you can confidently select the access you need. This update also applies to the recently introduced ephemeral API keys for Building Block Definitions, making it simple to grant just the right permissions for automation and integration scenarios.

How to use​

When creating or editing an API key, you will now see a new permission selection dialog. Permissions are grouped by category, and you can expand each group to learn more about what each permission allows. For ephemeral API keys used in Building Block Definitions, you can quickly select only the permissions required for your automation. This helps you follow the principle of least privilege and improves security for your integrations.

This release includes the following issues:

• Fixed Terraform Runner Handling of Single/Multi Select Input Types

Ticket Details​

Fixed Terraform Runner Handling of Single/Multi Select Input Types​

Audience: User

Description​

We fixed an issue in the Terraform building block runner where SINGLE_SELECT and MULTI_SELECT input values were not correctly processed when passed as Terraform variables. This caused Terraform execution errors when using these input types in building block definitions.

This release includes the following issues:

• Workspace-Scoped API Keys for Building Block Runs
• Default Values No Longer Supported for Encrypted User/Operator Inputs
• Fixed Building Block Runner Not Being Updated When Changing Implementation Type
• Disabled Users Are Now Excluded from Building Block Permission Input
• Ephemeral API Keys Automatically Deleted After Building Block Run Completes
• Markdown Lists Now Render with Proper Formatting
• meshObject API for Building Block Definition Version
• Simplified Project Deletion Dialog for Projects Without Tenants
• Fix Duplicate Azure User Groups During AKS Replication
• Improved OpenTofu Variable Handling in Building Block Runner
• Improved Azure Cost Collection Accuracy
• Improved Login Reliability for Workspace Switching
• meshPlatformType API Now Supports Workspace-Scoped Access Control

Ticket Details​

Workspace-Scoped API Keys for Building Block Runs​

Audience: User

Description​

Building blocks can now automatically receive an ephemeral API key to interact with the meshStack API during their execution. This enables self-service automation patterns where building blocks can create additional resources like other building blocks, tenants, or meshObjects within the consuming workspace - without requiring admin permissions.

When you define permissions on a building block definition, the system automatically provides authentication via the MESHSTACK_API_TOKEN input. The ephemeral API key is scoped to the workspace where the building block runs and has only the permissions you explicitly configured. Application teams see the required permissions in the marketplace before adding the building block.

Note: Ephemeral API keys are not yet fully supported for GitHub Actions and Azure DevOps building blocks. We plan to provide support for this soon.

How to use​

To enable this feature, configure permissions under the "Implementation" tab in your building block definition. The ephemeral API key is automatically deleted when the building block run reaches a terminal state, or after a maximum of 6 hours - whichever comes first.

For OpenTofu building blocks, the meshStack Terraform provider automatically picks up the MESHSTACK_API_TOKEN (and MESHSTACK_ENDPOINT) environment variables - no additional provider configuration needed.

The API key permissions follow the principle of least privilege. If your building block creates a nested building block that also requires permissions, meshStack prevents privilege escalation: the nested building block creation fails if it requires more permissions than the parent building block has.

Default Values No Longer Supported for Encrypted User/Operator Inputs​

Audience: User

Description​

Previously, setting a default value for encrypted (sensitive) inputs with "User Input" or "Platform Operator Manual Input" assignment types would result in the placeholder value "" being used as the actual input value when creating building blocks, causing them to fail or receive invalid encrypted input. This happened because encrypted values cannot be decrypted to display as default values in forms.

To prevent this issue, you can no longer set default values for these input types. Users and operators must now explicitly provide values for sensitive inputs with these assignment types when creating building blocks.

Fixed Building Block Runner Not Being Updated When Changing Implementation Type​

Audience: User

Description​

Fixed a bug where changing a building block definition's implementation type (e.g., from Manual to Terraform or vice versa) would fail with an error about the building block runner not matching the new implementation type. The issue occurred because the automatically preselected runner was not being properly included in the update request.

Disabled Users Are Now Excluded from Building Block Permission Input​

Audience: User

Description​

We fixed an issue where disabled users were incorrectly included in the building block permission input. When you disable a user via SCIM, the system now correctly excludes them from the building block user permission list. This ensures that building blocks no longer receive permission updates for users who should not have access to workspace resources.

Ephemeral API Keys Automatically Deleted After Building Block Run Completes​

Audience: User

Description​

Ephemeral API keys created for building block runs are now automatically deleted when the run reaches a terminal state (succeeded or failed). Previously, these keys remained valid for up to 6 hours, which was unnecessarily long for most use cases.

With this change, the effective lifetime of ephemeral API keys is reduced to the actual duration of the building block run, improving security by minimizing the window during which these credentials remain active.

Note: While the JWT bearer tokens themselves remain technically valid after deletion, they will no longer work for API calls.

Markdown Lists Now Render with Proper Formatting​

Audience: User

Description​

Fixed an issue introduced by a recent library upgrade where markdown formatting (bold text, links, italic text, and inline code) was not rendering properly inside lists when writing building block definition README files. Previously, bold and link markdowns would display as raw markdown syntax instead of being formatted correctly.

meshObject API for Building Block Definition Version​

Audience: User

Description​

A new meshObject API is now available for programmatic creation and modification of building block definition versions. This enables you to automate the management of building block definitions in meshStack, including support for all implementation types. The endpoints remain in preview mode for now. Future changes might still occur.

How to use​

The API provides access to building block definition versions for API keys with the appropriate permissions. You can use the API to create new draft versions, update existing draft versions of building block definitions and release draft versions. For detailed information about available endpoints, request formats, and authentication requirements, please refer to the meshStack API documentation.

Simplified Project Deletion Dialog for Projects Without Tenants​

Audience: User

Description​

The project deletion dialog in the admin area has been simplified for projects that do not have any tenants. When you delete a project without tenants, the dialog no longer shows unnecessary information about tenant deletion and building block removal, making the deletion process clearer and more straightforward.

Fix Duplicate Azure User Groups During AKS Replication​

Audience: User

Description​

Fixed an issue where Azure's eventual consistency could cause duplicate user groups to appear during AKS platform replication. These duplicates previously caused problems during the replication process. meshStack now automatically detects and removes duplicate user groups, ensuring smooth replication operations.

Improved OpenTofu Variable Handling in Building Block Runner​

Audience: User

Description​

We improved how building block inputs are passed to OpenTofu runs as input variables, making them more reliable to configure. The OpenTofu building block runner now properly encodes variables from building block inputs, ensuring better compatibility with different input types like CODE, MULTI_SELECT, and FILE.

Building block inputs with type CODE are now expected to contain HCL expressions. If parsing CODE input fails, the provided input is passed as-is as a string value. When an OpenTofu variable input is specified with type string and the building block input type doesn't match this, the value is provided as a JSON-encoded string, which you can recover using jsondecode in a typesafe manner within OpenTofu.

See further documentation in https://docs.meshcloud.io/concepts/building-block/#code-input

Improved Azure Cost Collection Accuracy​

Audience: User

Description​

We improved the accuracy of Azure cost data collection by preventing rare duplicate cost items during collection runs (which can happen when Azure re-names their products).

Improved Login Reliability for Workspace Switching​

Audience: User

Description​

Improved the reliability of workspace switching and login process. In rare cases, users could experience repeated login redirects (login loop). The system now automatically detects and tries to recover from this condition.

meshPlatformType API Now Supports Workspace-Scoped Access Control​

Audience: User

Description​

The meshPlatformType API has been enhanced to support workspace-scoped ownership. Platform types can now be owned by specific workspaces, allowing platform teams to manage their own platform types. The API now includes a new ownedByWorkspace field in the metadata section that identifies which workspace owns the platform type. All API keys can still read all platform types regardless of ownership.

This release includes the following issues:

• File Type Input Keys Can Contain Dots and Special Characters

Ticket Details​

File Type Input Keys Can Contain Dots and Special Characters​

Audience: User

Description​

Fixed a regression where building block input keys of type file were incorrectly restricted to the same naming rules as other input types. File type inputs can now contain dots and special characters again, making it possible to use filenames like "config.json" or "script.sh" as input keys. Non-FILE input types continue to follow the standard naming rules (must start with a letter, contain only letters, numbers, hyphens, and underscores).

This release includes the following issues:

• AWS Replication Now Detects Inactive and Deleted Accounts
• Fixed Issue Where Code Inputs Could Not Be Marked as Sensitive
• Landing Zone Selection Now Respects Project Tag Policies
• Improved Building Block Input Key Validation
• Fix Building Blocks With Author Input
• Improved Error Messages for Building Block Dependency Failures
• Improved Error Messages for Building Block Run Failures
• Building Block Type Selection Now Required During Creation
• Automatic MESHSTACK_ENDPOINT Input for Building Block Definitions
• Improved API Key Permission Descriptions for Tenant Import

Ticket Details​

AWS Replication Now Detects Inactive and Deleted Accounts​

Audience: User

Description​

We improved the AWS account replication to detect inactive or deleted accounts more reliably. Previously, the replication process only checked if an AWS account existed, which could lead to misleading success messages even when the account was actually deleted or inactive in AWS. If an account is found to be deleted or inactive, you will receive a clear replication failure message. This message will prompt you to either ensure the account is active in AWS or initiate the deletion process for the project/tenant in meshStack if the account is no longer needed.

Fixed Issue Where Code Inputs Could Not Be Marked as Sensitive​

Audience: User

Description​

A recent regression prevented building block definition inputs of type 'Code' from being marked as sensitive (encrypted). This functionality was previously working but was accidentally disabled. The issue has been fixed and code type inputs can now be marked as sensitive again.

This fix also resolves an issue where Kotlin-based building block runners (GitHub, GitLab, Azure DevOps, and Manual runners) were not decrypting sensitive code type inputs during execution, even though the Terraform runner handled them correctly. All runners now properly decrypt code type sensitive inputs.

Landing Zone Selection Now Respects Project Tag Policies​

Audience: User

Description​

When creating a project, the landing zone selection dropdown now correctly prevents you from selecting landing zones that do not match your project's tag policies. Previously, all landing zones appeared selectable in the dropdown, though backend validation would later prevent the wizard from completing if an incompatible landing zone was selected. Now, incompatible landing zones are visibly disabled in the dropdown with a ban icon, making it immediately clear which landing zones are available for your specific project configuration.

Improved Building Block Input Key Validation​

Audience: User

Description​

Building block input keys now show a clear, user-friendly error message when you enter an invalid name. The validation now ensures that input keys must follow a certain pattern to not cause problems during building block execution.

Fix Building Blocks With Author Input​

Audience: User

Description​

Fixed a regression introduced in release v2026.2.0 where building block runs would fail when using Author assignment type inputs. The author information is now correctly passed as a structured JSON object to Terraform, preventing "Variables not allowed" errors.

How to use​

No action required. Building blocks with Author assignment type inputs will now execute successfully. The author information (including user identifier, display name, username, email, and euid) is automatically provided as a properly formatted JSON object to your Terraform code.

Improved Error Messages for Building Block Dependency Failures​

Audience: User

Description​

We improved the error messages displayed when a building block cannot be created due to a missing dependency output. Previously, you would only see a generic internal error message when a dependent output key could not be found on the parent building block. Now, you see a clear message indicating which output key is missing and on which parent building block, helping you quickly identify and resolve dependency configuration issues.

Improved Error Messages for Building Block Run Failures​

Audience: User

Description​

Previously, some errors (such as SSH authentication or git connection issues) were only logged internally and were not visible in the building block run details. We now provide you with the full error information, making it easier to diagnose and resolve issues with your building block configurations.

Building Block Type Selection Now Required During Creation​

Audience: User

Description​

When creating a new building block definition, you must now explicitly choose between workspace-level or tenant-level type. Previously, the form defaulted to workspace-level, which could lead to incorrect choices that cannot be changed later. This improvement ensures you make a conscious decision about the building block type during creation.

Automatic MESHSTACK_ENDPOINT Input for Building Block Definitions​

Audience: User

Description​

New or updated building block definitions now automatically include a system-generated MESHSTACK_ENDPOINT environment variable input. This input provides building blocks with the meshStack API endpoint URL, enabling them to interact with meshStack APIs during execution without manual configuration.

Additionally, when importing OpenTofu variables for building block definitions with ephemeral API key permissions enabled, meshStack authentication inputs (MESHSTACK_API_KEY, MESHSTACK_API_SECRET, MESHSTACK_ENDPOINT) are no longer suggested, since these are automatically provided by the system.

Improved API Key Permission Descriptions for Tenant Import​

Audience: User

Description​

We improved the descriptions for tenant import permissions to better reflect their actual behavior and to be more consistent with other API key permission descriptions. The descriptions now more clearly state that these permissions allow importing "unmanaged tenants" and specify the scope more accurately. No functional behavior was changed, only the text descriptions were updated.

This release includes the following issues:

• Improved Building Block Git Clone Error Diagnostics
• Fix Stuck Building Block Runs With Ephemeral Runners

Ticket Details​

Improved Building Block Git Clone Error Diagnostics​

Audience: User

Description​

We improved error diagnostics for building block deployments when Git repository cloning fails. Previously, when a building block failed to clone a Git repository via SSH (particularly with Azure DevOps), the error logs only showed a generic error without revealing the underlying cause. Now, the detailed error output is captured and logged, making it easier to diagnose issues such as invalid SSH keys, permission problems, or authentication failures.

Fix Stuck Building Block Runs With Ephemeral Runners​

Audience: User

Description​

Fixed a critical issue where building block runners failed to execute runs because the run authentication token was not properly serialized when ephemeral building block runners were used. Note that not all environments used ephemeral runners.

This release includes the following issues:

• Fixed Timeout Building Block Runs Not Being Retryable
• Fixed Building Block Run Counting
• Restructured meshPlatformType Lifecycle in preview API
• Onboarding Tour in Marketplace Catalog Temporarily Disabled
• Fixed Save Button for Code Input Default Values in Building Blocks
• Improved Role Descriptions for Organization Admin and User
• Custom Platforms in meshPlatform and meshLandingZone API
• Platform Type Changes Are Now Rejected in meshPlatform and meshLandingZone API
• Project Assignment Modal When Adding Workspace Users in Access Control V2

Ticket Details​

Fixed Timeout Building Block Runs Not Being Retryable​

Audience: User

Description​

We fixed an issue where Terraform building block runs that timed out could not be properly retried automatically and appeared stuck.

How to use​

This causes a slight change in behavior so that terminated runs cannot be updated anymore with e.g. input updates. Please make sure your external pipelines are compatible with this behavior and won't send late updates after a run was marked as successful, failed, or timed out to prevent any problems.

Fixed Building Block Run Counting​

Audience: User

Description​

We improved the way runs are counted and fixed a bug which could lead to irregular run numbers.

Restructured meshPlatformType Lifecycle in preview API​

Audience: User

Description​

We restructured the lifecycle representation in the meshPlatformType API response to use a standardized format. The lifecycle state is now returned under status.lifecycle.state instead of the previous flat status.lifecycleState field.

Additionally, we renamed the lifecycleStatus query parameter to lifecycleState when listing meshPlatformTypes via the API. This change aligns the filter parameter name with the response field, making the API more consistent and intuitive to use.

The lifecycle state values remain unchanged (ACTIVE, DEACTIVATED).

Onboarding Tour in Marketplace Catalog Temporarily Disabled​

Audience: User

Description​

The interactive onboarding tour in the marketplace catalog has been temporarily disabled due to a license change in the underlying library. We are evaluating alternative solutions and will re-enable an onboarding tour experience in a future update.

Fixed Save Button for Code Input Default Values in Building Blocks​

Audience: User

Description​

We fixed an issue where editing the default value of a code input in a building block definition did not enable the save button. Previously, you had to modify another field to trigger the save button, even though your code changes would be persisted. The save button now correctly enables when you edit code input default values.

Improved Role Descriptions for Organization Admin and User​

Audience: User

Description​

We improved the role descriptions for the "Organization Admin" and "Organization User" roles to provide clearer information about their capabilities.

Custom Platforms in meshPlatform and meshLandingZone API​

Audience: User

Description​

The meshPlatform and meshLandingZone APIs now support custom platforms via API v2-preview. You can now create and manage platforms and landing zones for your custom platform types programmatically, just like you would for built-in platform types (AWS, Azure, GCP, etc.). This enables full API-based automation workflows for proprietary or emerging cloud platforms that you've added to meshStack.

Platform Type Changes Are Now Rejected in meshPlatform and meshLandingZone API​

Audience: User

Description​

When updating a meshPlatform or meshLandingZone via the meshObject API, attempts to change the platform type are now properly rejected with a clear error message. This applies to all platform types, including both built-in platforms (AWS, Azure, GCP, etc.) and custom platforms. Previously, such changes were silently ignored, potentially causing confusion.

Project Assignment Modal When Adding Workspace Users in Access Control V2​

Audience: User

Description​

When adding new users or groups to a workspace in Access Control V2 workspace control plane, a modal now automatically appears to optionally add them to existing projects in that workspace. This streamlines the workflow of granting both workspace and project access in a single operation, matching the behavior available in Access Control V1.

Note: This change only affects customers who have access to the new access control v2 feature. If you are using the standard access control interface, this change does not apply to you.

This release includes the following issues:

• Improved Building Block Event Log Quality
• Fix "Open Workflow" button disabled for released building block definitions
• Fix Platform Workspace Link in Admin View
• Fixed SSH Key Type Mismatch for Self-Hosted Git
• Fix Duplicate Tenant Usage Reports on Tenant Re-Import
• Ignore Azure User Invitation Failures For Blocked Users
• Fixed Setting Nullable Fields to Null in meshLandingZone API
• Building Block Configuration for Landing Zones via API
• Stricter Authorization for meshLandingZone and meshPlatform API
• Feature Previews Card On Cloud Foundation Dashboard
• Clarify AWS Account Name and Alias Pattern Behavior
• Fixed meshPlatform Link in meshLandingZone API Response
• Landing Zone Deactivation Terminology Consistency
• Fixed Loading State Display Issue in Tables
• Enhanced meshLandingZone API with Lifecycle State Filtering and Information
• Enhanced meshPlatform API with Lifecycle State Filtering and Information
• Access Management V2 for Partner Admin Area
• Specify Workspace Ownership for Landing Zones via API
• Display Service Provider Workspace in Marketplace Catalog
• meshLocation API Restricted to Admin Access For Modification
• Fix Building Block Failures With Large Input Variables
• meshPlatform API Now Requires Non-Empty Endpoint
• Validate ProjectRole References in Landing Zone Creation
• Delete Locations Via meshLocation API

Ticket Details​

Improved Building Block Event Log Quality​

Audience: User

Description​

We improved the building block event logs by removing redundant events and adding more meaningful ones. Previously, the system created "Building Block Run Requested" events every time a tenant was updated, even when no actual changes occurred. These events cluttered the event log without providing useful information. We now only create events when a building block run actually executes. This makes it easier to track and understand the actual activity of your building blocks.

Fix "Open Workflow" button disabled for released building block definitions​

Audience: User

Description​

We fixed a bug where the "Open Apply Workflow" and "Open Destroy Workflow" buttons were incorrectly disabled when viewing released building block definitions using GitHub Actions as implementation type.

Fix Platform Workspace Link in Admin View​

Audience: User

Description​

Fixed an issue where the platform workspace link in the admin view was incorrect. The link now correctly uses the workspace identifier instead of workspace name, ensuring proper navigation to the workspace overview.

Fixed SSH Key Type Mismatch for Self-Hosted Git​

Audience: User

Description​

We fixed an issue where building blocks using SSH authentication to access self-hosted or private Git repositories would fail with a "key mismatch" error. This occurred when you configured a known host entry with a specific key type (e.g., ssh-ed25519), but the Git server offered a different key algorithm during connection. The building block runner now correctly requests the specific key type you configured in the known hosts field, ensuring successful authentication to your self-hosted Git instance.

Fix Duplicate Tenant Usage Reports on Tenant Re-Import​

Audience: User

Description​

We fixed an issue where re-importing a tenant within the same month it was deleted from meshStack resulted in duplicate tenant usage reports. The system now correctly handles tenant re-imports without creating additional usage reports for the same reporting period.

Ignore Azure User Invitation Failures For Blocked Users​

Audience: User

Description​

When replicating Azure tenants, if a user invitation fails because Azure reports an error when the user is blocked the replication will now continue for other users instead of failing completely. Such failed invitations are reported in the replication system remarks with detailed error messages from Azure, allowing operators to investigate and resolve specific user issues.

Fixed Setting Nullable Fields to Null in meshLandingZone API​

Audience: User

Description​

We fixed an issue where you could not set optional fields like infoLink to null via the meshLandingZone API. When updating a meshLandingZone via PUT request with a null value for optional fields (e.g., infoLink), the API now correctly removes the existing value instead of keeping the old value.

Building Block Configuration for Landing Zones via API​

Audience: User

Description​

The meshLandingZone API now supports configuring mandatory and recommended building blocks. This allows you to define which building blocks should be automatically applied to tenants created in a landing zone, enabling better governance and standardization across your cloud environments.

Stricter Authorization for meshLandingZone and meshPlatform API​

Audience: User

Description​

The meshLandingZone and meshPlatform APIs now enforce stricter authorization for non-admin API keys. When using an API key without admin permissions, you can only retrieve landing zones or platforms if your workspace owns that resource or is listed as a contributor. This change improves security by preventing unauthorized access to detailed configuration information of platforms.

Feature Previews Card On Cloud Foundation Dashboard​

Audience: User

Description​

Adds a new card to the Cloud Foundation Dashboard that displays active feature previews and their rollout schedule. This allows you to see which features are available for early access and when they will be rolled out.

How to use​

The new "Feature Previews" card is visible on the Cloud Foundation Dashboard. You can view all available feature previews and their rollout dates. Click "View All Feature Previews" to navigate to a detailed overview.

Clarify AWS Account Name and Alias Pattern Behavior​

Audience: User

Description​

The AWS platform configuration now includes enhanced documentation that clarifies the behavior of the account alias pattern setting. The pattern is used to set both the AWS account name during initial account creation and the account alias. However, AWS does not allow the account name to be changed after account creation. This means that any subsequent changes to the account alias pattern only affect the account alias, not the immutable account name.

Fixed meshPlatform Link in meshLandingZone API Response​

Audience: User

Description​

The meshLandingZone API previously returned an incorrect link to the associated meshPlatform. The link pointed to the internal API endpoint instead of the public meshObject API endpoint. This has been corrected, and the meshLandingZone API now correctly references the meshPlatform API endpoint.

Landing Zone Deactivation Terminology Consistency​

Audience: User

Description​

We renamed "disable" to "deactivate" for landing zones throughout meshStack to provide consistent terminology with other meshObjects.

Fixed Loading State Display Issue in Tables​

Audience: User

Description​

We fixed a visual issue where empty placeholders were incorrectly displayed while tables were loading content. Now you will only see the loading indicator during data retrieval, providing a cleaner and less confusing user experience.

Enhanced meshLandingZone API with Lifecycle State Filtering and Information​

Audience: User

Description​

The meshLandingZone API v1-preview now supports filtering and retrieval of landing zones based on their lifecycle state. You can now filter landing zones by ACTIVE or DEACTIVATED states using the lifecycleState query parameter.

Note: The previous disabled query parameter has been replaced by the lifecycleState parameter. Landing zones that were previously disabled are now shown with the DEACTIVATED lifecycle state.

Enhanced meshPlatform API with Lifecycle State Filtering and Information​

Audience: User

Description​

The meshPlatform API v2 now supports filtering and retrieval of platforms based on their lifecycle state. You can now filter platforms by ACTIVE, DEACTIVATED, or DELETED states. Additionally, the platform status now includes the current lifecycle state.

Access Management V2 for Partner Admin Area​

Audience: User

Description​

We have upgraded the access management interface in the partner admin area to version 2. This provides an improved user experience when managing user and group access to your partner workspace. The new interface includes enhanced search capabilities, better visual feedback, and a more streamlined workflow for adding, editing, and removing access.

Note: This change only affects customers who have access to the new access control v2 feature. If you are using the standard access control interface, this change does not apply to you.

Specify Workspace Ownership for Landing Zones via API​

Audience: User

Description​

The meshLandingZone API now supports explicit workspace ownership specification. When creating a landing zone via the API, you must now specify which workspace owns that landing zone. Previously the Landing Zone was always owned by the workspace the API Key belongs to. This enables admins to create landing zones for any workspace, giving you more flexibility in managing landing zones across your organization. Additionally, landing zone contributors are now also able to manage Landing Zones via API.

How to use​

Please note that this is a breaking change for users of the v1-preview meshLandingZone API. The metadata.ownedByWorkspace field is now mandatory in all meshLandingZone API requests. If you are already using the v1-preview meshLandingZone API, you must update your API integrations to include this field in the request payload.

Display Service Provider Workspace in Marketplace Catalog​

Audience: User

Description​

The marketplace catalog now displays which workspace provides each service or building block. This makes it easy to identify the platform team responsible for offering each service, especially valuable in multi-unit or collaborative environments where different organizational units contribute to the service landscape.

meshLocation API Restricted to Admin Access For Modification​

Audience: User

Description​

We fixed a security issue where the meshLocation API incorrectly accepted workspace-scoped API keys without proper authorization checks. The API is now only accessible with admin permissions if modifications are done. If you were using workspace-scoped API keys to modify location information, you must now use API keys with admin rights instead.

Fix Building Block Failures With Large Input Variables​

Audience: User

Description​

Fixed an issue where building blocks would fail with an error when processing large input variables, such as extensive user lists or complex configurations. Building blocks now reliably handle input variables of any size.

meshPlatform API Now Requires Non-Empty Endpoint​

Audience: User

Description​

When creating or updating platforms via the meshPlatform meshObject API, the endpoint field must now be set to a non-empty string. Previously, setting an empty endpoint resulted in errors when attempting to access tenants created on that platform.

How to use​

Ensure that the spec.endpoint field in your meshPlatform API requests contains a valid, non-empty URL. This validation prevents configuration errors and ensures that all platform tenants remain accessible through the panel.

Validate ProjectRole References in Landing Zone Creation​

Audience: User

Description​

We fixed a bug where landing zones could be created with references to non-existent project roles in their role mappings. Now, when you create or update a landing zone via the meshObject API, meshStack validates that all referenced project roles actually exist. If any project role references are invalid, you'll receive a clear error message listing all missing roles, making it easier to correct the issue in one go.

Delete Locations Via meshLocation API​

Audience: User

Description​

The meshLocation API now supports deleting locations that have never been associated with platform instances. This enables you to manage the complete location lifecycle programmatically, which is particularly useful for testing infrastructure-as-code implementations like Terraform acceptance tests. You can now create, update, and delete locations as needed to maintain a clean platform configuration.

How to use​

Use the DELETE operation on the meshLocation API to remove a location. The API prevents accidental deletion of locations with platform instances. Note that once a location has been associated with platforms (which can only be soft-deleted), the location cannot be removed. We plan to address this limitation in a future release.

This release includes the following issues:

• Fixed Serialization Error for Users Without Keycloak ID

Ticket Details​

Fixed Serialization Error for Users Without Keycloak ID​

Audience: User

Description​

We fixed an issue where meshStack would fail to display certain pages when user data without a Keycloak user ID was present. The fix ensures that all user-related data is now correctly handled, even when Keycloak IDs are missing.

This release includes the following issues:

• Fix Dependent Mandatory Building Block Selection in Project Creation
• Improved Error Message for Wrong Azure Subscription Enrollment Selection
• Improved Building Block Execution with Isolated Run Jobs
• Improved Filtering for meshPlatform and meshLandingZone APIs
• Fix Event Log Filtering Error in Workspace View
• Related Service Description Shown in Marketplace
• Fix Workspace and Project Links in Platform Builder for Non-Admins
• Fix Removing Expiration Date From Users and Groups
• Add Feature Preview Rollout Dates

Ticket Details​

Fix Dependent Mandatory Building Block Selection in Project Creation​

Audience: User

Description​

When creating a project with a tenant that requires a Landing Zone, if the Landing Zone contains a mandatory Building Block that itself depends on another Building Block, the dropdown for the dependent Building Block was empty and displayed "create building block first!" This has been fixed.

Improved Error Message for Wrong Azure Subscription Enrollment Selection​

Audience: User

Description​

When creating an Azure subscription with an incorrect enrollment type selected (e.g., using a Legacy Enterprise Agreement configuration when a Microsoft Customer Agreement is required), meshStack now provides a clear and actionable error message. Previously, such misconfigurations resulted in generic error messages that made troubleshooting difficult.

Improved Building Block Execution with Isolated Run Jobs​

Audience: User

Description​

We have improved building block execution by enabling isolated and ephemeral run jobs. This enhancement provides better security through more fine-granular Workload Identity Federation (WIF) tokens and improves parallel building block execution performance. Please note that this is a breaking change for environments already using WIF-based building blocks, and we will coordinate the rollout individually with affected customers.

How to use​

This improvement is currently rolled out to QA and Trial environments that do not yet use WIF-based building blocks. Building blocks now execute in isolated environments, ensuring better resource isolation and security. If you use building blocks with cloud platform authentication via Workload Identity Federation, you will benefit from more fine-granular access tokens that are scoped to a building block definition. Additionally, parallel execution of multiple building blocks is now more efficient. For environments already using WIF-based building blocks, we will work with you directly to schedule the migration.

Improved Filtering for meshPlatform and meshLandingZone APIs​

Audience: User

Description​

The meshPlatform and meshLandingZone APIs now support explicit query parameters for filtering. You can filter platforms by name, location, owner, publication state, restriction, display name, and contributing workspaces. Landing zones can be filtered by name, display name, platform, disabled state, restriction and owner. Please note that the generic searchTerm parameter on the meshPlatform v2 API has been removed - if you previously filtered by ownedByWorkspace using searchTerm, you must now use the dedicated ownedByWorkspace query parameter instead.

Fix Event Log Filtering Error in Workspace View​

Audience: User

Description​

Fixed an error that occurred when filtering event logs by event type within a workspace. The event log filtering now works correctly and displays the filtered results as expected.

Related Service Description Shown in Marketplace​

Audience: User

Description​

Previously, when viewing the marketplace within a workspace, the description for a related service was not displayed. This issue has been fixed, and the description is now properly shown alongside related services in the marketplace.

Fix Workspace and Project Links in Platform Builder for Non-Admins​

Audience: User

Description​

Users in the platform builder area previously saw clickable links to workspace and project admin pages in the inventory tenants view, even though they couldn't access those pages. Now, non-admin users in the platform builder area see workspace and project identifiers as plain text instead of broken links.

Fix Removing Expiration Date From Users and Groups​

Audience: User

Description​

Previously, removing the expiration date from a user or group assignment resulted in an error message stating that the expiration date must not be in the past. This prevented you from removing expiration dates. This issue has been fixed, and you can now successfully remove expiration dates from user and group assignments.

How to use​

When editing a user or group assignment, you can now clear the expiration date field to remove the expiration date. For workspace roles, please note that if you have configured a maximum access period in the Role Recertification section in the Admin Area, the expiration date becomes mandatory. In such cases, you will receive a validation error if you attempt to remove the expiration date.

Add Feature Preview Rollout Dates​

Audience: User

Description​

Feature Previews may now include rollout completion dates. After this date, the feature will be considered fully released and no longer in preview status. This means that users can no longer switch back to the previous version of the feature, and admins can also no longer opt out of the feature preview. The rollout completion date will be displayed in the Feature Previews area of the panel. We also added a new section for completed feature previews to help users keep track of which features have fully rolled out. For the existing feature previews of "New Marketplace Experience" and "Workspace Overview - Default View", we have set the rollout completion date to April 1st, 2026.

This release includes the following issues:

• Fixed Greyed Out Code Editor in Building Block Input Definition
• Creator Can Now Be Removed During Project Creation
• Building Block Search Bar Remains Visible When no Results Are Found
• Search Filter for Workspace and Project Access Control v2 Tables
• Building Block API Query Parameters Now Use Exact Match
• Mandatory Building Blocks via API

Ticket Details​

Fixed Greyed Out Code Editor in Building Block Input Definition​

Audience: User

Description​

Previously, when creating a new building block definition and adding an input of type 'Code', the code editor was sometimes greyed out, making it impossible to specify a default value. This issue has been resolved.

Creator Can Now Be Removed During Project Creation​

Audience: User

Description​

When creating a project, the creator was automatically added and could not be removed. This restriction has been lifted. You can now remove the creator during the creation process, allowing you to create projects with a different set of users or even without any users assigned initially.

Building Block Search Bar Remains Visible When no Results Are Found​

Audience: User

Description​

We fixed a bug where the search bar in a lot of tables would disappear when no search results were found. The search bar now remains visible, allowing you to refine your search without having to reload the page.

Search Filter for Workspace and Project Access Control v2 Tables​

Audience: User

Description​

A search filter is now available in workspace and project access control tables, allowing you to quickly find specific users or groups by typing their name. This makes it easier to manage access in workspaces and projects with many users.

Note: This change only affects customers who have access to the new access control v2 feature. If you are using the standard access control interface, this change does not apply to you.

Building Block API Query Parameters Now Use Exact Match​

Audience: User

Description​

The meshBuildingBlock API endpoint now performs exact matching for all provided query parameters when filtering building blocks. Previously, these parameters used partial matching, returning all building blocks whose field values included the query parameter values as substrings. This could return unintended results when one value was a substring of another. With the new exact match behavior, only building blocks with exact matches for all provided query parameters are returned. For example, you can now reliably fetch all building blocks from one particular workspace by specifying the exact workspaceIdentifier.

Mandatory Building Blocks via API​

Audience: User

Description​

Tenants can now be created via the API with mandatory building blocks that have user inputs with default values. Previously, mandatory building blocks with "User Input" assignment type would prevent tenant creation, even when default values were defined. This enhancement allows for more flexible building block configurations while ensuring tenants can be created automatically via the API.