2026-09
2026-09
This release tracker is LLM-curated and based on the official Microsoft product sources listed below. It provides an architect-grade summary of recent features, changes, and announcements. Always verify critical details against the official documentation. List of all raw markdown files for the releases are at https://github.com/pisinger/pisinger.github.io/tree/main/_ms_release_radar
Microsoft Security Release Radar - September 2026
⛵ AKS
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔴 | Availability Sets (VMAS) automatic migration to Virtual Machines node pools | Security | Starting September 30, 2026, AKS will automatically migrate deprecated Availability Sets (VMAS) clusters to VM node pools via the auto-upgrader; migrate earlier using az aks update --migrate-vmas-to-vms to control timing. |
| 🔴 | Azure Linux with OS Guard retirement | Security | Azure Linux with OS Guard (preview) will be retired December 10, 2026; transition to Azure Container Linux by then, as new node pools, security patches, and node images cease after that, with image removal on March 10, 2027. |
| 🟢 | Autoscaling for Virtual Machines node pools | GA | Autoscaling for VM node pools, including multi-SKU autoscaling, is now generally available. |
| 🟡 | Managed system node pool conversion | Preview | Existing clusters can now be converted to use a managed system node pool in supported regions after registering the required preview feature. |
| 🟡 | Blue-green to rolling upgrade switch | Preview | Node pools with an in-progress blue-green upgrade can now safely switch to the rolling upgrade strategy. |
| 🟡 | On-Demand Monitor | Preview | On-Demand Monitor, a new Cluster Health Monitor capability for node health checks and remediation, is available in preview. |
| 🔵 | Kubernetes versions rollout | New/Updated | Kubernetes 1.37 preview is rolling out and patch versions 1.36.3, 1.35.7, and 1.34.10 are now available. |
| 🔵 | Release status site Windows version changes | New/Updated | The AKS release status site now includes Windows Server 2025 and no longer lists Windows Server 2019 or Windows Server 23H2 because AKS no longer produces those VHDs. |
| 🔵 | LocalDNS auto-enable on Kubernetes 1.37 | New/Updated | Starting with Kubernetes 1.37, LocalDNS is enabled automatically when cluster networking supports it, leaving BYO-CNI, unsupported network policy, and existing custom DNS configurations unchanged. |
| 🔵 | Dual-stack IPv6 removal rejection | New/Updated | AKS now rejects updates that attempt to remove IPv6 from an existing dual-stack cluster; dual-stack to single-stack migration isn’t supported. |
| 🔵 | HTTP proxy / Custom CA certificate size limit | New/Updated | New clusters using an HTTP proxy or Custom CA now reject CA certificate content larger than 35 KB to prevent node bootstrap data from exceeding platform limits; existing clusters are unaffected. |
| 🔵 | Managed namespace reserved-prefix rejection | New/Updated | Managed namespace creation now rejects names beginning with the reserved kube- or aks-istio- prefixes to avoid conflicts with system-reserved namespaces. |
| 🔵 | Azure Policy Kubernetes-native validation default | New/Updated | When the Azure Policy add-on is enabled, Azure Policy’s Kubernetes-native validation path is now enabled by default across regions. |
| 🔵 | Static Egress Gateway load balancer deregistration | New/Updated | Static Egress Gateway nodes now deregister from the load balancer before a node-image upgrade reimages them, reducing the risk of interrupted egress traffic. |
| 🔵 | KMS customer-managed key validation | New/Updated | AKS returns a validation error when enabling KMS encryption with versioned Key Vault key IDs on 1.37 clusters; this requires a versionless Key Vault key ID. |
| 🔵 | Prometheus namespace-scoped secrets access | New/Updated | On Kubernetes 1.37+, Azure Monitor managed Prometheus (ama-metrics) uses namespace-scoped access to Kubernetes secrets; configure namespace-scoped secrets access before upgrading clusters using Secret-referencing ServiceMonitor/PodMonitor configurations. |
| 🔵 | Defender for Containers collector CSI detach fix | Fix | Fixed an issue where the Microsoft Defender for Containers collector could prevent CSI volumes from detaching, leaving volumes terminating and blocking dependent pods from scheduling. |
| 🔵 | Windows node metrics exporter fix | Fix | Fixed missing Windows node metrics caused by an incorrect exporter port configuration. |
| 🔴 | Gatekeeper update to v3.23.1 | Security | Gatekeeper updated to v3.23.1, fixing excessive Validating Admission Policy reconciliation requests. |
| 🔴 | Managed Gateway API to v1.6.1 | Security | Managed Gateway API on Kubernetes 1.37 now uses the Gateway API v1.6.1 standard-channel CRD bundle, adding graduated TCPRoute and UDPRoute resources. |
| 🔴 | Istio service mesh security patches (ISTIO-SECURITY-2026-006) | Security | Istio add-on revisions updated with security patches for ISTIO-SECURITY-2026-006: asm-1-29 to v1.29.7 and asm-1-30 to v1.30.4; restart workload pods to reinject the updated istio-proxy sidecar. |
| 🔴 | Azure CSI driver updates | Security | Azure File CSI updated to v1.33.10/v1.34.9/v1.35.8, Azure Disk CSI to v1.33.11/v1.33.12/v1.34.6, and Azure Blob CSI to v1.27.10 across AKS versions. |
| 🔴 | Cloud Provider Azure component updates | Security | Cloud Provider Azure components updated to v1.33.17-2 and v1.36.5-2 (cloud-controller-manager, cloud-node-manager, health-probe-proxy), including Service Gateway support in the 1.36 CCM. |
| 🔴 | Cilium / Hubble Relay image updates | Security | Cilium, Hubble Relay, and ACNS FQDN policy images updated across Kubernetes versions to v1.16.19 (1.31), v1.17.18 (1.32), v1.18.12 (1.34), and v1.19.6 (1.36). |
| 🔴 | App Routing update to 0.2.28 | Security | App Routing updated to version 0.2.28 with ingress-nginx bumped to v1.13.10-10 and additional validation for custom log formats. |
| 🔴 | AKS node image updates | Security | Updated Windows Server 2022/2025, Azure Linux v3.0, Azure Container Linux, and Ubuntu 22.04/24.04 node images for August 2026, including security patch updates. |
| 🟡 | AppNet availability in additional regions | Preview | AppNet is now available in public preview in additional regions including Central US, East US, Japan East, North Europe, South India, Southeast Asia, West US 2, and West US 3. |
| 🔵 | AppNet retired versions | New/Updated | AppNet 1.0 (Istio 1.25), 1.1 (Istio 1.26), and 1.2 (Istio 1.27) are retired; self-managed upgrades should move to a currently supported version. |
| 🔵 | AppNet member-join prerequisite validation | Fix | AppNet now validates cluster prerequisites (Entra/AAD or Managed Gateway API add-ons, minimum K8s version) at member-join time and returns actionable errors instead of failing later. |
| 🔵 | AppNet Gateway API CRD ownership conflict fix | Fix | Clusters using AKS managed Gateway API no longer hit a CRD ownership conflict when joining a mesh. |
| 🔵 | AppNet Managed Control Plane cert rotation fix | Fix | Fixed an issue where the AppNet Managed Control Plane could fail to start after intermediate certificate authority rotation, which could disrupt the entire mesh. |
| 🔵 | AppNet cross-cluster east-west gateway label fix | Fix | Fixed missing required network labels on multicluster east-west gateways that caused cross-cluster traffic to fail. |
| 🔵 | AppNet Entra (managed identity) member update fix | Fix | Fixed an issue where member clusters using Microsoft Entra managed identity authentication were rejected on update, blocking member updates and version upgrades. |
| 🔵 | AppNet member leave cleanup fix | Fix | Orphaned mesh resources on a member cluster after it left the mesh are now cleaned up. |
| 🔵 | AppNet member deletion retry-loop fix | Fix | Fixed member deletion being stuck in a retry loop when the underlying cluster had already been removed; already-deleted resources are now treated as a success. |
| 🔵 | AppNet diagnostic log delivery fix | Fix | Fixed AppNet Managed Control Plane diagnostic logs being missing from customer Log Analytics workspaces. |
| 🔵 | AppNet component updates | New/Updated | AppNet updated to Istio 1.28.10 (1.3), Istio 1.29.6 (1.4), and Istio 1.30.3 (1.5, now available). |
⚡ Azure Functions
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | TLS/SSL certificate and end-to-end TLS encryption support for Flex Consumption | GA | GA for TLS/SSL certificates through a new site-scoped certificate model (up to 3 .pfx and 3 .cer per app, from direct upload, Key Vault, or App Service Managed Certificates) enabling custom domains, client-certificate auth, and mutual TLS; end-to-end TLS encryption is also GA, encrypting traffic between platform front ends and workers. |
🚨 Microsoft Security Exposure Management
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Improved MDASH onboarding experience | New/Updated | MDASH onboarding is reorganized into clear tasks within the setup flow for easier guided configuration, using the Standard scan configuration by default with optional override. |
| 🔵 | MDASH scan progress monitoring | New/Updated | Scan progress shows whether a scan is waiting, processing code, validating findings, or publishing results, including completed work, elapsed time, and output availability for long-running remote repository scans. |
🛡️ Microsoft Defender Cloud
| Indicator | Feature | Type | Description |
|---|---|---|---|
| ⚫ | Deprecation of “Machines should have a vulnerability assessment solution” recommendation | Deprecation | As part of the transition to individual recommendations, this recommendation will be deprecated on October 11, 2026; customers should use individual recommendations to review and manage vulnerability assessment coverage. |
| 🔵 | AWS GuardDuty coverage status on S3 asset page | New/Updated | Defender for Cloud now shows Amazon GuardDuty coverage status (Extended Threat Detection and Malware Protection) for AWS S3 buckets in the Cloud security details section, viewable without leaving the Defender portal. |
| 🔵 | Defender for Cosmos DB GA in Azure Government cloud | New/Updated | Defender for Cosmos DB in Azure Government cloud now aligns with the commercial cloud offering in feature coverage and runtime protection capabilities. |
🛡️ Microsoft Defender Cloud - Recommendations & Alerts
| Indicator | Feature | Type | Description |
|---|---|---|---|
| ⚫ | Retirement of legacy grouped recommendations (sub-assessments) | Deprecation | Retirement of legacy grouped recommendations has started; customers can no longer access the deprecated data through the API, and the portal and Azure Resource Graph may take a few days to reflect the change. |
| 🟢 | SQL Vulnerability Assessment individual recommendations (database level) | GA | GA of individual recommendations at the scanned database level for SQL Servers, covering 19 checks including xp_cmdshell revocation, latest updates, guest/DB user permissions, CLR, trusted assemblies, database ownership chaining, remote admin connections, default trace, password/check_policy, sa account handling, PUBLIC role permissions, and service broker endpoints. |
| 🟢 | Upgrade AKS to remove vulnerabilities from system pods | GA | Recommendation to upgrade Azure Kubernetes Service to remove vulnerabilities from AKS system pods is now generally available. |
| 🟢 | Container images in Docker Hub registry vulnerability findings | GA | Recommendation that container images in the Docker Hub registry should have vulnerability findings resolved is now generally available. |
| 🟢 | Expanded multicloud security coverage (200+ recommendations) | GA | Over 200 new multicloud security recommendations for AWS and GCP resources are now generally available across data, identity and access, networking, compute, and container categories (~90 new resource types) and now affect Secure Score. |
| 🟢 | PostgreSQL Flexible Server recommendations | GA | Nine recommendations are now generally available for Azure Database for PostgreSQL Flexible Servers under Defender CSPM, covering log retention, pgaudit settings, public IP/private endpoint, access to Azure services, geo-redundant backups, and secure transport. |
| 🟢 | Unused API endpoints in Function Apps | GA | Recommendation that unused API endpoints should be disabled and removed from Function Apps is now generally available. |
| 🟢 | Unused API endpoints in Logic Apps | GA | Recommendation that unused API endpoints should be disabled and removed from Logic Apps is now generally available. |
| 🟢 | Authentication on API endpoints in Function Apps | GA | Recommendation that authentication should be enabled on API endpoints hosted in Function Apps is now generally available. |
| 🟢 | Authentication on API endpoints in Logic Apps | GA | Recommendation that authentication should be enabled on API endpoints hosted in Logic Apps is now generally available. |
| 🟡 | Abnormally large SQL row extraction alert | Preview | New alert detecting an abnormally large number of rows extracted from your SQL server is available in preview. |
| 🟡 | EMR cluster recommendations | Preview | Preview recommendations for AWS EMR clusters: custom IAM roles, security configuration, public network access disabled on primary nodes, Kerberos authentication, termination protection, and encrypted logging. |
| 🟡 | Neptune DB recommendations | Preview | Preview recommendations for AWS Neptune: IAM Database Authentication, deletion protection, public access disabled, and encryption at rest. |
| 🟡 | Athena workgroup recommendations | Preview | Preview recommendations for AWS Athena: CloudWatch query metrics, workgroup enforcement, expected S3 bucket owner, query results location, and KMS-based encryption for query results. |
| 🟡 | Additional multicloud preview recommendations | Preview | New preview recommendations for AWS MSK, AWS OpenSearch Service, GCP App Engine, and GCP Certificate Manager across networking, data, identity and access, and compute categories. |
| 🟡 | Data/analytics service recommendations | Preview | Preview recommendations for AWS AppFlow (customer-managed KMS, Glue metadata), DataSync (data integrity, file-level audit, metadata preservation), FSx (backups/auditing), Amazon Kendra, Keyspaces, Kinesis, Amazon MQ, QuickSight, CodeBuild, Cognito, AppSync, WorkSpaces/AppStream, Auto Scaling Groups, EMR, and DMS covering encryption, access control, auditing, and least privilege. |
| 🟡 | ECS Fargate and serverless containers recommendations | Preview | Preview recommendations for ECS Fargate (least-privilege IAM task roles, no elevated privileges, read-only root filesystem, not publicly exposed, ECS Exec logging/disablement) and Azure Container Apps/Container Instances (authentication, public exposure, least-privilege managed identities). |
🎯 Microsoft Defender XDR
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Identity Security dashboard and Coverage & Maturity | GA | The Identity Security dashboard provides a centralized view of identity-related security risks and posture; Coverage & Maturity helps security teams understand protection across on-premises, cloud, SaaS, identity providers, and partner technologies, identify gaps, and prioritize posture improvements. |
🆔 Microsoft Defender Identity
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Identity Security dashboard and Coverage & Maturity | New/Updated | Centralized view of identity-related security risks and posture with Coverage & Maturity, helping teams identify coverage/deployment gaps and prioritize actions across on-premises, cloud, SaaS, identity providers, and partner technologies. |
| 🟡 | Sensor v3.x onboarding without Defender for Endpoint (Preview) | Preview | Defender for Identity sensor v3.x can now be activated on eligible domain controllers (Windows Server 2019+) without first onboarding them to Defender for Endpoint; supports new sensor v3.x deployments only. |
| 🟡 | Sensor v3.x support for AD CS, AD FS, and Entra Connect (Preview) | Preview | Sensor v3.x now supports eligible AD FS, AD CS, and Microsoft Entra Connect servers that aren’t domain controllers, with manual activation and automatic Windows event auditing supported. |
| 🔵 | Combined Sensor management tab | New/Updated | The Onboarding and Sensors tabs on the identity On-premises settings page are combined into a single Sensor management tab; automatic sensor v3.x activation is now configured on the Advanced features page. |
🔍 Microsoft Defender Endpoint
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Memory scan for Linux | Preview | [Linux] Memory Scan extends MDE protection on Linux by inspecting process memory for known malicious behaviors and memory-resident threats, adding protection against in-memory malware and code injection; available in Defender version 101.26071.0005+ in the Insiders-slow channel. |
| 🟡 | MDE plug-in support for WSL containers (WSLc) | Preview | Extend MDE protection to workloads running in WSL containers with visibility through device inventory, alerts, incidents, device timeline, and Advanced Hunting across Windows and Linux workloads; available in public preview via registration form. |
💿 MDE Release Notes
Linux Releases
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Memory scanning | Preview | [Linux] Release 101.26072.0004 adds process memory scanning to detect known malicious behaviors and memory-resident threats, strengthening protection against in-memory attacks. |
| 🔵 | Platform support additions | New/Updated | [Linux] Added support for Ubuntu 26.04, openSUSE Leap 16, and Fedora 44. |
| 🔵 | Reliability and quality improvements | New/Updated | [Linux] General reliability and quality improvements included in release 101.26072.0004. |
| 🔵 | Fixed wdavdaemon restart while scanning | Fix | [Linux] Fixed an issue that could cause the wdavdaemon process to restart in rare cases while scanning running processes. |
📱 Microsoft Intune
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | New Remote Help for Windows version | New/Updated | [Windows] Remote Help for Windows version 5.2.1040.0 is now available, updating subscription metadata for E3, E5, and E7 licenses (features unchanged from 5.2.1037.0). |
🔎 Microsoft Purview
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟢 | Network Data Security via Entra Global Secure Access integration | GA | Integrate Microsoft Entra Global Secure Access with Purview to protect text, files, and AI interactions at the network layer, enforce restrictive DLP actions, and detect risky user activity through Insider Risk Management, preventing sensitive data sharing with untrusted cloud apps including generative AI platforms. |
📊 Microsoft Fabric
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🟡 | Capacity Operation Events in Real-Time Hub | Preview | Real-Time Intelligence adds operation-level telemetry for capacity consumption, duration, throttling, workspaces, and items through capacity operation events in the Real-Time Hub. |
| 🟡 | Workspace outbound access protection for Fabric Maps | Preview | Workspace outbound access protection for Fabric Maps allows only approved map data sources and external geospatial services through workspace data connection rules. |
🐙 GitHub Security
| Indicator | Feature | Type | Description |
|---|---|---|---|
| 🔵 | Code scanning AI Scan no longer requires CodeQL default setup | New/Updated | AI Scan for pull requests can now find security vulnerabilities even when CodeQL default setup isn’t enabled, running more broadly across eligible repositories; in public preview on github.com for GHAS customers (Enterprise Server not supported). |
| 🔵 | npm extends recovery-code security holds to all accounts | New/Updated | npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, pausing publishing and other security-sensitive writes (e.g. access token creation) to slow account-takeover attempts and reduce malicious publishing. |
| 🔵 | CodeQL 2.27.0 adds Linux ARM64 support | New/Updated | CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded Java/Kotlin and C# framework coverage (Micronaut, ASP.NET Core, OData), and analysis accuracy improvements, plus C/C++ PostgreSQL libpq SQL injection sinks and GitHub Actions author-association check improvements. |
| 🔵 | GitHub Advanced Security expands trial availability | New/Updated | More Enterprise Cloud customers can now start a self-serve GHAS trial to evaluate GitHub Code Security and Secret Protection; eligibility expanded from enterprises up to 100 licenses to up to 300. |
| 🔵 | Block pull requests with exposed secrets from merging | New/Updated | Repository rulesets can now block pull requests from merging when they introduce secret scanning alerts via the new “Require secret scanning alerts are resolved” rule, adding a PR-layer defense beyond push protection; available in public preview for GitHub Secret Protection or GHAS. |
| 🔵 | Remediate Code Quality findings with agentic autofix | New/Updated | Agentic autofix lets you assign up to 25 standard code quality findings to Copilot at once, which fixes them on a branch, validates changes, and opens a PR; follows existing GitHub Code Quality policy and consumes AI credits. |
| 🔵 | Enforce GitHub Advanced Security configurations | New/Updated | Enterprise administrators can now enforce GHAS configurations across organizations, preventing both organization and repository admins from overriding enterprise-level settings via “Don’t enforce”, “Enforce for repository owners”, or “Enforce for repository and organization owners”. |
| 🔵 | Automatic Dependabot access to GitHub-hosted registries | New/Updated | Dependabot’s GITHUB_TOKEN can now read private GitHub Packages registries without a PAT by reusing “Manage Actions access” grants, removing the need for PAT-based registry entries (rollback was resolved; registry credentials/tokens take precedence). |
| 🟡 | AI Scan for pull request APIs | Preview | New REST API endpoints at organization and repository levels manage AI Scan for pull request enablement programmatically; org settings control running, repository settings allow per-repo toggling, and in public preview on github.com for GHAS customers. |
| 🔵 | Control GitHub Actions cache access with cache-mode | New/Updated | cache-mode now applies least-privilege access to the Actions cache at workflow/job level (read/write/write-only/none), helping protect trusted workflows from cache poisoning; GA on all plans, with security warnings when granting write on low-trust events. |
| 🟢 | Multiple trusted publishing configurations for npm | GA | GA of multiple trusted publishing (OIDC) configurations per package, staged packages only approved after malware scanning completes, and maintainer staged history in the package versions tab. |
Top 5 Action Items
| Priority | Action | Due | Affected Product(s) |
|---|---|---|---|
| 🔴 High | Patch Istio service mesh add-ons to v1.30.4/v1.29.7 to remediate ISTIO-SECURITY-2026-006 and restart workloads | Immediately | AKS |
| 🔴 High | Migrate deprecated Availability Sets (VMAS) clusters to VM node pools before September 30, 2026 | By Sep 30, 2026 | AKS |
| 🔴 High | Migrate from Azure Linux with OS Guard (preview) to Azure Container Linux before December 10, 2026 | By Dec 10, 2026 | AKS |
| 🔴 High | Transition from grouped “Machines should have a vulnerability assessment solution” recommendation to individual recommendations | By Oct 11, 2026 | Microsoft Defender Cloud |
| 🟡 Medium | Configure namespace-scoped secrets access for Prometheus PodMonitor/ServiceMonitor before upgrading AKS to Kubernetes 1.37 | Before AKS 1.37 upgrade | AKS |
Security Architect Observations
- AKS lifecycle dominates the window: Availability Sets auto-migration, Azure Linux with OS Guard retirement (Dec 10, 2026), and AppNet/Istio version retirements require coordinated migration planning and node image turnover before deadlines.
- The grouping-to-individual recommendation transition (vulnerability assessment and SQL VA moved to per-database/per-scan level) changes how coverage is aggregated, reported, and consumed via API/Resource Graph — rework dashboards and policy before the October 11 deprecation.
- GitHub code security posture shifts: AI Scan is now decoupled from CodeQL default setup, GHAS settings can be forcibly enforced at the enterprise level, and Actions cache access is now least-privilege driven — update CI/CD governance and security configuration baselines.
- Defender multicloud coverage expansion adds 200+ AWS/GCP recommendations that now affect Secure Score, broadening the compliance and reporting surface; plan for increased remediation noise across ~90 new resource types.
- Identity posture gains a centralized view: Identity Security dashboard / Coverage & Maturity plus Defender Identity sensor v3.x can now be deployed independently of Defender for Endpoint and supports AD CS/AD FS/Entra Connect — a new identity-first coverage and maturity tracking architecture.
- Purview network-layer DLP through Entra Global Secure Access integration adds defense-in-depth for AI/risky cloud interactions, but requires intentional network segmentation and conditional-access alignment.
Security Operations Observations
- AKS behavioral changes affect runtime and net-new security guardrails: dual-stack IPv6 removal is now rejected, KMS encryption requires versionless key IDs on 1.37, managed namespaces can’t use
kube-/aks-istio-prefixes, and LocalDNS auto-enables on 1.37 — review cluster configurations before upgrades to avoid breakage. - MDE Linux now offers memory scanning (preview) to detect in-memory/memory-resident threats and supports Ubuntu 26.04, openSUSE Leap 16, and Fedora 44 — prioritize rolling out memory scan to high-risk Linux workloads and re-tune hunting queries for in-memory detections.
- Defender Identity sensor v3.x adds support for AD FS, AD CS, and Entra Connect servers plus the combined Sensor management tab — extend sensor coverage to these identity roles and update onboarding/activation procedures.
- GitHub Supply-chain detections expand: block PRs that introduce secret-scanning alerts, Dependabot reads private registries without PATs, and npm imposes a 72-hour recovery-code hold on publishing — update SOC runbooks for secret exposure and account-compromise scenarios.
- Defender SQL VA recommendations move to the database level and PostgreSQL Flexible Server GA recommendations add pgaudit/logging checks — retune alerting, reporting, and remediation ownership to the new scoping.
- GitHub Actions
cache-modewarns against write access on low-trust events (e.g.pull_request_target); review workflow cache settings to avoid cache-poisoning exposure while preserving least privilege.
References
This post is licensed under CC BY 4.0 by the author.