Cloud Run

Apigee X's VerifyJWT, VerifyJWS, GenerateJWS, and DecodeJWS policies now handle RFC 7797 unencoded payloads (b64:false), including detached content, and VerifyJWS/VerifyJWT enforce that b64 be listed in crit before accepting such tokens. This is breaking: any proxy that previously set b64 through an AdditionalHeaders variable to produce an RFC 7797 JWS must switch to the UnencodedPayload policy option (with DetachContent for detached payloads), since AdditionalHeaders now rejects a b64 entry with a new InvalidNameForAdditionalHeader fault.

Matters for: Apigee X API teams whose proxies use JWT and JWS policies for signed payload verification and generation, particularly those with custom AdditionalHeaders configurations for the b64 header.

New managed Cloud Service Mesh proxy versions are rolling out across the rapid, regular, and stable release channels, and the CVE tables show several of the fixed vulnerabilities (including CVE-2026-19931, CVE-2026-81870, CVE-2026-82474, CVE-2026-84303, and CVE-2026-84304) affect the Cloud Run component of the mesh proxy. Applying these channel rollouts patches those CVEs in the Cloud Run-integrated proxy without requiring any manual configuration change.

Matters for: Teams running Cloud Run services with Cloud Service Mesh sidecar injection or Gateway API integration on GKE.

The provided source text covers updates to Anti Money Laundering AI, Apigee hybrid, the App Optimize API, and BigQuery, but it contains no mention of Cloud Run or any change to it. Because no Cloud Run-specific content exists in the source, no new capability or breaking change can be described for it.

Matters for: This applies to anyone expecting Cloud Run release notes from this particular update, since the source text does not address Cloud Run at all.

Cloud Run now generally supports specifying custom target CPU or concurrency utilization through scaling controls, moving this capability out of preview. Teams can rely on these scaling controls in production deployments without preview limitations.

Matters for: Relevant to teams running latency-sensitive or variable-load services on Cloud Run who need finer-grained autoscaling behavior tuned to CPU or request concurrency targets.