Release vNext
Release period: 2026-08-26 to 2026-09-02
This release includes the following issues:
- One Broken Building Block No Longer Blocks a Whole Workspace
- Fixed Missing User Email When Logging in via Microsoft Entra ID
- Improved API Stability During Nightly Replication
- Improved Access Checks for Workspace Data
- Use meshStack Tags as Building Block Inputs
- No More Dead-End Actions on Deleted Platforms
- Copy an Integration's UUID From the Edit Integration Page
- Renamed Two Policy Fields in the Building Block Definition API
- Error Details in Admin Tables No Longer Get Cut Off
- Sensitive Building Block Inputs No Longer Accept Default Values
- Fixed AWS Replication Failing During SCIM Group Membership Updates
- Consistent Input Controls Across All Building Block Forms
- Building Block Configuration Changes Are No Longer Dropped Under High Load
- Marketplaces Hidden When OSB Services Are Disabled
- Unused Marketplaces Can Now Be Deleted
- Building Block Inputs Can Now Be Optional
- Fixes for Number and Read-Only Building Block Inputs
- Sensitive Building Block Inputs Must Use an Encryptable Type
- Improved Handling of Secret Values Between Panel and Backend
- Sensitive Default Values No Longer Break During Building Block Upgrades
- Self-Hosted Runners Without WIF No Longer Show a Misleading Configuration
- See Which Building Block Manages a Platform or Landing Zone
Ticket Details
One Broken Building Block No Longer Blocks a Whole Workspace
Audience: User
Description
Until now, a single building block whose configuration meshStack could not resolve stopped every other building block in the same workspace from running: new building blocks never started and deletions never went through.
Now we skip only the building block we cannot resolve, together with the building blocks that depend on it. All other building blocks in the workspace keep running as usual.
How to use
This mostly affects workspaces that build their own building block definitions. Only a draft version of a building block definition can still be changed, and a draft version can only be used inside the workspace that owns it, so a version that gains a dependency while building blocks already run on it never reaches anyone else's workspace.
It can also happen on a released version, in one temporary situation: a tenant was deleted while some of its building blocks still wait for their cleanup. meshStack cleans these up automatically, and the skip disappears with them.
Fixed Missing User Email When Logging in via Microsoft Entra ID
Audience: User
Description
The Microsoft Entra ID integration set up its identity provider without requesting the profile and email scopes, so newly imported users had no email address and could get stuck in a login loop. New integrations now request both scopes. An existing integration picks up the fix when you save it again.
Improved API Stability During Nightly Replication
Audience: User
Description
We fixed an issue where the meshStack API could become completely unavailable for several minutes during the nightly replication window. When many background jobs ran at the same time, the API was restarted even though it would have recovered on its own, causing failed requests, for example logins from automation that is triggered by replication itself. The API now stays up during such load peaks, so short slowdowns no longer turn into outages.
Improved Access Checks for Workspace Data
Audience: User
Description
We improved access checks for low criticality data across meshStack to better protect your workspace data.
For example, workspace members can now read statistics only for projects they can access. Previously, they could read statistics (e.g. number of tenants) from other projects in the same workspace.
Use meshStack Tags as Building Block Inputs
Audience: User
Description
You can now feed the metadata meshStack already governs straight into your building blocks. Pick "Tag" as the source of a building block input, choose a tag key, and meshStack fills in that tag's value for every building block instance. No more asking your users to re-type a cost center, an environment classification or a business unit that meshStack already knows.
Tenant building blocks can read tags of the workspace, project, payment method and landing zone they belong to. Workspace building blocks can read workspace tags. Restricted tags work too, and the definition only ever stores the tag key, so values stay scoped to the building block that resolves them.
When the value of a tag your building block reads changes, we automatically trigger a new run, so your provisioned resources follow the metadata. We also protect you from breaking a running building block: a tag definition can no longer be deleted while a building block reads it, and we name the building block definition that declares the input so you know where to remove it.
How to use
In meshPanel, edit a building block definition version, add or edit an input and set its source to "Tag", then pick the tag key you want. The input type is set to Code for you, because a tag value is a list of strings and arrives as a sorted JSON array such as ["CC-1234"]. In OpenTofu, declare the variable as list(string). If the tag holds no value on the object the building block reads it from, the value is null, so make the variable nullable unless the tag is mandatory in your tag schema.
Tag inputs are also available through the meshObject API: set an input's assignmentType to TAG, its type to CODE and its argument to the tag you want to read, for example WORKSPACE.costCenter.
See our Building Block documentation for details: https://docs.meshcloud.io/docs/concepts.building-block.html#tag-input
No More Dead-End Actions on Deleted Platforms
Audience: User
Description
The Platforms list no longer shows an Actions menu for a platform that has already been deleted. Previously the menu offered "Configure Platform", "Delete Platform" and "Send Message to Users" for deleted platforms, but every one of them led to a read-only page or an empty audience, because a deleted platform can no longer be configured, deleted again, or messaged. You now see at a glance which platforms you can still act on.
How to use
You can still open a deleted platform by clicking its name in the list. Its pages remain available in read-only mode, including the Danger Zone, where you can look up when it was deleted, who deleted it, and the reason given.
Copy an Integration's UUID From the Edit Integration Page
Audience: User
Description
The Edit Integration page now shows the integration's UUID with a click-to-copy button, just like other meshStack objects. You no longer need to extract the UUID from the browser URL or the API when referencing an integration, for example in support requests or automation.
Renamed Two Policy Fields in the Building Block Definition API
Audience: User
Description
Breaking Change (Preview API): We renamed two fields in the meshBuildingBlockDefinition meshObject API.
spec.approvals is now spec.approvalPolicies, and spec.scheduleConfig is now spec.schedule. The names now
match what the fields hold, so you can tell from the request body which policy you are setting.
Error Details in Admin Tables No Longer Get Cut Off
Audience: User
Description
When an action on a table row fails, we show the reason in a small popover next to the row. Until now that popover was trapped inside the table: it was squeezed to roughly a third of its width, cut off at the edge of the table, and it pushed a scrollbar into the table instead of growing. Longer messages were unreadable.
The popover now floats above the table at full width and is styled as an error, so you can read the whole message - including the error ID you need when you contact support - without scrolling. This applies everywhere we report a failed row action, including the tag definition, user, API key, service broker, landing zone and service instance tables.
Sensitive Building Block Inputs No Longer Accept Default Values
Audience: User
Description
meshStack now rejects a default value on any sensitive building block input. Previously we accepted one on static inputs, where it was never used. Inputs that already managed to get a default value keep it and stay editable, for now.
Fixed AWS Replication Failing During SCIM Group Membership Updates
Audience: User
Description
Replication of AWS tenants that use the SCIM-based AWS SSO integration could fail with the AWS error "Replacing group memberships is not supported", for example on the AWS European Sovereign Cloud. meshStack previously replaced the full member list of a group, which newer AWS SCIM endpoints reject. We now assign and unassign individual members instead, so your project roles replicate reliably again. Users that meshStack assigned and that were then removed directly in AWS are assigned again on the next replication. Members you added to a group outside of meshStack are no longer removed, because AWS does not report them to us.
Consistent Input Controls Across All Building Block Forms
Audience: User
Description
Building Block inputs now look and behave the same in every form, whether you are ordering a new Building Block, editing its settings, configuring a run or upgrading to a new version. Boolean inputs now read "On" and "Off" on their toggle, and code inputs use the full width of the form so longer scripts stay readable.
Building Block Configuration Changes Are No Longer Dropped Under High Load
Audience: User
Description
We fixed a bug that could make a change to a Building Block's configuration silently have no effect. When the platform was busy, the change could be discarded on its way to being applied, so no Building Block Run was started, the Building Block kept its previous configuration and nothing reported a problem. Such a change is now retried automatically and takes effect as expected.
Marketplaces Hidden When OSB Services Are Disabled
Audience: User
Description
Marketplace platforms are no longer shown in the project and tenant creation dialogs when OSB Services are disabled for your meshStack.
Unused Marketplaces Can Now Be Deleted
Audience: User
Description
You can now delete a marketplace that has no service brokers and no service instances. Marketplaces that still hold either remain protected from deletion. The global marketplace can also be deprecated once it is unused.
Building Block Inputs Can Now Be Optional
Audience: User
Description
When you define a building block, you can now mark an input as optional. Whoever orders the building block may
leave it blank, and your implementation falls back to the default declared in its own code: a Terraform variable's
default, or a workflow input's default.
Optional inputs are available on every implementation type except manual building blocks. Boolean inputs cannot be optional.
How to use
Open a draft building block definition version and switch on "optional" for the input. An optional input cannot carry a meshStack default value, since the default now lives in your implementation.
When you prefill inputs from your OpenTofu sources, every variable that declares a default is imported as optional and the default stays where you wrote it, in your repository.
An optional input never holds a building block back. If you mark a platform operator input optional, ordering no longer waits for an operator to confirm it, and we no longer ask them to act on it.
Screens that show inputs mark the optional ones, so it is clear what may be left blank, and one left empty reads "-not set-" instead of showing nothing at all. A run is no longer reported as missing values for an optional input that was left empty.
Optional inputs are also available through the meshObject API, which reports whether an input is optional and lets you clear one again by supplying no value.
Fixes for Number and Read-Only Building Block Inputs
Audience: User
Description
We fixed two problems in the forms where you fill in Building Block inputs.
A code or file input that the Building Block's provider does not allow you to change looked fully editable, but silently discarded anything you typed. It is now greyed out and read-only, so you can see up front that the value is fixed.
A number input accepted decimals such as 1.5, which were quietly truncated to 1 by the time the Building Block
ran. The form now asks you for a whole number instead.
Sensitive Building Block Inputs Must Use an Encryptable Type
Audience: User
Description
meshStack now validates when you save a building block definition version that a sensitive input uses an encryptable type (string, code or file). Previously a sensitive input of another type, such as an integer or a selection, could be saved but failed later when a building block tried to provide a value for it. A misconfigured definition is now rejected immediately with a clear error message.
Improved Handling of Secret Values Between Panel and Backend
Audience: User
Description
We improved and cleaned up how secret values are exchanged between the panel and the backend. Sensitive arguments, default values and input values of building blocks are now consistently represented by a secret hash instead of the internal placeholder that was used before. This also makes secret changes visible in event logs: the change history of a building block definition version now records when a secret value was changed, and the building block event log shows a changed secret input as two different secret hashes, where both sides previously showed the same placeholder. The meshObject API is unaffected, because it already used the secret hash representation.
Sensitive Default Values No Longer Break During Building Block Upgrades
Audience: User
Description
When you upgraded a building block to a definition version that introduces a sensitive input with a default value, meshStack encrypted the already encrypted default a second time. The building block run then received an unusable value instead of the intended secret. Upgrades now apply sensitive default values correctly.
Self-Hosted Runners Without WIF No Longer Show a Misleading Configuration
Audience: Operator
Description
A self-hosted building block runner set to Public visibility previously showed the meshcloud-hosted
cluster's issuer and subject in its Workload Identity Federation dialog whenever the runner had no
Workload Identity Federation configuration of its own. Those values describe meshStack's own cluster and
never applied to a self-hosted runner, so a trust relationship built from them could not work. Such
runners now show "Not configured", which is what self-hosted runners set to Private already did.
See Which Building Block Manages a Platform or Landing Zone
Audience: User
Description
Platforms and landing zones are increasingly onboarded by a building block rather than by hand, for example by a reference architecture that sets up a platform together with its landing zones. Both lists now show a "managed by" link naming the building block that created the platform or landing zone, so you can see at a glance which objects a building block owns and jump straight to it.
How to use
This appears automatically, for existing platforms and landing zones as well as for new ones: in the Platforms list and in the Landing Zones list, both in the admin area and in a platform's own Landing Zones tab.
Only building blocks you have access to are named. A platform or landing zone created by a building block in a workspace you cannot see, or by one that has been deleted in the meantime, looks just like any other.