Security updates​

• Go runtime upgraded from 1.25.8 to 1.25.12.
• golang.org/x/net v0.57.0 (CVE-2026-46600)
• golang.org/x/text v0.40.0 (CVE-2026-56852)
• golang.org/x/crypto v0.54.0

Upgrade​

Run a helm upgrade with the new image tag in your values.yaml. See the Helm installation guide.

# Azure or GCP
image:
  repository: public.ecr.aws/nullplatform/controlplane-agent
  pullPolicy: Always
  tag: 0.9.0

# AWS
image:
  repository: public.ecr.aws/nullplatform/controlplane-agent
  pullPolicy: Always
  tag: aws-0.9.0

Highlights​

• New interactive browser login against your organization's SSO: np login --np-url https://<your-org>.app.nullplatform.io, or set the NP_LOGIN_URL environment variable and run np login with no flags. See logging in from the terminal.
• New username and password login for organizations without SSO: np login --username --password --organization-id.
• New np query command to run read-only SQL against your organization's data lake, with an interactive editor included.
• np build start now reports the CI context of a build (provider, run, actor, and workflow), auto-inferred on GitHub Actions, GitLab, Jenkins, CircleCI, Azure DevOps, Bitbucket, Buildkite, and Travis.
• np service workflow build-context now supports service notifications.
• New np namespace delete command.

Fixes​

• np service-action exec no longer reports a successful script as failed when it emits a large amount of output before exiting.

Security updates​

• golang.org/x/sys v0.47.0 (CVE-2026-39824)
• golang.org/x/text v0.40.0 (CVE-2026-56852)

Upgrade​

curl https://cli.nullplatform.com/install.sh | sh

Highlights​

• Kubernetes scope deployments now show their progress in real time as "X/Y launched" and "X/Y healthy", so you can tell how far along a rollout is at a glance.
• Scheduled task scopes have a new Kill instance action to terminate an individual running job instance.

Fixes​

• Triggering a scheduled task job on a scope that is not deployed now fails with a clear message instead of an opaque error.

Upgrade​

If you pin the scopes version in your agent's values.yaml, update the branch reference:

configuration:
  values:
    GITHUB_REPO: "github.com/nullplatform/scopes.git"
    GITHUB_BRANCH: "v1.14.0"

Highlights​

• AWS credentials can now be obtained via assume role.
• ALBs can be auto-created when a scope is created, instead of requiring one to exist beforehand.
• Scheduled task scopes support nodeSelector, so you can pin jobs to specific node groups.

Fixes​

• Fixed a race condition in IAM role creation when multiple scopes are created concurrently.

Upgrade​

If you pin the scopes version in your agent's values.yaml, update the branch reference:

configuration:
  values:
    GITHUB_REPO: "github.com/nullplatform/scopes.git"
    GITHUB_BRANCH: "v1.13.0"

✨ Run into a problem? Just ask the AI assistant​

When a deployment doesn't look right, the AI assistant is one click away in the platform. Open it and just ask. No IDs, no context to paste. It already knows what you're looking at, and returns a clear diagnosis, root cause, and next steps in seconds.

Answers come back as live widgets too. Instead of walls of text, you get tables, charts, and status cards you can read at a glance.

Investigate, debug, and troubleshoot, right where you work. 🚀

👉 See the AI assistant docs.

✨ Require approval before resolving action items​

Now when a developer resolves, defers, or rejects an action item, that change can go through nullplatform's standard approvals engine, the same one you already use across the platform. Instead of a separate embedded flow, you can require a reviewer to sign off before the item's state changes.

For example, to require a reviewer before a critical item can be rejected, create the approval action:

curl -L -X POST 'https://api.nullplatform.com/approval/action' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <token>' \
-d '{
    "nrn": "organization=1:account=2",
    "entity": "action_item",
    "action": "action_item:reject",
    "on_policy_success": "approve",
    "on_policy_fail": "manual"
}'

Then attach a policy that auto-approves every rejection except critical ones:

{
    "nrn": "organization=1:account=2",
    "name": "Manual review for rejecting critical items",
    "conditions": {
        "action_item.priority": { "$ne": "critical" }
    }
}

👉 See the Action items docs and how to require approval.

✨ Control secret access by environment​

Approvals and policies for reading secret parameter values can now be scoped to specific dimensions, like an environment. Instead of unlocking every value of a parameter at once, an approval scoped to environment: development reveals only the development value and keeps the rest — including production — hidden.

This makes secret access per-environment: developers get instant, audited access in lower environments, while production stays behind a manual review.

For example, create the approval action for parameter:read-secrets:

curl -L -X POST 'https://api.nullplatform.com/approval/action' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer <token>' \
-d '{
    "nrn": "organization=1:account=2",
    "entity": "parameter",
    "action": "parameter:read-secrets",
    "dimensions": {},
    "on_policy_success": "approve",
    "on_policy_fail": "manual"
}'

Then attach a policy that auto-approves secret reads only in the lower environments, so production requests fall through to manual review:

{
    "nrn": "organization=1:account=2",
    "name": "Auto-approve secret access in lower environments",
    "conditions": {
        "dimensions.environment": { "$in": ["development", "staging"] }
    }
}

👉 See Accessing secret values and the new tutorial Approve secret access by environment.

✨ Use nullplatform from Kiro​

The nullplatform AI plugins now work with Kiro, so you can interact with nullplatform straight from Kiro the same way you already can from Claude Code, Factory AI, and Codex CLI. Describe what you need in plain language and the plugin queries entities and calls the right API endpoints for you.

👉 See the AI plugins setup guide.

That's all for June, from the nullplatform team! ❤️

Highlights​

• np account read --show-deleted lets you read accounts that have been deleted.
• New np entity-hook find command to look up entity hooks.

Fixes​

• Flags defined as snake_case in the API specs are now also accepted in their kebab-case form (for example --show-deleted matches the spec's show_deleted).
• np service-action exec no longer hangs when a script emits a single output line larger than 64 KB, and stream read errors now mark the action as failed instead of leaving it stuck in progress.

Upgrade​

curl https://cli.nullplatform.com/install.sh | sh

Highlights​

• Parameters of type file now support binary values, and file parameters are no longer injected as environment variables.
• Public and private scopes using DNS_TYPE=external_dns now register their DNS records in the correct Route53 hosted zone, preventing cross-zone record leakage.
• The main HTTP port of Kubernetes scopes is now configurable (default 8080), and additional ports support HTTP. Requires traffic manager container version 1.7.0 or later.
• Container memory and CPU limits are now configurable independently from requests.
• Diagnose checks now emit structured evidence with severity, affected resources, and suggested actions, failure findings embed the relevant pod log slice, and a new Application Logs category surfaces your application container's log tail directly in the UI.
• When a deployment fails waiting to become active, repeated probe failures are consolidated into a single readable line, a progress heartbeat is emitted, and a suggested fix is shown based on the failure mode.

Upgrade​

If you pin the scopes version in your agent's values.yaml, update the branch reference:

configuration:
  values:
    GITHUB_REPO: "github.com/nullplatform/scopes.git"
    GITHUB_BRANCH: "v1.12.0"

✨ Configurable HTTP ports for Containers scopes​

Not every application binds to 8080, and some need to expose more than one HTTP listener. Containers scopes can now bind the main HTTP listener to any port and expose extra HTTP ports alongside it, all from the Exposed Ports section of the scope form.

What you get:

• A configurable main_http_port (default 8080, range 1024 to 65535). Nullplatform threads it through the Service, Ingress, container port, and health probes automatically.
• HTTP support for additional_ports, each with its own Service and Ingress. Extra ports become reachable over HTTPS at the same hostname, with SSL terminated at the ALB using the existing wildcard certificate.

The change is fully backward-compatible: scopes that don't set a main port keep using 8080, and existing GRPC additional ports keep working without changes.

👉 See the Configurable HTTP ports docs.

✨ Tunable CPU and memory limits for Containers scopes​

Containers scopes now let you set CPU and memory limits independently from requests, so an application can request more resources than its steady-state baseline. The fields live under the ADVANCED → Resources tab and both default to Same as request.

This is an advanced knob with real trade-offs. Raising a limit above its request drops the pod from the Guaranteed to the Burstable QoS class, changing how Kubernetes schedules, throttles, and evicts it. The new page walks through each risk: QoS downgrade, memory overcommit and OOMKill, and CPU throttling. For most workloads, sticking to the default behavior remains the safer choice.

👉 See the CPU and memory limits docs.

✨ WAF protection for Static files scopes​

Static files scopes can now attach an existing AWS WAF WebACL to their CloudFront distribution, adding managed rules, rate limiting, and request filtering in front of your assets. The feature is opt-in and adds no IAM overhead unless enabled.

Set aws_security = "waf" and the WebACL name in your scope-configurations provider, or use the Security tab in the UI. Attaching, swapping, or detaching a WebACL is always an in-place update: the distribution ID stays stable and there's no downtime.

👉 See the WAF protection docs.

✨ Conditional firing for entity hooks​

You can now fire an entity hook only when the event that triggered it matches specific conditions, for example only when a deployment switches traffic to 100%. Instead of filtering the hook itself, you filter the notification channel the hook delivers through, using the same filters mechanism already available for Slack, HTTP, and agent notifications.

The framework injects the triggering operation's request_body into the notification context, so channel filters can match on any field from the API request that fired the hook.

👉 See the Conditional hook firing docs.

✨ Reference namespace and account in your specifications​

The additionalKeywords jq context used by specifications now exposes the parent namespace and account of the resolved entity, alongside the existing application, scope, and service data. Both are derived automatically from the NRN cascade, so no extra parameter is needed to reference values like .namespace.slug or .account.slug in your dynamic schemas.

👉 See the External fields docs.

✨ CLI 2.7.0​

We've released version 2.7.0 of the nullplatform CLI, with a new command option and a bug fix.

What's new in CLI 2.7.0:

• np account read --show-deleted now lets you read deleted accounts.
• Fixed np service-action exec hanging when the command's stdout exceeded 64 KB.

Install the latest version:

curl https://cli.nullplatform.com/install.sh | sh

👉 See the CLI docs for more info.

That's all for May, from the nullplatform team! ❤️

✨ Configure agent-backed scopes from the UI​

Agent-backed scopes can now be configured from the nullplatform UI. Instead of managing every scope option through environment variables in your agent, you can define settings like Kubernetes namespace, domain, deployment strategy, and security options directly from the platform, using the same provider you already use for cloud credentials.

Configuration resolves in a clear priority order: provider configuration overrides environment variables, which override defaults. Apply settings at the organization, account, namespace, or scope level and let child levels inherit or override as needed.

Configure scopes from Platform Settings → Scopes → Configurations.

👉 See the Scope configurations docs.

✨ Static files scope​

The Static files scope is a new scope type for deploying SPAs, static websites, and front-end bundles. Nullplatform provisions the full CDN stack and handles DNS, HTTPS, and cache invalidation automatically, with no server-side runtime required.

What you get:

• CDN distribution: CloudFront on AWS or Azure CDN on Azure, with HTTPS and SPA-friendly routing
• Automatic DNS: a custom subdomain ({app}-{scope}.your-domain.com) created and pointed at the CDN
• Cache invalidation: assets refreshed on every deployment
• Rollback: redeploy any previous release to instantly switch the CDN origin

👉 See the Static files docs to set it up on AWS or Azure.

✨ Data lake​

The data lake gives you SQL read access to a queryable replica of your nullplatform organization's data. You can query audit events alongside the current state of your applications, scopes, deployments, parameters, and other resources, all through a single endpoint.

What you can do with it:

• Build custom reports: Feed platform data into BI tools or external dashboards without manual exports.
• Investigate incidents: Cross-reference audit events with resource state at the time of a failure.
• Query with access control: Results are scoped automatically to the resources your API key can access via NRN.

👉 See the Data lake docs to connect and run your first query.

✨ Security best practices​

We published a security best practices guide for teams using nullplatform, covering the key areas to get right from the start.

Topics covered:

• Namespace-based team separation and least-privilege role assignments
• Secrets and parameters: versioning, rotation, and avoiding hardcoded values
• Pipeline safety: machine-user API keys, approval workflows, and deployment controls
• Observability: audit logs, alerting, and maintaining visibility over changes

👉 See the Security best practices docs.

✨ Keep parameter values in your own backend​

A new Storage section under Platform settings > Parameters & Secrets lets you keep parameter values in a backend you control instead of nullplatform's database. Two variants are available at launch:

• HashiCorp Vault Self-Hosted: register your Vault address, mount, and base path in nullplatform. The Vault token never leaves your environment; nullplatform forwards the connection metadata to your handler on every parameter lifecycle event.
• Other agent-backed Storage: a generic option that routes parameter lifecycle events to a notification channel you configure. Use it for cloud secret managers, internal vaults, or any backend reachable from your infrastructure.

The developer experience stays the same: parameter values still appear in the UI and the CLI and API contract is unchanged.

👉 See the Storage backends overview for a comparison of the variants and step-by-step setup guides.

✨ CLI 2.6.0​

We've released version 2.6.0 of the nullplatform CLI, bringing new commands and improvements.

What's new in CLI 2.6.0:

• New np upgrade command to check for a newer CLI version and install it in place.
• New np browse command to navigate across nullplatform entities from the terminal.
• HTTP requests to the nullplatform API now include x-np headers.

Install the latest version:

curl https://cli.nullplatform.com/install.sh | sh

👉 See the CLI docs for more info.

That's all for April — from the nullplatform team! ❤️

Security updates​

• Go runtime upgraded from 1.25.7 to 1.25.8.
• go-git upgraded from v5.16.4 to v5.16.5, fixing CVE-2026-25934 (data integrity in .pack and .idx file handling).
• cloudflare-circl upgraded from 1.6.1 to 1.6.3.

Upgrade​

Run a helm upgrade with the new image tag in your values.yaml. See the Helm installation guide.

# Azure or GCP
image:
  repository: public.ecr.aws/nullplatform/controlplane-agent
  pullPolicy: Always
  tag: 0.8.0

# AWS
image:
  repository: public.ecr.aws/nullplatform/controlplane-agent
  pullPolicy: Always
  tag: aws-0.8.0

Highlights​

• New np upgrade command to detect whether a newer version is available and install it. The CLI also checks for new versions in the background and lets you know when one is out.
• New np browse command to navigate nullplatform entities interactively from the terminal. See browsing your organization.
• New --all flag on list commands to fetch every entity at once instead of paging.
• Requests to the nullplatform API now carry x-np headers, improving traceability.

Upgrade​

curl https://cli.nullplatform.com/install.sh | sh

Highlights​

• Scope creation now validates ALB capacity. Requires the AWS permissions elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeListeners, and elasticloadbalancing:DescribeRules.
• Every deployment now validates the ALB's target group capacity. Requires the AWS permission elasticloadbalancing:DescribeTargetGroups.
• Scopes can now balance across multiple ALBs, prioritizing the one with the most idle capacity.
• Scopes support scope configurations, optional cloud settings that developers can adjust per scope from the UI.
• The traffic manager's memory and CPU limits are now configurable.
• ALB metrics publishing to CloudWatch or Datadog: rule count and target group count per ALB.

Fixes​

• Fixed a blue-green switch-traffic failure when additional ports (for example gRPC) are added to a scope after its initial deployment.

Upgrade​

If you pin the scopes version in your agent's values.yaml, update the branch reference:

configuration:
  values:
    GITHUB_REPO: "github.com/nullplatform/scopes.git"
    GITHUB_BRANCH: "1.11.0"

✨ External fields in service specifications​

Service specifications can now include fields whose values are resolved from your infrastructure. When someone opens the form to create or link a service, the nullplatform agent running in your environment fetches the data and injects it into the schema dynamically.

What you can do with it:

• Populate fields with real infrastructure data: Postgres users to assign as database owners, RabbitMQ vhosts to connect producers and consumers, existing S3 buckets, Route 53 hosted zones, or anything else your agent can query.
• No APIs to expose, no credentials to share: the handler script runs inside your agent. Nullplatform only sends the action context and validates the response against a schema you define.

All you need on your side is a handler script in the agent and a dedicated notification channel. Nullplatform takes care of executing, validating, and resolving.

👉 See the External fields docs or the step-by-step tutorial.

✨ SCIM provisioning​

You can now automate user and group provisioning from your identity provider to nullplatform using the SCIM 2.0 protocol (RFC 7644). Instead of managing users manually, your IdP syncs them automatically.

What it enables:

• Automatic user creation, updates, and deactivation when changes happen in your IdP
• Group membership sync for role-based access control
• Real-time consistency between your identity provider and nullplatform

The first supported provider is Azure Entra ID, with a step-by-step guide covering enterprise app setup, attribute mapping, group sync, and troubleshooting.

👉 See the SCIM provisioning docs to get started.

✨ Notification traceability in service actions​

You can now see the notifications triggered by a service action directly from the action's workflow view, without jumping between tabs to correlate what was sent and where.

Each notification shows:

• Delivery status: at-a-glance indicator of whether the notification was delivered, failed, or is still in progress.
• Channel used: the destination the event was routed to (agent, Slack, webhook, etc.).
• Quick links: open the full notification detail or jump straight to the agent logs for debugging.

To access it:

1. Go to Platform settings → Services.
2. Click the (⋮) menu on a service and select Actions.
3. Open the Review view of any action.
4. Expand an execution step to see its notifications.

That's all for March — from the nullplatform team! ❤️

Highlights​

• Commands are now deduplicated, so a command delivered more than once executes only once.
• The Docker image now ships with mise, enabling runtime version management for the tools your workflows run.

Fixes​

• Fixed a formatting issue when logging errors.

Security updates​

• Go runtime upgraded from 1.25.5 to 1.25.7.

Upgrade​

Run a helm upgrade with the new image tag in your values.yaml. See the Helm installation guide.

# Azure or GCP
image:
  repository: public.ecr.aws/nullplatform/controlplane-agent
  pullPolicy: Always
  tag: 0.7.0

# AWS
image:
  repository: public.ecr.aws/nullplatform/controlplane-agent
  pullPolicy: Always
  tag: aws-0.7.0

Highlights​

• np provider specification now supports create, update, and delete, so you can manage provider specifications end to end from the CLI.

Fixes​

• np provider list now handles dimensions correctly.
• np service-action exec now handles action updates correctly.

Security updates​

• Go runtime upgraded from 1.25.5 to 1.25.7.

Upgrade​

curl https://cli.nullplatform.com/install.sh | sh

✨ Platform-wide banners​

You can now broadcast messages to your team directly within the nullplatform UI using banners. Use them to communicate maintenance windows, incidents, outages, or general announcements, targeted to specific sections of the platform.

Key highlights:

• Severity levels: choose from Informational (🔵), Maintenance (🟡), Degraded (🟠), or Outage (🔴) to match the nature of your message.
• Resource targeting: banners use the NRN hierarchy, so a banner on a namespace is visible on all its applications and scopes.
• Draft and publish workflow: save banners as drafts and publish them when ready. Unpublishing hides a banner without deleting it.
• Dismissible banners: users can dismiss banners individually. If an admin updates a dismissed banner, it reappears automatically.

ℹ️ Note: Only users with the Admin role can create, edit, publish, or delete banners.

👉 See the Banners docs for setup details.

That's all for February — from the nullplatform team! ❤️

Upgrade​

Run a helm upgrade with the new image tag in your values.yaml. See the Helm installation guide.

# Azure or GCP
image:
  repository: public.ecr.aws/nullplatform/controlplane-agent
  pullPolicy: Always
  tag: 0.6.0

# AWS
image:
  repository: public.ecr.aws/nullplatform/controlplane-agent
  pullPolicy: Always
  tag: aws-0.6.0

✨ UI and discovery improvements​

This month includes several UI and usability improvements focused on faster discovery, clearer context, and better sorting across key views.

Applications list (grid)​

The Applications grid has been redesigned to make navigation and management easier.

• Quick access links to repository, scopes, and deployments are now available directly on each application card.
• New sorting options, including recently used, help you find relevant applications faster.
• Improved card layout and visual hierarchy for better scanning.

Search and sorting enhancements​

We’ve expanded filtering and sorting capabilities across multiple sections of the platform:

• Namespaces: new sort by name option.
• Releases: sort by name and created date.
• Logs: improved sorting when using date range filters.
• Releases list: search now supports more flexible matching by branch.
• Service actions view: now shows Last activity so you can quickly see recent usage.

✨ OCI and OKE provider support​

You can now configure Oracle Cloud Infrastructure (OCI) and Oracle Kubernetes Engine (OKE) as supported providers in nullplatform. This expands your cloud and container orchestration options, enabling you to run agent workloads and manage clusters on Oracle Cloud.

Where to configure them:

• OCI: Platform settings → Cloud providers
• OKE: Platform settings → Container orchestration

👉 See the Supported providers docs for setup details.

✨ Cross-property validation in JSON Schema ($data)​

Forms generated from JSON Schema now support cross-property validation using AJV’s $data extension.
You can define rules that compare values across fields directly in the schema — for example, requiring one field to be greater than another.

Example: ensure interval is greater than timeout:

{
  "type": "object",
  "properties": {
    "timeout": {
      "type": "number",
      "title": "Timeout (seconds)"
    },
    "interval": {
      "type": "number",
      "title": "Interval (seconds)",
      "exclusiveMinimum": { "$data": "1/timeout" }
    }
  }
}

• "$data": "1/timeout" is a relative JSON Pointer: 1 = parent object, timeout = property.
• The interval value must be strictly greater than timeout.

You can also use $data with keywords such as minimum, maximum, minLength, and maxLength to express cross-field rules.

👉 See the Special JSON schema keys docs for more details.

✨ Bulk create grants for a user​

You can now create multiple grants for a user in a single request, simplifying and speeding up permissions management.

Use the user ID and send a bulk request to the grants endpoint:

curl -L 'https://api.nullplatform.com/user/:id/grant' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <token>' \
-d '[
  {
    "nrn": "organization=1:account=2",
    "role_slug": "developer"
  },
  {
    "nrn": "organization=1:account=3",
    "role_slug": "ops"
  }
]'

👉 See the Grants and permissions docs for more information.

Wishing you a fantastic year ahead – from the nullplatform team! ❤️

Highlights​

• The traffic manager's nginx can now be configured through a configmap, so you can adjust its behavior without rebuilding anything.
• Kubernetes scopes support a NAMESPACE_OVERRIDE configuration, letting you choose the namespace a scope's resources are created in.
• Diagnose gained new checks, improved logging in existing ones, and documentation.

Fixes​

• Deleting cluster objects now keeps only one deployment per scope, avoiding leftovers from previous deployments.
• Actions that are not valid for the scope's current deployment status are no longer executed.

Upgrade​

If you pin the scopes version in your agent's values.yaml, update the branch reference:

configuration:
  values:
    GITHUB_REPO: "github.com/nullplatform/scopes.git"
    GITHUB_BRANCH: "1.10.0"

Fixes​

• HTTP request retries no longer send an empty body.

Security updates​

• Go runtime upgraded to 1.25.5, fixing CVE-2025-61729 (excessive resource consumption in certificate validation) and CVE-2025-61727 (subdomain constraint bypass in certificate chains).

Upgrade​

curl https://cli.nullplatform.com/install.sh | sh