Google Release Notes

Campaign data import validation report

We’ve launched a new validation report to help you verify and improve the quality of your campaign data imports.

The campaign data import validation report assists you in assessing your non-Google campaign data and imported campaign data. This helps you pinpoint campaigns that lack useful campaign performance data, like cost, clicks, and impressions, and enables you to review previously imported campaign data.

Learn more about the Campaign data import validation report

Provide more clear, contextual feedback with timestamped comments in Google Drive videos

We are introducing timestamped comments for videos in Google Drive on the web. Users can now anchor comments to a specific time mark in a video, making video collaboration more direct, precise, and contextual. | Learn more.

Visual screenshots now included in Google Meet meeting notes

We’re improving the ‘Take notes for me’ feature in Google Meet by giving you the ability to automatically capture and include screenshots of presented content directly in the meeting notes document. | Learn more.

Gemini in Google Classroom is expanding to users of all ages, with contextualized Gemini starter prompts for students

Last year, we launched Gemini in Google Classroom to help educators save time on planning and create more engaging lessons, and later expanded Gemini in Classroom to higher education students 18 years of age and older to help them study and learn. Starting August 10, 2026, Gemini in Classroom will also be made available to K-12 and higher education students of all ages who have already been granted access to Gemini in Classroom, Gemini and Gemini Notebook by their admin, offering a guided space to interact with these tools. | Learn more.

Streamlining rubric generation in Google Classroom with Gemini

To make it easier to create rubrics and grade in Google Classroom, educators can now instantly generate a new Classroom-ready rubric during their assignment creation workflow, using context from their assignment. | Learn more.

Automatically add sources to your Gemini Notebooks in Workspace Studio

Historically, keeping Gemini Notebooks up to date would require you to manually add sources one by one. Now, this new integration lets you automate adding sources to your Gemini Notebooks as part of a recurring workflow. You can use the new Add a source to Gemini Notebook step to add text, links to Drive files, or generic Youtube or web URLs as sources to your notebooks to ensure your notebooks are always up to date on the latest content. | Learn more.

The announcements above were published on the Workspace Updates blog over the last week. Please refer to the original blog posts for complete details.

Gemini Omni makes creating videos as easy as having a conversation. Here are some of the coolest things people and companies are building with it.

At this year’s I/O, we introduced Gemini Omni Flash, our first model in the new Omni family. Omni makes creating and editing videos as easy as having a conversation. You can generate high-quality videos from text, image, video, or audio references, and even edit your own videos. And since Omni combines an intuitive understanding of physics with Gemini’s real-world knowledge, it creates more realistic outputs.

We recently gave developers access to Omni, and builders have already used it for a range of projects. Here are some of the demos that caught our eye.

Switch angles and perspectives.

Omni makes editing videos incredibly easy. You can change camera angles, switch environments, and apply cinematic zooms — all without losing the thread of your original scene.

Builder Leon Lin (@LexnLin on X) took full advantage of this capability, capturing a woman standing in the middle of a city from about 20 different perspectives. You see her from every angle imaginable: up close and far away, head on and in profile, from above, and from below. Some shots zoom in, while others hold still. And the background shifts: She stands on sidewalks, crosswalks, and city streets, surrounded by pedestrians, cars, trams, and a range of different buildings.

Transform the world around you.

Omni lets you change what’s happening in a video and create something you never could have filmed yourself. You can edit the action or swap in different objects, and Omni will still maintain a coherent, cohesive scene.

Take this video from builder Carlos Santana (@DotCSV on X), for example. He changes an outdoor scene using only his voice, switching the lighting from day to night, adding cloudy skies and rainy sounds, turning the leaves orange, and covering the ground in snow.

Animate everyday objects.

With Omni in Google Flow, you can turn sketches into realistic videos, using doodles to guide how individual elements move. And you can decide whether these hand-drawn elements become part of your final product.

Builder Pan (@sebatheepan on X), for instance, uses doodles to playfully transform everyday objects. A lemon becomes a submarine bobbing in the ocean. A cup of espresso is now a hot air balloon transporting someone through the sky. A pair of hot peppers form a sleeping dragon that breathes fire when startled. A match is recast as a rocket ship. And scissors turn into a scary shark looking for a snack.

Play with different styles or visual effects.

Curious what your video would look like with a completely different aesthetic? With Omni, you can change styles and apply effects to create something that matches your vision. Define the look you want by inputting references, or just describe what you’re looking for in natural language. Omni blends that together to create a cohesive clip.

Builder Jerrod Lew (@jerrod_lew on X) put this to the test with Omni in Google Flow, rendering a video of a woman walking down the street in four different animation styles. The original clip fluidly shifts from live-action to anime to claymation and more, never interrupting the woman’s natural forward progression.

Bring ideas to life.

The team at Hyperagent (@hyperagentapp on X) used Omni to visualize three different concepts with video. They layered landscaping into a video of an empty park to create a before-and-after design proposal. They personified data with an animated professor who explains business dashboards. And they gamified a to-do list with a video showing a character clearing tasks.

Omni blends knowledge with creativity, letting you create scenes that follow real-world logic. Try it in the Gemini app, Google Flow, Google AI Studio, the Gemini API, or the Gemini Enterprise Agent Platform.

Feature

Gemini Enterprise: Custom MCP server data stores

You can connect your custom Model Context Protocol (MCP) server with Gemini Enterprise to securely access your company's private data, custom internal tools, and MCP-compliant third-party systems.

This feature is turned off by default. To enable it, an Organization Policy Administrator must remove the organization constraint. This feature is generally available (GA).

For more information, see:

• Set up your custom MCP server
• Override the organization policy for Custom MCP data stores

What's Changed

Features & Refactors:

Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#2935).

New extractors and ecosystem support via osv-scalibr:

Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.

Extend ecosystem mapping for:

• SUSE
• Azure Linux / Mariner
• Alpaquita
• Mageia
• openSUSE Leap
• Debian and Ubuntu PURL

PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:

Bug #2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.

Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #2940, #2931)

Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

New Contributors

@Korulag made their first contribution in #2915

Full Changelog: v2.4.0...v2.5.0

Features & Refactors:

• Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#2935).
• New extractors and ecosystem support via osv-scalibr:
  • Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
  • Extend ecosystem mapping for:
    • SUSE
    • Azure Linux / Mariner
    • Alpaquita
    • Mageia
    • openSUSE Leap
    • Debian and Ubuntu PURL
• PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:

• Bug #2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.
• Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #2940, #2931)
• Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

Features

• Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0).
• Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default.
• Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems.
• Feature #2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans.
• Feature #2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation.
• Feature #2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings.
• Feature #2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin.

Fixes

• Bug #2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files.
• Bug #2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs.
• Bug #2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag.
• Bug #2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead.
• Bug #2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges.
• Bug #2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested.

Misc

• Update Go version to 1.26.4.
• Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
• Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#2857).

Fixes:

• Fix installation issues with go install due to dependency conflicts (downgrade containerd/cgroups/v3, moby/buildkit and opencontainers/runtime-spec).
• Bug #2762 Skip packages with short commit hashes instead of aborting scan.
• Bug #2781 Secure file path handling with os.OpenRoot.
• Bug #2766 Correct typos across docs, configs, and Go source.

Misc:

• Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.
• Remove replace directive (#2782).
• Update contributing.md (#2779).

Features

• Feature #2658 Support regex matching for package name overrides.
• Feature #2510 Scan Homebrew inventory using git repository metadata.

Fixes

• Bug #2750 Sanitize \r/\n in default/table/vertical output to prevent GitHub Actions workflow command injection.
• Bug #2641 Correctly output packages from osv-scanner.json source in spdx format.
• Bug #2729 Increase color contrast of vulnerability stats.
• Bug #2664 Remove second newline at end of vertical output.
• Bug #2669 Sanitize \r in gh-annotations to prevent GitHub Actions workflow command injection.

Misc

• Update osv-scalibr to v0.4.6-0.20260428235529-7791e288d6c1.
• Update Go version to 1.26.2 (#2706).

Features

• Feature #2458 Add --exclude flag to skip paths during scanning.
• Feature #2477 Add pylock extractor.
• Feature #2475 Add base image info to container scanning output header (in table, markdown and vertical formats).

Misc

• Update Go version to 1.25.7.
• Update osv-scalibr from v0.4.1 to v0.4.2. Release note.
• Refactor to better align with osv-scalibr plugins and inventory data structure.