A maintenance release fixes concurrency races in route and shared configuration handling. It also corrects Prometheus native histogram bucket indices; no operator configuration changes are stated.
Source ↗
Don't read release notes for 77 CNCF projects.
Alerts only when your stack needs action, and what to do about it.
77 projects · 1078 analyses · this week 27 reviewed → 8 alerts
Latest alert · Oct 6, 2026 – Oct 13, 2026
Last 7 days
Action needed8 projects · 29details →
Harborv2.15.3security14breaking2Path traversal in distribution endpoints 외 15건
Envoyv1.38.7 · v1.37.9 · v1.36.13security3wasmtime update for CVE-2026-54786 외 2건
Argov3.4.10 · v3.5.4security2Coordinated security fixes 외 1건
Check if affected7 projects · 28details →
- Envoyv1.39.3 · v1.38.6 · v1.37.8 · v1.36.12security8GHSA-8vc2-jrm4-835w in the oauth2 filter 외 7건
NATSv2.15.1 · v2.14.8security1breaking6auth_users auth callout bypass issues corrected 외 6건- Harborv2.15.4 · v2.15.3security1breaking3Legacy signer pull behavior 외 3건
Plan ahead1 projects · 1details →
A maintenance release with a disclosed security dependency update and fixes for concurrency and metrics correctness. No operator configuration changes are announced.
Action needed (1)
securitylow
wasmtimeupdate for CVE-2026-54786Wasm support updates the
wasmtimedependency to24.to resolve CVE-2026-54786.0. 10
A maintenance release with a disclosed security dependency update and fixes for concurrency bugs. It contains no announced operator configuration changes.
Action needed (1)
securitylowThe
wasmtimedependency update for CVE-2026-54786The
wasmtimedependency was updated to24.to resolve CVE-2026-54786.0. 10
A security maintenance release updates Wasmtime and fixes several race conditions in AWS request signing, AWS Lambda, local rate limiting, and secret distribution. It introduces no newly enforced configuration or behavioral requirements.
Action needed (1)
securitylowThe
wasmtimedependency update for CVE-2026-54786wasmtimewas updated to24.to resolve CVE-2026-54786.0. 10
A behavior-changing release tightens Kubernetes and CRD requirements, changes feature-gate defaults, and removes Kaniko from Connect image builds. It also adds early-access cluster security and cert-manager integrations, newer Kafka and HTTP Bridge support, service-account token mounts, and dashboard updates; no security fixes are disclosed.
Action needed (4)
breakingThe
Kanikobuild tool, removedKanikois removed, andBuildahis the only tool used for building Connect images.breakingThe
UseConnectBuildWithBuildahfeature gate, enforced by defaultThe
UseConnectBuildWithBuildahfeature gate moves to GA and is enabled by default without an option to disable it.breakingThe
UseBackgroundPodDeletionfeature gate, enabled by defaultThe
UseBackgroundPodDeletionfeature gate moves to beta and is enabled by default. It can still be disabled in the Cluster Operator feature-gates configuration.breaking
Kubernetesversion support, limited to 1.32 and newerFrom Strimzi 1.3.0, only
Kubernetes1.32 and newer are supported.Kubernetes1.30 and 1.31 are no longer supported.
Check if affected (1)
breakingOlder CRD APIs removed
Applies if you use
v1beta2,v1beta1, orv1alpha1for custom resources or CRDs.
Plan ahead (1)
deprecatedPKCS12 certificate generation, deprecatedremoval date not announced
Applies if you use PKCS12 format certificates.
A maintenance release focused on correctness fixes and dependency updates. It includes fixes across guest behavior, storage, migration, hardware handling, and deployment configuration, with no disclosed security changes.
Source ↗
A maintenance release with updated Go and networking dependencies and security advisory pointers. It also corrects encoded-slash handling in basic authorization policy input and the Data API.
Source ↗