CRI-O
v1.35.11Kubernetes CoreNov 3, 2026
A maintenance release focused on CPU cleanup, user-namespace handling, systemd scope cleanup, and dead-shim failures. Release bundle SBOMs now use a new SPDX format, with `bom` v0.8.0 or later required for validation.
Check if affected (1)
breakingRelease bundle SBOM format
Applies if you use
bom.Release bundle SBOMs now use SPDX 3.0.1 JSON-LD and the
.suffix instead of SPDX 2.3 tag-valuespdx. json .files. Validation withspdx bomrequires v0.8.0 or later.
All 5 other recorded changesfixes 4 · value changes 1
fixes (4)
- - Fixed exclusive CPU cleanup when cgroups disappear during container cleanup. (#10470, @bitoku)
- - Fix userns-mode when combined with a Kubelet supporting user namespaces. (#10442, @openshift-cherrypick-robot)
- - When crio.service is restarted while containers are being created, an in-flight conmon process can still be killed and its crio-conmon-*.scope unit can still enter a failed state. That scope is now automatically garbage collected by systemd instead of persisting in
systemctl --failedindefinitely. (#10343, @amritansh1502) - - Fixed CRI-O crash loops and stuck-Terminating pods caused by dead kata shims. (#10424, @openshift-cherrypick-robot)
value changes (1)
- - The release bundle SBOMs are now SPDX 3.0.1 JSON-LD files suffixed with
.instead of SPDX 2.3 tag-valuespdx. json .files. Validating them withspdx bomrequires v0.8.0 or later. (#10395, @saschagrunert)
Add CRI-O to your stack
A weekly email arrives when a release needs action. Like the breaking changes in this release.