RATATOSKRATATOSK
Sign in

KEDA

v2.21.0Orchestration & Management
Sep 23, 2026

ACTION 11CHECK 2PLAN 1OTHER 90

A feature-rich release with new scalers, scaling behavior, metrics, and authentication options. It also includes breaking changes, security fixes, and broad dependency updates, so compatibility and upgrade requirements need review.

Action needed (11)

  • securityThe github.com/google/cel-go module at v0.29.0

    This release updates the github.com/google/cel-go module to v0.29.0.

  • securityThe github.com/google/cel-go module at v0.30.0

    This release updates the github.com/google/cel-go module to v0.30.0.

  • securityThe github.com/klauspost/compress module at v1.18.7

    This release updates the github.com/klauspost/compress module to v1.18.7.

  • securityThe github.com/prometheus/prometheus module at v0.311.3

    This release updates the github.com/prometheus/prometheus module to v0.311.3.

  • securityThe github.com/valyala/fasthttp module at v1.70.0

    This release updates the github.com/valyala/fasthttp module to v1.70.0.

  • securityThe golang.org/x/crypto module at v0.56.0

    This release updates the golang.org/x/crypto module to v0.56.0.

  • securityThe golang.org/x/mod module at v0.40.0

    This release updates the golang.org/x/mod module to v0.40.0.

  • securityThe golang.org/x/net module at v0.56.0

    This release updates the golang.org/x/net module to v0.56.0.

  • securityThe google.golang.org/grpc module at v1.82.1

    This release updates the google.golang.org/grpc module to v1.82.1.

  • securityPrometheus v0.312.0 with CVE fixes

    The Prometheus dependency is updated to v0.312.0 to fix CVEs.

  • breakingThe scaleOnInFlight default

    KEDA 2.21 adds scaleOnInFlight, with a default of true. Queue length now includes unfinished jobs already assigned to an agent.

Check if affected (2)

  • securityExplicit service account token audiences for TriggerAuthentication and ClusterTriggerAuthentication

    Applies if you use TriggerAuthentication or ClusterTriggerAuthentication.

    KEDA now enforces explicit service account token audiences for TriggerAuthentication and ClusterTriggerAuthentication. The change addresses CVE-2026-77524 and GHSA-637c-6jxx-4rwm.

    CVE-2026-77524 / GHSA-637c-6jxx-4rwmmigration guide

  • breakingRemoval of deprecated Temporal scaler settings

    Applies if the Temporal scaler configures buildId, selectAllActive, or selectUnversioned.

    The Temporal scaler no longer accepts the deprecated buildId, selectAllActive, and selectUnversioned settings.

Plan ahead (1)

  • deprecatedThe Liiklus Scaler deprecationremoval date not announced

    Applies if you use the Liiklus Scaler.

    KEDA deprecates the Liiklus Scaler because its upstream project is unmaintained. Removal is planned for a later KEDA release.

All 90 other recorded changesvalue changes 34 · fixes 32 · additions 20 · constraints 4

value changes (34)

  • **General**: migrate datadog, graphite and github_runner, rabbitmq to authentication.Config
  • **General**: stop polling triggers when pollingInterval is not relevant
  • **General**: Share HTTP Transport across HTTP clients to avoid leaking connections
  • **General**: Aggregate KEDA CRD permissions into default roles
  • **General**: move HPA health signal off Ready into a dedicated HPAActive condition
  • **General**: Bump dependencies
  • **Dependencies**: Bump Go dependencies and migrate major versions
  • **Dependencies**: Pin dependencies
  • **Dependencies**: Update AWS SDK×5
  • **Dependencies**: Update Azure SDK
  • **Dependencies**: Update Go Dependencies (non-major)×5
  • **Dependencies**: Update Google Cloud SDK×2
  • **Dependencies**: Update Kubernetes Dependencies to v0.35.7
  • **Dependencies**: Update Prometheus Dependencies
  • **Dependencies**: Update dependency protocolbuffers/protobuf to v35
  • **Dependencies**: Update dependency protocolbuffers/protobuf to v36
  • **Dependencies**: Update dependency protocolbuffers/protobuf to v36.2
  • **Dependencies**: Update dependency strimzi/strimzi-kafka-operator to v1
  • **Dependencies**: Update gcr.io/distroless/static:nonroot Docker digest to …×2
  • **Dependencies**: Update module cloud.google.com/go/storage to v1.65.0
  • **Dependencies**: Update module github.com/Azure/azure-sdk-for-go/sdk/azcore to v1.23.0
  • **Dependencies**: Update module github.com/google/go-github/v91 to v92
  • **bump go to 1.26.5**
  • **chore(deps)**: bump github.com/microsoft/go-mssqldb from 1.9.6 to 1.10.0

fixes (32)

  • **General**: Fix concurrent map iteration and map write in pkg/fallback
  • **General**: Fix nil pointer dereference in customScalingStrategy when customScalingQueueLengthDeduction is omitted
  • **General**: Guard against negative metric returned in scaler.go
  • **General**: Fix panic in the HashiCorp Vault token renewal
  • **General**: Ignore StreamMetricSpec updates that carry no metric specs
  • **General**: Keep cached metric records of healthy triggers on scaler errors
  • **General**: Make cache deletion synchronous to fix concurrency bug in CachedMetrics
  • **General**: fix context handling for scalers and auth refreshes
  • **General**: Restore gRPC reconnect backoff
  • **General**: Guard GetCurrentReplicas against nil ScaleTargetGVKR
  • **General**: use field indexes in verifyScaledObjects to avoid O(N) admission cost
  • **General**: Fix concurrent map writes panic in the shared root CA CertPool
  • **General**: correct pollingInterval and cooldownPeriod relevance check for idleReplicaCount
  • **General**: Emit ScaledJob removal event with the ScaledJob's namespace
  • **General**: Fix nil ptr dereference on uninitialized Deployment spec replicas
  • **General**: scaler scheme: recurse on nested pointers and propagate 'optional'
  • **General**: Fix stale scalercache
  • **CouchDB Scaler**: Close the query result iterator instead of leaking the response body
  • **Dynatrace Scaler**: Handle all documented DQL query states in execute and poll paths
  • **External Scaler**: release pooled gRPC connections when the last scaler closes
  • **External Push Scaler**: Activation send blocking on stream cancellation
  • **Github Scaler**: key per-run job cache by (repo, runID)
  • **Kafka Scaler**: Exclude retention-deleted messages from lag for uncommitted offsets
  • **Metrics Service**: Rebuild CA cert pool on rotation to prevent data race and monotonic growth
  • **RabbitMQ scaler**: fix empty queue handling during fast drain
  • **Solr Scaler**: fail on non-200 instead of reporting an empty queue
  • **Splunk Observability Scaler**: Close SignalFlow client on teardown
  • **Azure Blob Scaler**: strip leading slash from globPattern before matching
  • **Mongo Scaler**: Disconnect client when initial Ping fails to avoid leaking connections
  • **Kafka Scaler**: Metadata scoping
  • **Azure EventHub Scaler**: Avoid passing EventHubName when connection string contains EntityPath
  • **AWS Secret Manager**: Guard nil credentials in handler

additions (20)

  • **General**: controller sharding by label selectors
  • **General**: Add new GCP Cloud Spanner Scaler
  • **General**: Support StreamMetricSpec RPC in external scaler proto for dynamic HPA target updates
  • **General**: Add new Clickhouse Scaler
  • **ActiveMQ Scaler**: Allow managementEndpoint to be set via TriggerAuthentication
  • **Azure Cosmos DB**: Introduce new Azure Cosmos DB Change Feed Scaler
  • **Azure Monitor Scaler**: Add optional metricInterval mapping to the Azure Monitor interval parameter
  • **Kafka Scaler**: support GSSAPI authentication with a Kerberos credential cache
  • **Metrics**: Add external scaler gRPC client metrics
  • **Prometheus Scaler**: Add support for OAuth2 client credentials authentication
  • **Selenium Grid Scaler**: add includeOngoingSessions trigger param
  • **Splunk Observability Scaler**: Add sum, count, latest aggregators
  • **Sumologic Scaler**: add support ignoreNullValues
  • **Temporal Scaler**: add composite metric (backlog + running workflow count)
  • **Temporal Scaler**: add enableTLS parameter to control TLS with API key auth
  • **General**: Add flag to enable high-cardinality HTTP duration labels
  • **Azure Pipelines Scaler**: add service principal authentication via reusable Azure provider
  • **MSSQL Scaler**: Add driverName to select the azuresql driver
  • **General**: Timeout for Kubernetes API operations in scaling loops
  • **General**: Include missing package in k8s group

constraints (4)

  • **General**: Accept pod-level cpu/memory requests in ScaledObject validation
  • **General**: add "default" to ScaledJob scalingStrategy.strategy CRD enum
  • **General**: Grant events permission on both core and events.k8s.io groups
  • **Metrics API Scaler**: reject auth modes the scaler does not implement
Add KEDA to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All KEDA releases →