RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Mar 2026Clear ×
Kubeflow26.03AI & MLMar 22, 2026
ACTION 1CHECK 1OTHER 18View full analysis

This release updates supported Kubernetes and pod-security configurations, installation behavior, and bundled component versions. The main operator-facing changes are the Kubernetes 1.34+ requirement and the baseline pod-security enforcement default, alongside fixes and new capabilities.

Action needed (1)

  • breakingBaseline pod security enforcement

    Pod security enforcement changes to the baseline level in this release.

Check if affected (1)

  • breakingKubernetes 1.34+ requirement

    Applies if you use Kubernetes 1.34+.

Source ↗
KServev0.17.0AI & MLMar 13, 2026
ACTION 13CHECK 6OTHER 91View full analysis

An operator release with expanded configuration and LLMInferenceService capabilities, plus chart and dependency updates, behavior changes, removals, and defect corrections. It also includes security fixes for operators to review.

Action needed (13)

  • securitycriticalh11 malformed-body fix for CVE-2025-43859

    h11 malformed-body handling associated with CVE-2025-43859 is addressed in this release.

  • securityhighstarlette version 0.49.1

    starlette is pinned to version 0.49.1 to fix CVE-2025-62727 in this release.

  • securityhighlightgbm version 4.6.0

    lightgbm is updated to version 4.6.0 for CVE-2024-43598 in this release.

  • securityhighCVE-2025-66418 decompression-chain fix

    The unbounded number of links in the decompression chain associated with CVE-2025-66418 is addressed in this release.

  • securityhighexpr-lang/expr version v1.17.7

    expr-lang/expr is updated to v1.17.7 to fix CVE-2025-68156 in this release.

  • securityhighcryptography fix for CVE-2026-26007

    The cryptography issue associated with CVE-2026-26007 is addressed in this release.

  • securityhighpython-multipart fix for CVE-2026-24486

    The arbitrary file write issue in python-multipart associated with CVE-2026-24486 is addressed in this release.

  • securitymediumFixes for CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181

    This release addresses CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181.

  • securityhttps.go path traversal prevention

    The path traversal issue in https.go is prevented in this release.

  • securitySeveral CVE fixes

    This release addresses several CVEs.

  • securityAIOHTTP HTTP Parser auto_decompress fix

    The AIOHTTP HTTP Parser auto_decompress feature issue involving zip bombs is addressed in this release.

  • securityextractTarFiles path traversal fix

    The path traversal vulnerability in extractTarFiles is addressed in this release.

  • breakingminio replacement with seaweedfs

    minio is replaced with seaweedfs in this release.

Check if affected (6)

  • breakinginferenceservice CRD cert-manager annotation removal

    Applies if you use the inferenceservice CRD.

  • breakingPython 3.9 support removal

    Applies if you run Python 3.9.

  • breakingDeprecated --disable-log-requests flag removal

    Applies if you configure --disable-log-requests.

  • + 3 more on the release page
Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023