AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release for flagd-proxy resolves open Dependabot security alerts. The sync server also receives a gRPC keepalive enforcement policy update.
Action needed (1)
securityOpen Dependabot security alerts resolved
Open Dependabot security alerts are resolved in flagd-proxy v0.9.8.
This release contains routine correctness fixes and a security fix in the server. The security change concerns users of the SSD CLI.
Action needed (1)
securitySSD CLI secret-mask spoofing prevention
The server prevents secret-mask spoofing in the SSD CLI. This fix ships in Argo CD v3.5.1.
A maintenance release with correctness fixes, a server-side secret-mask spoofing fix, and a third-party dependency update. Ordinary fixes and the dependency update require no operator action, while upgrading addresses the security fix.
Action needed (1)
securitySSD CLI secret-mask spoofing prevention
The server now prevents secret-mask spoofing in the SSD CLI. This fix ships in the 3.4 release line.
A maintenance release with fixes for secret masking and pprof endpoint configuration, alongside dependency updates for two listed CVEs. The secret-handling fixes and dependency updates are addressed by upgrading, while the remaining defect fixes require no operator action.
Action needed (2)
securityhighThe /ui brace-expansion dependency update for CVE-2026-69152
The /ui dependency brace-expansion is updated to 2.1.4 and 1.1.18 for CVE-2026-69152.
securitymediumThe DOMPurify dependency update for CVE-2026-49978
The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.
Check if affected (2)
securitySSD CLI secret mask spoofing prevention
Applies if you use SSD CLI.
securitySecret hiding in the last-applied-configuration annotation
Applies if you configure last-applied-configuration.
This release updates dependencies associated with published security advisories. Builders created with the pack CLI from this release contain lifecycle v0.21.0 by default.
Action needed (3)
securityhighThe github. dependency update
github. updates from v5.19.1 to v5.19.2 in buildpacks v0.40.9. The release note cites GHSA-hc8v-wwc9-vgxm.
securitymediumThe go. dependency update
go. updates from v1.43.0 to v1.44.0 in buildpacks v0.40.9. The release note cites GO-2026-5158 and CVE-2026-41178 for a baggage header that was not length-capped.
securityThe github. dependency update
github. updates from v1.18.6 to v1.18.7 in buildpacks v0.40.9. The release note cites GO-2026-5841 and GHSA-259r-337f-4rfw for an out-of-bounds read in s2.
A maintenance release focused on operator-facing bug fixes, with additional feature and configuration work. It also includes dependency updates, including a UI dependency update for CVE-2026-41240.
Action needed (3)
securitymediumThe redoc/dompurify dependency update for CVE-2026-41240
The UI dependency redoc/dompurify is bumped to v3.4.0 to fix CVE-2026-41240.
securityThe formidable dependency update
The formidable dependency is updated to v2.1.3.
breakingThe auto-sync toggle removal from the app top bar
The auto-sync toggle is removed from the app top bar.
Check if affected (1)
breakingThe theme default changed to auto
Applies if theme is not configured.
A maintenance release with bug fixes and dependency updates. The form-data update in /ui addresses CVE-2026-12143.
Action needed (1)
securityhighThe form-data dependency update for CVE-2026-12143
The form-data dependency is updated to version 4.0.6 in /ui to address CVE-2026-12143.
This release combines ordinary bug fixes with security-related updates. It also improves blob/HTTP synchronization, with no announced operator-facing removals, deprecations, or default changes.
Action needed (2)
securityThe google. module update to v1.82.1
The google. module is updated to v1.82.1 in core v0.16.1.
securityThe vulnerability-updates update
vulnerability-updates is updated in core v0.16.1.
A maintenance release with a bug-fix heading, a new server timeout setting, dependency updates, and security-related updates. The google. update requires upgrading.
Action needed (2)
securityThe google. module, updated to v1.82.1
The google. module is updated to v1.82.1 as a security-related dependency change.
securityThe vulnerability-updates dependency update
The release updates vulnerability-updates as a security-related dependency change.
flagd/v0. combines bug fixes with security dependency updates and a configurable sync-server capability. The security notes do not include advisory identifiers or flaw details, while the sync-server changes include server timeouts and configurable gRPC keepalive enforcement.
Action needed (3)
securitySecurity dependency updates
Security dependencies are updated in flagd/v0..
securityThe google. module update
The google. module is updated to v1. in flagd/v0..
securityVulnerability updates
Vulnerability updates are included in flagd/v0. as a security change.
This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.
Action needed (1)
securityGo 1.25.10 dependency update
Go is updated to 1. for CVE remediation in this release.
Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang. packages, with no specific advisory identifiers or vulnerability details in the note.
Action needed (3)
securityGo 1.25.10 update
Go is updated to 1. for CVE remediation in v1.9.6.
securitygolang. v0.52.0 update
golang. is updated to v0. for CVE remediation in v1.9.6.
securitygolang. v0.55.0 update
golang. is updated to v0. for CVE remediation in v1.9.6.
Release v1.14.0 adds tracing and observability capabilities and broadens ResolutionRequest resolution support. It also includes correctness fixes, a Go security-related update, and shipped dependency updates.
Action needed (1)
securityGo 1. update
Go is updated to 1. in v1.14.0 for CVE remediation.
A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.
Action needed (2)
securityThe infinispan dependency upgrade
infinispan was upgraded from ^0. to ^0. to address known vulnerabilities.
breakingThe unused json-schema runtime dependency, removed
The unused json-schema runtime dependency has been removed.
Check if affected (7)
breakingThe catalog. setting, removed
Applies if you configure catalog..
breakingComboboxProps as a union type
Applies if you use ComboboxProps.
breakingThe default /kubernetes page, removed
Applies if you use /kubernetes.
Plan ahead (9)
deprecatedTop-level Combobox input state props, deprecated
Applies if you use plain-array options.
deprecatedPrevious tokens, deprecatedremoval date not announced
Applicability is not stated in the release notes.
deprecatedThe single-module runCliModule helper, deprecated
Applies if you use runCliModule.
A maintenance release with correctness fixes, a security-relevant dependency update, resolver compatibility constraints, metric behavior changes, and additional dependency upgrades. The changes include a restriction on the object types handled by Tekton Resolvers and an update to gRPC.
Action needed (1)
securitycriticalgoogle. updated to 1.79.3 for CVE-2026-33186
The google. dependency is updated from 1.77.0 to 1.79.3 to fix CVE-2026-33186, an authorization bypass caused by a missing leading slash in the :path header.
Check if affected (1)
breakingTekton Resolvers, limited to supported object types
Applies if you use the Resolver API.
Tekton v1.6.3 contains resolver validation and behavior corrections, along with fixes affecting cross-architecture execution and metrics. It also updates dependencies, including a gRPC change for CVE-2026-33186, so resolver users and dependency-sensitive deployments should review the release.
Action needed (1)
securitycriticalThe google. dependency fix for CVE-2026-33186
The google. dependency includes a fix for CVE-2026-33186 in v1.6.3.
Check if affected (1)
breakingTekton Resolver target restrictions
Applies if your ResolutionRequest objects use Tekton Resolvers.
Argo CD v3.3.11 contains bug fixes and a UI dependency update addressing CVE-2026-41240. The release concerns deployments using the affected UI dependency.
Action needed (1)
securitymediumThe redoc/dompurify dependency, updated to v3.4.0
The /ui dependency redoc/dompurify is updated to v3.4.0 to address CVE-2026-41240.
Flux v2.8.8 is a maintenance release with defect corrections, expanded compatibility, and dependency updates. It also includes two disclosed security fixes in go-git.
Action needed (1)
securitymediumThe go-git security fixes for CVE-2026-45571 and CVE-2026-45570
Flux v2.8.8 includes security fixes in go-git associated with CVE-2026-45571, CVE-2026-45570, GHSA-crhj-59gh-8x96, and GHSA-m7cr-m3pv-hgrp.
A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.
Action needed (2)
securityModule Federation packages at v2.
Module Federation packages were upgraded to v2. to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4. because of a license change.
Check if affected (9)
securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
Plan ahead (4)
deprecatedThe PolicyQueryUser. field, deprecated
Applies if you use PolicyQueryUser..
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
deprecatedThe catalog. setting, deprecated
Applies if you configure catalog..
This release combines bug fixes with dependency and toolchain updates. The Go update to 1. addresses CVEs and concerns deployments using this release.
Action needed (1)
securityThe Go toolchain, updated to 1.
The Go toolchain is updated to 1. on release-3. to resolve CVEs.
Flux v2. includes a security update to the go-git dependency alongside toolkit component updates. The go-git update addresses CVE-2026-45022 and GHSA-389r-gv7p-r3rp.
Action needed (1)
securityhighThe go-git dependency update to v5.
The go-git dependency is updated to v5., which fixes CVE-2026-45022 and addresses GHSA-389r-gv7p-r3rp. This update ships in Flux v2..
A broad maintenance and feature release with correctness, performance, dependency, and operator-facing changes. Operators should review the cluster-version annotation format and changed defaults, while dependency updates include Kubernetes and Helm changes; no explicitly disclosed exploitable vulnerability or security advisory is identified.
Action needed (4)
securityThe k8s. module, updated to v1.
The k8s. module is updated to v1. as a security-related dependency update.
securityThe helm dependency, updated to 3.
The helm dependency is updated to 3. due to a CVE.
breakinggRPC service config DNS TXT lookups, disabled by default
gRPC service config DNS TXT lookups are disabled by default.
breakingThe appset resource status count, defaulted to 5000
The default appset resource status count is changed to 5000.
Check if affected (2)
breakingThe --client flag in the Helm version command, removed
Applies if you use --client.
breakingThe cluster-version annotation format, renamed
Applies if you use Application Sets with Cluster Generators and configure argocd..
OpenFeature core/v0.15.5 is a maintenance release with operator-relevant corrections and a security-related dependency update. The security announcement does not identify a specific advisory in the release text.
Action needed (1)
securityOpen Dependabot security alerts resolved
Open Dependabot security alerts were resolved in the OpenFeature core release.
This release resolves open Dependabot security alerts in the flagd proxy. The release note does not identify which vulnerabilities or dependencies were fixed.
Action needed (1)
securityDependabot security alerts resolved
The flagd-proxy/v0. release resolves open Dependabot security alerts. The release note does not identify the affected dependencies or vulnerabilities.
v3.3.9 is a maintenance release with a disclosed security fix and a go version update to resolve CVEs. It also includes bug fixes in the release.
Action needed (2)
securitycriticalGHSA-3v3m-wc6v-x4x3 security fix
This release fixes the vulnerability identified by GHSA-3v3m-wc6v-x4x3.
securityThe go version update for CVE resolution
The go version is bumped to resolve CVEs in v3.3.9.
Version v3. includes a disclosed security fix and additional correctness and dependency updates. The security fix is the release change that concerns users evaluating whether to upgrade.
Action needed (1)
securitycriticalSecurity fix for GHSA-3v3m-wc6v-x4x3
Version v3. contains a security fix for the vulnerability identified by GHSA-3v3m-wc6v-x4x3.
A substantial feature and maintenance release with API, UI, plugin, authentication-token, catalog, scaffolder, frontend, and SCM changes. It also updates vulnerable glob and rollup dependencies, fixes the . URL, and includes broad correctness and dependency updates.
Action needed (4)
securityhighThe glob and rollup dependencies, upgraded
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe glob dependency, upgraded to v13
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.
securityThe rollup dependency, upgraded to v4.59+
rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe . URL
The . resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.
Check if affected (22)
breakingThe auth. setting
Applies if you do not configure auth..
breakingThe SignInResolverFactoryOptions type parameters
Applies if you use SignInResolverFactoryOptions.
breakingThe catalog permission exports, removed
Applies if you use CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, or catalogPermissionExtensionPoint.
Plan ahead (6)
deprecatedThe show and showModal compatibility implementation, deprecated
Applies if you use show or showModal.
deprecatedThe auth. setting, deprecatedremoval date not announced
Applies if you configure auth..
deprecatedThe config. callback format, deprecated
Applies if you use config..
This release contains two security updates whose affected vulnerabilities are not identified. It also adds experimental incremental updates for gRPC synchronization.
Action needed (1)
securityThe vulnerability-updates security update
OpenFeature Core v0.15.2 includes a security update for vulnerability-updates.
This release contains security updates for flagd-proxy/v0.. The available notes do not identify the affected vulnerabilities or describe their scope.
Action needed (2)
securityThe vulnerability-updates entry for issue #1933
The vulnerability-updates entry records a security update for flagd-proxy/v0., tracked in issue #1933. The notes do not describe the affected vulnerability.
securityThe vulnerability-updates entry for issue #1934
The vulnerability-updates entry records a security update for flagd-proxy/v0., tracked in issue #1934. The notes do not describe the affected vulnerability.
flagd v0.15.2 includes two undisclosed security updates and a new experimental gRPC incremental-update capability. The experimental addition concerns deployments that use gRPC synchronization.
Action needed (2)
securityThe vulnerability-updates security update for issue #1933
flagd v0.15.2 includes the vulnerability-updates security update linked to issue #1933.
securityThe vulnerability-updates security update for issue #1934
flagd v0.15.2 includes the vulnerability-updates security update linked to issue #1934.
Release 0.15.1 fixes a memory leak caused by unbounded metrics cardinality and updates a dependency for an undisclosed security fix. The dependency update ships in the core v0.15.1 release.
Action needed (1)
securityThe github. dependency update
The github. module is updated to v4.1.4 for a security fix. This change ships in core v0.15.1.
This release includes a security update to the github. dependency. The release note does not disclose the nature of the vulnerability.
Action needed (1)
securitygithub. updated to v4.1.4
The github. module is updated to v4.1.4 in flagd-proxy v0.9.3 as a security fix. The note does not disclose the nature of the vulnerability.
This release fixes RPC flag defaulting, metrics-server process handling, and unbounded metrics cardinality. It also updates a dependency for an undisclosed security fix, which is the main consideration for users evaluating the release.
Action needed (1)
securityThe github. dependency, updated to v4.1.4
The github. module is updated to v4.1.4 in flagd/v0. for an undisclosed security fix.
This maintenance release includes a security mitigation for CVE-2026-33186 in grpc-go. It also contains ordinary fixes to application behavior and the user interface.
Action needed (1)
securitycriticalgrpc-go CVE-2026-33186 mitigation
A mitigation for CVE-2026-33186 in grpc-go ships in the release-3. line.
Argo CD v3.1.13 focuses on release artifact provenance and maintenance, with a security mitigation, a UI correction, and a dependency update. Container images are signed, and qualifying container images and CLI binaries receive SLSA Level 3 provenance.
Action needed (1)
securitycriticalgrpc-go CVE-2026-33186 mitigation
The release includes a mitigation for CVE-2026-33186 in grpc-go for release-3.1.
Flux v2.8.2 includes correctness fixes and dependency updates. It also fixes a disclosed TLS-handshake denial-of-service issue in the controller builds.
Action needed (1)
securitymediumCVE-2026-27138 TLS-handshake DoS fix
The TLS-handshake denial-of-service issue identified as CVE-2026-27138 is fixed by building all controllers with Go 1..
A security-focused maintenance release fixes undisclosed issues in two Backstage backend plugins. The affected plugins are @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.
Action needed (1)
securitySecurity fixes in two Backstage backend plugins
Security fixes ship in @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.
This is a maintenance release with security fixes backported from v1.. The fixes affect operators using the v1. release line.
Action needed (1)
securityBackported security fixes from v1.
This release contains backported security fixes from v1..
Argo v3.3.0 is a substantial feature and maintenance release with changes across synchronization, health, hydration, diff and apply behavior, the UI, and resource operations. It also updates core dependencies and removes an app controller flag.
Action needed (3)
securityThe k8s. module, updated to v1.34.2
The k8s. module is updated to v1.34.2 in Argo v3.3.0.
securityHelm 3.19.4
Helm is updated to 3.19.4 in Argo v3.3.0.
securityRedis, updated to the latest stable release
Redis is updated to the latest stable release in Argo v3.3.0.
Check if affected (1)
breakingThe --self-heal-backoff-cooldown-seconds flag, removed
Applies if your app controller configuration uses --self-heal-backoff-cooldown-seconds.
