AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with dependency and toolchain updates, several defect corrections, and a new repository timeout flag. The pkg/registry login option for passing TLS configuration in memory has been removed.
Action needed (1)
breakingThe pkg/registry in-memory TLS configuration login option, removed
The pkg/registry login option for passing TLS configuration in memory is reverted and does not ship in this release.
A security-focused maintenance release addresses disclosed Go vulnerabilities and improves proxy connection-pool performance. It also adds the forward plugin's max_idle_conns parameter, which defaults to 0 for an unbounded pool.
Action needed (1)
securityhighCVE-2025-68119 fix
The release also addresses CVE-2025-68119, which affects the stated Go versions.
Check if affected (1)
securitycriticalGo security vulnerability fixes
Applicability is not stated in the release notes.
A maintenance release with a new regex length constraint, correctness fixes, and plugin capability and behavior changes. It does not disclose a security advisory or explicitly exploitable vulnerability.
Action needed (1)
breakingThe core regex length limit
core adds a length limit for regular expressions.
