Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

May 2026Clear ×

containerdv2.2.4Kubernetes CoreMay 20, 2026

ACTION 2OTHER 8View full analysis

A maintenance release with security updates, including a dependency update tied to an advisory. It also includes compatibility and runtime changes across storage, policy, sandbox, validation, and toolchain areas.

Action needed (2)

securityhighCVE-2026-46680 security update
The release records CVE-2026-46680, also identified as GHSA-fqw6-gf59-qr4w, as a security update in containerd.
securityhighgo-jose/go-jose updated to v4.1.4
The go-jose/go-jose dependency was updated to v4.1.4 to fix GHSA-78h2-9frx-2jm8, also identified as CVE-2026-34986.

Source ↗

containerdv2.0.9Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1OTHER 7View full analysis

A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.

Action needed (1)

securityhighThe CVE-2026-46680 security fix
A security fix for CVE-2026-46680, also identified as GHSA-fqw6-gf59-qr4w, ships in this release.

Check if affected (1)

breakingThe default seccomp socket policy
Applies if you use seccomp.

Source ↗

containerdv1.7.32Kubernetes CoreMay 20, 2026

ACTION 1OTHER 5View full analysis

containerd v1.7.32 includes a disclosed security advisory alongside correctness and compatibility fixes. The release concerns users assessing security exposure or changes in runtime and configuration behavior.

Action needed (1)

securityhighCVE-2026-46680 security fix
containerd v1.7.32 includes a fix associated with CVE-2026-46680 and GHSA-fqw6-gf59-qr4w.

Source ↗

containerdv2.3.1Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

securityhighCVE-2026-46680 correction
The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

breakingThe overlayfs "rebase" capability, disabled in user namespaces
Applies if you use overlayfs and run in a user namespace.

Plan ahead (1)

deprecatedTask fields in Runc options, deprecated
Applies if you configure task fields in Runc options.

Source ↗

Helmv3.21.0Kubernetes CoreMay 14, 2026

ACTION 1OTHER 10View full analysis

Helm v3.21.0 is a maintenance release with dependency updates and fixes to chart and OCI handling. It also includes a security fix in the opentelemetry packages.

Action needed (1)

securityThe opentelemetry packages, upgraded for CVE patches
Helm v3.21.0 upgrades the opentelemetry packages to patch CVEs.

Source ↗

Helmv4.2.0Kubernetes CoreMay 14, 2026

ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394
Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

securityPlugin version path traversal fix
Applies if you use the Plugin extension.

Plan ahead (1)

deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated
Applies if you use --hide-notes or --render-subchart-notes.

Source ↗

CRI-Ov1.36.0Kubernetes CoreMay 5, 2026

ACTION 1OTHER 20View full analysis

CRI-O v1.36.0 is a substantive operator-facing feature and maintenance release with runtime and operational changes. It also includes a security update to spdystream and a broad dependency refresh.

Action needed (1)

securityhighThe spdystream dependency update for CVE-2026-35469
CRI-O v1.36.0 updates the spdystream dependency to fix CVE-2026-35469.

Source ↗

CRI-Ov1.35.3Kubernetes CoreMay 5, 2026

ACTION 2OTHER 4View full analysis

A maintenance release that adds a runtime metric and a GOMAXPROCS configuration field, fixes two runtime defects, and reverts CNI monitoring after node bootstrapping regressions. It also updates the spdystream dependency to address CVE-2026-35469.

Action needed (2)

securityhighThe spdystream dependency update for CVE-2026-35469
The spdystream dependency is updated to address CVE-2026-35469. The update ships in this release.
breakingCRI-O CNI monitoring, reverted
CRI-O reverts CNI monitoring because it caused node bootstrapping regressions. The change ships in this release.

Source ↗

CRI-Ov1.34.8Kubernetes CoreMay 5, 2026

ACTION 1OTHER 2View full analysis

CRI-O v1.34.8 includes a security-relevant dependency update and adds operator-facing observability and configuration capabilities. The dependency update is the release change that requires upgrading, while the other additions concern optional setup or informational use.

Action needed (1)

securityhighCVE-2026-35469 fix in the spdystream dependency
CRI-O v1.34.8 updates the spdystream dependency to fix CVE-2026-35469.

Source ↗

CRI-Ov1.33.12Kubernetes CoreMay 5, 2026

ACTION 1OTHER 1View full analysis

CRI-O v1.33.12 includes a security fix for a disclosed vulnerability in the spdystream dependency. It also adds the min_injected_gomaxprocs configuration field for controlling the floor of injected GOMAXPROCS values.

Action needed (1)

securityhighCVE-2026-35469 fix in the spdystream dependency
CVE-2026-35469 is fixed by updating the spdystream dependency in CRI-O v1.33.12.

Source ↗

etcdv3.6.11Kubernetes CoreMay 1, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a correctness fix, an RBAC authorization bypass fix, and a security-related dependency update for GO-2026-4962. It also records Go 1.25.9 as the toolchain used to build the binaries.

Action needed (1)

securitymediumgolang.org/x/image update for GO-2026-4962
The release updates golang.org/x/image to v0.39.0 to resolve GO-2026-4962.

Check if affected (1)

securityRBAC authorization bypass in nested Put requests
Applies if you use RBAC.

Source ↗

etcdv3.5.30Kubernetes CoreMay 1, 2026

ACTION 1OTHER 2View full analysis

A maintenance release with a security fix for an RBAC authorization bypass in transaction handling. It also includes an ordinary correctness fix and a Go toolchain dependency update.

Action needed (1)

securityRBAC authorization bypass in nested etcd transactions
The release fixes an RBAC authorization bypass that allowed read access through PrevKv or lease attachment in Put requests nested in etcd transactions. The fix ships in this release.

Source ↗

Browse by month