RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Strimzi1.2.0Networking & MessagingAug 20, 2026
ACTION 2CHECK 3OTHER 7View full analysis

This release removes legacy CRD API versions and resource state metrics, and changes defaults for token mounting, feature gates, and container security contexts. It also adds Kafka and configuration capabilities and updates shipped dependencies.

Action needed (2)

  • breakingService Account token mounting

    Service Account tokens are no longer auto-mounted into Pods. They are mounted through a volume instead.

  • breakingThe ServerSideApplyPhase1 feature gate, permanently enabled

    The ServerSideApplyPhase1 feature gate has moved to GA and is permanently enabled. It can no longer be disabled.

Check if affected (3)

  • breakingLegacy CRD API versions, no longer supported

    Applies before upgrading to Strimzi 1.0.0 or later if you use the v1beta2, v1beta1, or v1alpha1 APIs.

  • breakingResource state metrics, removed

    Applicability is not stated in the release notes.

  • breakingDefault securityContext for operator installations

    Applies if you use the Cluster, Topic, and User Operator YAML installation files or the Cluster Operator Helm Chart.

Source ↗
NATSv2.12.14Networking & MessagingJul 30, 2026
ACTION 1CHECK 2OTHER 33View full analysis

A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.

Action needed (1)

  • breakingThe disk concurrency semaphore, increased to 4096 slots

    The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.

Check if affected (2)

  • securityAuthentication checks with no_auth_user and auth callouts

    Applies if you configure no_auth_user and use auth callouts.

  • securityTLS verify_and_map authentication with blank passwords

    Applies if you use TLS and configure verify_and_map.

Source ↗
Ciliumv1.20.0Networking & MessagingJul 29, 2026
ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

  • securitygoogle.golang.org/grpc v1.79.3

    The google.golang.org/grpc module is updated to v1.79.3 in the main branch.

  • securitygoogle.golang.org/grpc v1.82.1

    The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.

  • securityhelm.sh/helm/v4 v4.1.4

    The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.

  • securitygithub.com/cloudflare/circl v1.6.3

    The github.com/cloudflare/circl module is updated to v1.6.3.

  • securitygithub.com/go-jose/go-jose/v4 v4.1.4

    The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.

  • securitygithub.com/moby/spdystream v0.5.1

    The github.com/moby/spdystream module is updated to v0.5.1.

  • breakingcni.customConf CNI configuration version

    The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.

  • breakingCilium operator IPAM metrics removal

    The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.

  • breakingDefault CNI configuration version

    The default CNI configuration version changes from 0.3.1 to 1.0.0.

  • breakingNative histogram default

    Native histograms are emitted for all histograms by default.

  • breakingAgent bootstrap metrics removal

    Agent bootstrap metrics are removed.

Check if affected (28)

  • securitytbid traffic host namespace handling

    Applies if you use tbid traffic.

  • breakingDocker libnetwork plugin removal

    Applies if you use the Docker libnetwork plugin.

  • breakingces-slice-mode removal

    Applies if you configure ces-slice-mode.

  • + 25 more on the release page

Plan ahead (6)

  • deprecatedBeta Mutual Auth deprecationremoval date not announced

    Applies if you use Mutual Auth.

  • deprecatedDeprecated address and interface CIDR fields

    Applies if you configure addresses[].subnet or interfaces[].cidr.

  • deprecatedLocal REST BGP API deprecationremoval date not announced

    Applies if you use the local REST BGP APIs.

  • + 3 more on the release page
Source ↗
Linkerdedge-26.7.1Networking & MessagingJul 21, 2026
ACTION 1CHECK 1OTHER 58View full analysis

This release tightens Gateway API and service-port handling and corrects tracing identity construction. It also updates dependencies and shipped components, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

  • breakingUndefined service port requests disallowed

    The destination component now disallows requests to service ports that are not defined.

Check if affected (1)

  • breakingGateway API checks during Helm installation

    Applies when you use Helm.

Source ↗
Istio1.30.2Networking & MessagingJun 24, 2026
ACTION 12CHECK 5OTHER 7View full analysis

A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.

Action needed (12)

  • securityhighCVE-2026-47220 crash bug fix

    The Envoy security update fixes the crash bug described by CVE-2026-47220.

  • securityhighCVE-2026-48044 memory exhaustion fix

    The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.

  • securityhighCVE-2026-48042 JSON nesting-depth limit

    The Envoy security update limits JSON nesting depth to 1000 through envoy.reloadable_features.limit_json_parser_nesting_depth.

  • securitymediumCVE-2026-47692 bug fix

    The Envoy security update fixes the bug described by CVE-2026-47692.

  • securitymediumCVE-2026-47205 use-after-free crash fix

    The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.

  • securitymediumCVE-2026-48090 asynchronous token callback handling

    The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.

  • securitymediumCVE-2026-47778 Subject Alternative Name validation

    The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).

  • securitymediumCVE-2026-47204 crash and use-after-free fix

    The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.

  • securitymediumCVE-2026-48497 query name length checking

    The Envoy security update fixes sanity checking of the query name length.

  • securitymediumCVE-2026-47775 padding oracle

    The Envoy security update addresses a padding oracle described by CVE-2026-47775.

  • securityGHSA-p7c7-7c47-pwch denial-of-service fix

    The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.

  • breakingWarn-level message logging

    The message is now logged at warn level.

Check if affected (5)

Source ↗
Istio1.30.0Networking & MessagingMay 18, 2026
ACTION 1CHECK 1OTHER 33View full analysis

A feature release adds Gateway API, ambient-mode, telemetry, Helm, and operability capabilities. Authenticated XDS debug endpoints and the new default image registry are the changes most likely to affect deployment and operational configuration.

Action needed (1)

  • breakingDefault Istio image registry

    The default registry for Istio images is now registry.istio.io.

Check if affected (1)

  • breakingAuthentication required for XDS debug endpoints

    Applies if ENABLE_DEBUG_ENDPOINT_AUTH is set.

Source ↗
Linkerdedge-26.5.2Networking & MessagingMay 15, 2026
ACTION 2OTHER 32View full analysis

A release that changes the default sidecar mode and promotes native sidecars to GA. It also fixes correctness issues, adds configurable timestamp handling, addresses eleven disclosed CVEs, and updates numerous dependencies.

Action needed (2)

Source ↗
Ciliumv1.19.4Networking & MessagingMay 13, 2026
ACTION 2CHECK 1OTHER 46View full analysis

A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github.com/moby/spdystream dependency.

Action needed (2)

  • securityThe github.com/moby/spdystream module update

    The github.com/moby/spdystream module is updated to v0.5.1.

  • breakingService-label filtering for EndpointSlice watches

    The loadbalancer/reflectors component filters EndpointSlice watches by service labels.

Check if affected (1)

  • breakingLabel filtering for EndpointSlices

    Applies if you set --k8s-service-proxy-name.

Source ↗
Strimzi1.0.0Networking & MessagingApr 28, 2026
ACTION 2CHECK 4OTHER 12View full analysis

A release that removes older CRD API versions, changes defaults and configuration locations, and adds Kafka and HTTP Bridge capabilities. Monitoring configurations and standalone Topic Operator setups may require updates.

Action needed (2)

  • breakingThe UseConnectBuildWithBuildah feature gate, enabled by default

    The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default.

  • breakingThe /metrics endpoint, moved to the HTTP management interface

    The /metrics endpoint is no longer available on the regular HTTP interface, which uses port 8080 by default. It is now available on the HTTP management interface on port 8081.

Check if affected (4)

  • breakingOlder CRD API versions, removed

    Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.

  • breakingThe Open Policy Agent (OPA) authorizer plugin, no longer bundled

    Applies if you use the Open Policy Agent (OPA) authorizer plugin.

  • breakingLegacy TLS environment variables, ignored

    Applies if you set any of STRIMZI_TLS_ENABLED, STRIMZI_TLS_AUTH_ENABLED, STRIMZI_PUBLIC_CA, STRIMZI_TRUSTSTORE_LOCATION, STRIMZI_TRUSTSTORE_PASSWORD, STRIMZI_KEYSTORE_LOCATION, or STRIMZI_KEYSTORE_PASSWORD.

  • + 1 more on the release page
Source ↗
Istio1.29.2Networking & MessagingApr 13, 2026
ACTION 1OTHER 15View full analysis

A maintenance release adds Helm v4 server-side apply support and includes numerous correctness fixes. The WASM decompression size-limit change affects inputs that were previously accepted and may require operator review.

Action needed (1)

  • breakingThe gzip decompression size limit for WASM binaries

    A size limit is now enforced on gzip-decompressed WASM binaries fetched over HTTP.

Source ↗
NATSv2.12.6Networking & MessagingMar 24, 2026
ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

  • breakingJWT size limit

    JWTs now have a 1MB size limit.

Check if affected (13)

  • securityhighMQTT security fixes

    Applies if you use MQTT.

  • securityhighLeafnode security fix

    Applies if you use leafnodes.

  • securityhighCommand-line credential security fix

    Applies if you provide credentials on the command line.

  • + 10 more on the release page
Source ↗
NATSv2.11.15Networking & MessagingMar 24, 2026
ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

  • breakingThe JWT size limit

    JWTs now have a 1MB size limit.

Check if affected (11)

Source ↗
Strimzi0.51.0Networking & MessagingMar 6, 2026
ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

  • securityhighCVE-2026-27133 and CVE-2026-27134 security fixes

    Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.

  • breakingThe ServerSideApplyPhase1 feature gate default

    The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

  • breakingKubernetes version support

    Applies if you use Kubernetes 1.27, 1.28, or 1.29.

  • breakingKafka 4.0.0 and 4.0.1 support

    Applies if you use Kafka 4.0.0 or 4.0.1.

Plan ahead (1)

  • deprecatedThe ingress listener type deprecation

    Applies if you configure the ingress listener type.

Source ↗
Istio1.29.0Networking & MessagingFeb 16, 2026
ACTION 1CHECK 4OTHER 18View full analysis

This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.

Action needed (1)

  • breakingAutomatic GOMEMLIMIT setting for istiod

    istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

  • breakingDefault iptables reconciliation

    Applies when the istio-cni DaemonSet is upgraded.

  • breakingDefault debug endpoint authorization

    Applies to debug endpoints on port 15014.

  • breakingDefault HTTP compression for Envoy metrics

    Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.

  • + 1 more on the release page
Source ↗
Ciliumv1.18.7Networking & MessagingFeb 13, 2026
ACTION 1OTHER 27View full analysis

A maintenance release combining an operator-facing configuration adjustment with bug fixes and routine dependency and image refreshes. No security advisories or security-specific fixes are disclosed.

Action needed (1)

  • breakingExclusion of topology.kubernetes.io labels from security labels by default

    The default security-label handling in this release excludes topology.kubernetes.io labels from security labels.

Source ↗
Ciliumv1.19.0Networking & MessagingFeb 4, 2026
ACTION 15CHECK 30PLAN 7OTHER 436View full analysis

A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.

Action needed (15)

  • securityThe github.com/containerd/containerd dependency, updated

    The github.com/containerd/containerd module is updated to v1.7.29.

  • securityThe github.com/go-viper/mapstructure/v2 dependency, updated

    The github.com/go-viper/mapstructure/v2 module is updated to v2.4.0.

  • securityThe github.com/docker/docker dependency, updated

    The github.com/docker/docker module is updated to v28.3.3+incompatible.

  • securityThe golang.org/x/crypto dependency, updated

    The golang.org/x/crypto module is updated to v0.45.0.

  • securityThe helm.sh/helm/v3 dependency, updated to v3.18.4

    The helm.sh/helm/v3 module is updated to v3.18.4.

  • securityThe helm.sh/helm/v3 dependency, updated to v3.18.5

    The helm.sh/helm/v3 module is updated to v3.18.5.

  • breakingThe plpmtud default, set to blackhole

    The default plpmtud mode is now blackhole (blackhole-detected).

  • breakingThe AddressScopeMax default, set to 254

    The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.

  • breakingThe tls authMode default, set to migration

    tls authMode is set to migration by default.

  • breakingThe CNI deletion timeout, reduced to 1.5 seconds

    The CNI deletion timeout is reduced to 1.5 seconds.

  • breakingThe policy-default-local-cluster default

    policy-default-local-cluster is now set by default.

  • breakingHost firewall bypass, disabled by default

    Host firewall bypass is disabled by default.

  • breakingFQDN match pattern sanitization

    FQDN match pattern sanitization is refactored and tightened.

  • breakingEncrypted traffic forwarding via cilium_host, removed

    Forwarding encrypted traffic via cilium_host has been removed.

  • breakingCNI configuration in the container image, removed

    The CNI configuration is no longer installed in the container image.

Check if affected (30)

  • breakingLocal-cluster default for network policy selectors

    Applies if you do not set cluster in network policy selectors.

  • breakingThe CiliumBGPPeeringPolicy v1 API, removed

    Applies if you use CiliumBGPPeeringPolicy.

  • breakingMutual Authentication, disabled by default

    Applies if you enable Mutual Authentication.

  • + 27 more on the release page

Plan ahead (7)

  • deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced

    Applies if you use --enable-ipsec-encrypted-overlay.

  • deprecatedKafka match fields and ToRequires and FromRequires, deprecated

    Applies if you use ToRequires or FromRequires.

  • deprecatedTLS certificate and key Helm values, deprecated

    Applies if you pass TLS certificates or keys in Helm values.

  • + 4 more on the release page
Source ↗
Ciliumv1.18.6Networking & MessagingJan 13, 2026
ACTION 1OTHER 21View full analysis

A maintenance release with fixes for networking, policy, proxy, gateway API, and endpoint handling, plus dependency, image, and OCI publishing updates. The Cilium Preflight check no longer includes Envoy Configmaps.

Action needed (1)

  • breakingCilium Preflight check no longer includes Envoy Configmaps

    The Cilium Preflight check no longer includes Envoy Configmaps. This change ships in v1.18.6.

Source ↗
Envoyv1.37.0Networking & MessagingJan 13, 2026
ACTION 1CHECK 2PLAN 1OTHER 30View full analysis

This release adds dynamic-module, filter, routing, observability, and certificate capabilities, along with fixes and performance improvements across HTTP, networking, and protocol handling. It also changes HTTP reset behavior, removes runtime guards and legacy code paths, and deprecates the OpenTelemetry access log common_config field.

Action needed (1)

  • breakingRuntime guards and legacy code paths removed

    Multiple runtime guards and legacy code paths are removed in this release.

Check if affected (2)

  • breakingDefault HTTP reset code changed

    Applicability is not stated in the release notes.

  • breakingDefault upstream protocol error reset handling changed

    Applicability is not stated in the release notes.

Plan ahead (1)

  • deprecatedOpenTelemetry access log common_config field deprecated

    Applies if you configure common_config.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023