Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Apr 2026Clear ×

Strimzi1.0.0Networking & MessagingApr 28, 2026

ACTION 2CHECK 4OTHER 12View full analysis

A release that removes older CRD API versions, changes defaults and configuration locations, and adds Kafka and HTTP Bridge capabilities. Monitoring configurations and standalone Topic Operator setups may require updates.

Action needed (2)

breakingThe UseConnectBuildWithBuildah feature gate, enabled by default
The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default.
breakingThe /metrics endpoint, moved to the HTTP management interface
The /metrics endpoint is no longer available on the regular HTTP interface, which uses port 8080 by default. It is now available on the HTTP management interface on port 8081.

Check if affected (4)

breakingOlder CRD API versions, removed
Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.
breakingThe Open Policy Agent (OPA) authorizer plugin, no longer bundled
Applies if you use the Open Policy Agent (OPA) authorizer plugin.
breakingLegacy TLS environment variables, ignored
Applies if you set any of STRIMZI_TLS_ENABLED, STRIMZI_TLS_AUTH_ENABLED, STRIMZI_PUBLIC_CA, STRIMZI_TRUSTSTORE_LOCATION, STRIMZI_TRUSTSTORE_PASSWORD, STRIMZI_KEYSTORE_LOCATION, or STRIMZI_KEYSTORE_PASSWORD.
+ 1 more on the release page

Source ↗

NATSv2.12.8Networking & MessagingApr 27, 2026

ACTION 1OTHER 22View full analysis

A maintenance release with a security fix, correctness fixes, a performance improvement, and dependency and toolchain manifest updates. Most changes take effect through the release itself without additional operator action.

Action needed (1)

securityBearer JWT disclosure fix in /connz
The /connz monitoring endpoint no longer discloses bearer JWTs. The fix ships in the NATS monitoring endpoint.

Source ↗

Envoyv1.38.0Networking & MessagingApr 23, 2026

ACTION 1CHECK 6PLAN 1OTHER 77View full analysis

A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.

Action needed (1)

securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.

Check if affected (6)

securityURL encoding for query_parameter_mutations values
Applies if you configure query_parameter_mutations.
securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
breakingExplicit max_early_data_bytes configuration
Applies if you configure upstream_connect_mode with a value other than IMMEDIATE and do not configure max_early_data_bytes.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe enforce_rsa_key_usage option, deprecatedremoval date not announced
Applies if you configure enforce_rsa_key_usage.

Source ↗

Contourv1.32.5Networking & MessagingApr 20, 2026

ACTION 1OTHER 1View full analysis

Contour v1.32.5 fixes a Lua code injection vulnerability and upgrades Envoy to v1.34.14. The release also includes an informational Kubernetes compatibility update.

Action needed (1)

securityhighCVE-2026-41246 Lua code injection vulnerability fixed
This release fixes CVE-2026-41246 and GHSA-x4mj-7f9g-29h4, a Lua code injection vulnerability affecting cookieRewritePolicies[].pathRewrite.value.

Source ↗

Ciliumv1.19.3Networking & MessagingApr 15, 2026

ACTION 1OTHER 50View full analysis

Cilium v1.19.3 combines operator-relevant bug fixes with configuration and CLI additions, along with dependency and image updates. The release is relevant to deployments using the affected functionality and to users tracking dependency changes.

Action needed (1)

securityThe github.com/go-jose/go-jose/v4 module update
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in the v1.19.3 release. The update is marked as security-related.

Source ↗

Ciliumv1.18.9Networking & MessagingApr 15, 2026

ACTION 2OTHER 39View full analysis

Cilium v1.18.9 contains correctness fixes and dependency updates. It also includes security-related changes, including an injection-prevention fix and a security-tagged module update.

Action needed (2)

securityRegex dollar-sign escaping for injection prevention
Regex handling now escapes the $ character to prevent injection. The fix ships in Cilium v1.18.9.
securityThe github.com/go-jose/go-jose/v4 dependency update
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Cilium v1.18.9. The release note marks this dependency update as security-related.

Source ↗

Istio1.29.2Networking & MessagingApr 13, 2026

ACTION 1OTHER 15View full analysis

A maintenance release adds Helm v4 server-side apply support and includes numerous correctness fixes. The WASM decompression size-limit change affects inputs that were previously accepted and may require operator review.

Action needed (1)

breakingThe gzip decompression size limit for WASM binaries
A size limit is now enforced on gzip-decompressed WASM binaries fetched over HTTP.

Source ↗

Browse by month