Releases — RATATOSK

NATSv2.12.14Networking & MessagingJul 30, 2026

ACTION 1CHECK 2OTHER 33View full analysis

A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.

Action needed (1)

breakingThe disk concurrency semaphore, increased to 4096 slots
The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.

Check if affected (2)

securityAuthentication checks with no_auth_user and auth callouts
Applies if you configure no_auth_user and use auth callouts.
securityTLS verify_and_map authentication with blank passwords
Applies if you use TLS and configure verify_and_map.

Source ↗

Ciliumv1.20.0Networking & MessagingJul 29, 2026

ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

securitygoogle.golang.org/grpc v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in the main branch.
securitygoogle.golang.org/grpc v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.
securityhelm.sh/helm/v4 v4.1.4
The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.
securitygithub.com/cloudflare/circl v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3.
securitygithub.com/go-jose/go-jose/v4 v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.
securitygithub.com/moby/spdystream v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1.
breakingcni.customConf CNI configuration version
The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.

Check if affected (28)

securitytbid traffic host namespace handling
Applies if you use tbid traffic.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
+ 25 more on the release page

Plan ahead (6)

deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[].subnet or interfaces[].cidr.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
+ 3 more on the release page

Source ↗

Linkerdedge-26.7.1Networking & MessagingJul 21, 2026

ACTION 1CHECK 1OTHER 58View full analysis

This release tightens Gateway API and service-port handling and corrects tracing identity construction. It also updates dependencies and shipped components, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

breakingUndefined service port requests disallowed
The destination component now disallows requests to service ports that are not defined.

Check if affected (1)

breakingGateway API checks during Helm installation
Applies when you use Helm.

Source ↗