Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Prometheusv3.14.0ObservabilityAug 18, 2026

ACTION 1CHECK 1PLAN 1OTHER 39View full analysis

A maintenance release with an API deprecation, operator-visible removals and default changes, new capabilities, performance improvements, and correctness fixes across discovery, PromQL, TSDB, and other components. No security advisories or explicitly described security vulnerabilities are included.

Action needed (1)

breakingDefault support for PromQL duration expressions
Duration expressions are enabled by default in PromQL. The promql-duration-expr feature flag is now a no-op.

Check if affected (1)

breakingThe __meta_hetzner_datacenter label, removed
Applies if you use hcloud targets.

Plan ahead (1)

deprecatedThe stats query parameter, deprecated for other valuesremoval date not announced
Applies if you set stats to a value other than true or all.

Prometheusv3.13.2ObservabilityJul 30, 2026

ACTION 2OTHER 2View full analysis

Prometheus v3.13.2 updates dependencies for two disclosed vulnerabilities and includes related transitive dependency upgrades. It also fixes a PromQL SIGBUS crash when the data disk is full.

Action needed (2)

securityhighgolang.org/x/text update for CVE-2026-56852
golang.org/x/text updates from v0.38.0 to v0.39.0 in Prometheus v3.13.2 for CVE-2026-56852.
securityhighgoogle.golang.org/grpc update for GHSA-hrxh-6v49-42gf
google.golang.org/grpc updates from v1.81.1 to v1.82.1 in Prometheus v3.13.2 for GHSA-hrxh-6v49-42gf.

Jaegerv2.20.0ObservabilityJul 20, 2026

ACTION 1CHECK 3PLAN 1OTHER 27View full analysis

A release with backend compatibility removals, forced migrations, new configuration and CLI capabilities, and correctness fixes across storage, extensions, and related components. It does not disclose security advisories or security-specific flaws.

Action needed (1)

breakingTemplate creation through esclient
Template creation moves to esclient, and legacy mapping rendering is retired.

Check if affected (3)

breakingSupport for elasticsearch v6, removed
Applies if you use elasticsearch v6.
breakingThe jaegermcp extension, merged into jaegerquery
Applies if you use the jaegermcp extension.
breakingExpired stable feature gates, removed
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedThe legacy flag, deprecated
Applies if you use legacy flag.

Litmus3.31.0ObservabilityJul 15, 2026

ACTION 1OTHER 9View full analysis

Release 3.31.0 contains a dependency update addressing vulnerabilities in graphql/server. It also includes correctness fixes across probes, GraphQL, authentication, infrastructure, and experiment handling.

Action needed (1)

securityDependencies in graphql/server updated
Dependencies in graphql/server are updated to fix vulnerabilities. The update ships in Release 3.31.0.

Prometheusv3.5.5ObservabilityJul 9, 2026

ACTION 1OTHER 1View full analysis

Prometheus v3.5.5 includes a Go 1.25.12 toolchain change and a disclosed security fix in the UI. The security fix concerns the sanitize-html dependency and CVE-2026-53606.

Action needed (1)

securitymediumThe sanitize-html dependency update for CVE-2026-53606
The Prometheus UI updates sanitize-html to v2.17.5 to fix CVE-2026-53606.

Thanosv0.42.0ObservabilityJul 8, 2026

ACTION 1CHECK 4OTHER 19View full analysis

A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.

Action needed (1)

securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186
The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.

Check if affected (4)

securityReceive tenant ID validation
Applies if you run Receive.
breakingQuery-Frontend time_taken field renamed to time_taken_ms
Applies if you run Query-Frontend.
breaking--shipper.ignore-unequal-block-size flag removed
Applies if you configure --shipper.ignore-unequal-block-size.
+ 1 more on the release page

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().

Prometheusv3.5.4ObservabilityJun 17, 2026

ACTION 2CHECK 1OTHER 1View full analysis

Prometheus v3.5.4 is primarily a security maintenance release, with a fix for plaintext secret exposure and dependency updates addressing reported advisories. It also adds publication of container images to the GitHub Container Registry at ghcr.io.

Action needed (2)

securitycriticalgolang.org/x/net and OpenTelemetry dependency updates
The golang.org/x/net dependency is updated to v0.55.0, and OpenTelemetry to v1.43.0. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.
securityPatched UI dependency versions
The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.

Check if affected (1)

securityPlaintext secret exposure via /-/config corrected
Applies if you access the /-/config endpoint.

Chaos Meshv2.8.3ObservabilityJun 10, 2026

ACTION 2OTHER 1View full analysis

A security-focused maintenance release includes undisclosed container-image CVE fixes and updates image components. It also corrects NetworkChaos recovery for targets in CrashLoopBackOff by falling back to the sandbox (pause) container PID for network namespace operations.

Action needed (2)

securityGo toolchain and containerd upgrades
The Go toolchain (1.25.11) and containerd (1.7.32) were upgraded in the container images.
securitymemStress rebuild and headless JRE for chaos-daemon
The memStress helper was rebuilt with the modern Go toolchain (v0.3.1), and the chaos-daemon image switched to a headless JRE.

Jaegerv2.19.0ObservabilityJun 3, 2026

ACTION 1OTHER 15View full analysis

This release adds API and storage capabilities, updates API query naming and defaults, and includes correctness fixes. No security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingThe searchdepth default in the trace-summaries endpoint
The default for searchdepth changed in the trace-summaries endpoint.

OpenCostv1.120.3ObservabilityMay 29, 2026

ACTION 1CHECK 1OTHER 51View full analysis

A maintenance release with dependency updates, correctness fixes, and new cloud and query capabilities. Configuration and output behavior also change, along with a Go dependency upgrade for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Action needed (1)

securityhighGo dependency upgrades for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986
Go dependencies are upgraded for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Check if affected (1)

breakingThe MCP_SERVER_ENABLED default is false
Applies if you do not configure MCP_SERVER_ENABLED.

Prometheusv3.12.0ObservabilityMay 28, 2026

ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

breakingConcurrent fgprof profile rejection
The API rejects concurrent fgprof profiles.

Check if affected (3)

securityRemote Write decoded-length constraint
Applies if you use Remote Write.
securityPlaintext secret exposure in STACKIT SD
Applies if you use STACKIT SD.
breakingDecompressed body-size limit for OTLP write requests
Applies if you use OTLP.

OpenCostv1.120.2ObservabilityMay 18, 2026

ACTION 1CHECK 2OTHER 40View full analysis

A maintenance release with dependency updates, operator-visible configuration and behavior changes, new integrations and capabilities, and correctness fixes. It also includes an explicitly disclosed security-related Go dependency upgrade.

Action needed (1)

securityhighGo dependency upgrades for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986
Go dependencies were upgraded to address GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Check if affected (2)

breakingThe provider config source, changed
Applies if you configure provider config.
breakingThe MCP_SERVER_ENABLED default, changed to false
Applies if you use the MCP server.

Litmus3.29.0ObservabilityMay 18, 2026

ACTION 1OTHER 7View full analysis

Litmus 3.29.0 includes operator-facing changes across dependencies and platform behavior. This release includes a google.golang.org/grpc update to v1.79.3 for CVE-2026-33186.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency, updated for CVE-2026-33186
The release updates google.golang.org/grpc to v1.79.3. The dependency update addresses CVE-2026-33186 in Litmus 3.29.0.

Jaegerv2.18.0ObservabilityMay 13, 2026

ACTION 2OTHER 23View full analysis

A release with breaking removals, API and metric changes, bug corrections, and experimental capabilities. It also adds storage, MCP, UI, and tracing functionality, with no security advisories or security-specific fixes disclosed.

Action needed (2)

breakingThe min step api in metricstore, removed
The min step api was removed from metricstore in this release.
breakingThe non-standard health MCP tool, removed
The non-standard health MCP tool was removed from jaegermcp in this release.

Cortexv1.21.0ObservabilityApr 27, 2026

ACTION 1CHECK 1PLAN 3OTHER 81View full analysis

A feature and maintenance release that adds Store Gateway, federation, overrides, caching, metric, and query capabilities while graduating several experimental features. It also changes defaults and configuration names, updates dependencies, and fixes correctness, memory, panic, and data-corruption defects.

Action needed (1)

breakingThe blocks storage bucket index default
Blocks storage now enables the bucket index by default through -blocks-storage.bucket-store.bucket-index.enabled. Disabling it with -blocks-storage.bucket-store.bucket-index.enabled=false is not recommended for production.

Check if affected (1)

breakingThe Distributor type and unit label flag
Applies if you configure either -distributor.enable-type-and-unit-labels or -distributor.otlp.enable-type-and-unit-labels for remote write v2 and OTLP requests.

Plan ahead (3)

breakingThe Ruler API flag rename
Applies if you configure -experimental.ruler.enable-api.
breakingThe Alertmanager API flag rename
Applies if you configure -experimental.alertmanager.enable-api.
breakingThe Users Scanner user index update configuration
Applies if you configure either -*.users-scanner.user-index.cleanup-interval or clean_up_interval.

Litmus3.28.0ObservabilityApr 15, 2026

ACTION 2OTHER 3View full analysis

A maintenance release with several defect fixes, including prevention of stale configuration leakage and a frontend base-image update to address a Python vulnerability. It also includes fixes for workflow event handling, branding, and experiment image-registry behavior.

Action needed (2)

securityStale configuration across probes of the same type
Stale configuration no longer leaks across multiple probes of the same type.
securityFrontend base image updated to ubi9
The frontend base image is updated to ubi9 to resolve a Python vulnerability.

OpenCostv1.120.0ObservabilityApr 13, 2026

ACTION 1OTHER 26View full analysis

A maintenance release with dependency updates, defect corrections, expanded compatibility, and new integrations and configuration capabilities. An existing configuration source is replaced, so affected operators need to update their configuration.

Action needed (1)

breakingProvider configuration replaced by cloud-integration.json
The provider config is no longer used, and configuration is read from cloud-integration.json instead. Operators using the replaced configuration source need to update their configuration.

Chaos Meshv2.8.2ObservabilityMar 25, 2026

ACTION 2CHECK 1PLAN 1OTHER 6View full analysis

A maintenance release deprecates and removes install.sh, updates the Go toolchain and JSON-RPC dependency, and corrects dashboard and webhook issues. It also includes vulnerability fixes in Go and UI packages.

Action needed (2)

securityGo package updates for vulnerability fixes
Go packages are upgraded to fix vulnerabilities.
securityUI package updates for vulnerability fixes
UI packages are upgraded to fix vulnerabilities.

Check if affected (1)

breakingThe install.sh installer, removed
Applies if you use install.sh.

Plan ahead (1)

deprecatedThe install.sh installer, deprecated
Applies if you use install.sh.

Jaegerv2.16.0ObservabilityMar 7, 2026

ACTION 1CHECK 2OTHER 5View full analysis

A release with breaking configuration and API changes, a Go 1.25.7 requirement, new capabilities, and bug and performance fixes. No security advisories or security-specific fixes are identified.

Action needed (1)

breakingGo 1.25.7 requirement
The codebase now requires Go 1.25.7, with Go version consistency enforced across the codebase.

Check if affected (2)

breakingLegacy response format of the remote sampling endpoint, removed
Applies if you use the remote sampling endpoint.
breakingtraces.topic renamed to traces.topics
Applies if you configure traces.topic.

Jaegerv2.15.1ObservabilityFeb 9, 2026

ACTION 1OTHER 2View full analysis

This release removes a deprecated v1 adapter wrapper and changes the default span kind in API v3 operations. The remaining release notes do not describe distinct operator-facing changes.

Action needed (1)

breakingDeprecated protofromtraces wrapper removal
The deprecated protofromtraces wrapper has been removed from v1adapter.

Prometheusv3.9.0ObservabilityJan 7, 2026

ACTION 1CHECK 1OTHER 34View full analysis

This release updates histogram collection and TSDB behavior while adding capabilities across the API, PromQL, storage, and UI. It also includes fixes for query handling, storage validation, receivers, and interface behavior.

Action needed (1)

breakingA 10,000-set limit for the TSDB status endpoint
The TSDB status endpoint now limits responses to a maximum of 10,000 sets of statistics.

Check if affected (1)

breakingThe native-histogram feature flag has no effect
Applies if you set scrape_native_histograms to collect Native Histogram samples from exporters.

Browse by month