Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Crossplanev1.20.12Orchestration & ManagementYesterdayAug 21, 2026

ACTION 5OTHER 3View full analysis

A maintenance release with security-related dependency and toolchain updates, along with routine dependency and runtime version changes. No advisory identifiers are stated.

Action needed (5)

securityVulnerable dependency fixes
Vulnerable dependencies were updated in the release-1.20 branch.
securityVulnerable dependency updates
Vulnerable dependencies were updated in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module update
The github.com/go-git/go-git/v5 module was updated to version v5.19.2 in the release-1.20 branch.
securityThe golang.org/x/mod module update
The golang.org/x/mod module was updated to version v0.40.0 in the release-1.20 branch.
securityThe Go toolchain version 1.25.13
The Go toolchain was updated to version 1.25.13 in the release-1.20 branch.

Source ↗

Crossplanev2.2.5Orchestration & ManagementYesterdayAug 21, 2026

ACTION 1OTHER 2View full analysis

A maintenance release corrects binary checksum generation and deletion-protection indexing, and updates dependencies for upstream CVE fixes. The changes affect release verification, webhook deletion checks, and the dependency set shipped with the release.

Action needed (1)

securityDependency security updates
The release updates cel-go, golang.org/x/mod, sigstore-go, and go-git, along with a combined set of vulnerable dependency updates, to pick up upstream CVE fixes. It also bumps crossplane-runtime to v2.2.4, which carries its own security dependency updates.

Source ↗

Crossplanev2.3.5Orchestration & ManagementYesterdayAug 21, 2026

ACTION 4OTHER 4View full analysis

A maintenance release corrects binary checksum handling and the Usage index key, alongside updates to security-sensitive and build dependencies. The dependency changes require the new release, with no operator configuration migration stated.

Action needed (4)

securityThe golang.org/x/mod dependency update
The release updates golang.org/x/mod as a security-related dependency change.
securityThe github.com/sigstore/sigstore-go dependency, updated to v1.2.1
The release updates github.com/sigstore/sigstore-go to v1.2.1 as a security-related dependency change.
securityThe github.com/google/cel-go dependency, updated to v0.30.0
The release updates github.com/google/cel-go to v0.30.0 as a security-related dependency change.
securityThe crossplane-runtime dependency, bumped to v2.3.4
The release bumps crossplane-runtime to v2.3.4 as a security-related dependency change.

Source ↗

Crossplanev2.4.0Orchestration & ManagementAug 20, 2026

ACTION 15CHECK 4PLAN 1OTHER 33View full analysis

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

securityGo version and dependency security updates
Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.
securityGo 1.25.10
Go was updated to 1.25.10 to fix standard library CVEs.
securitygolang.org/x/crypto v0.52.0
The golang.org/x/crypto module was updated to v0.52.0 for security fixes.
securitygolang.org/x/sys v0.44.0
The golang.org/x/sys module was updated to v0.44.0 for security fixes.
securitygolang.org/x/net v0.55.0
The golang.org/x/net module was updated to v0.55.0 for security fixes.
securitygithub.com/sigstore/cosign/v3 v3.0.6
The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.
securitygithub.com/sigstore/rekor v1.5.2
The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.
securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0
The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.0
The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.
securityCombined grpc, x/net, and x/text security updates
Combined security updates were applied to grpc, x/net, and x/text.
securitygolang.org/x/net v0.56.0
The golang.org/x/net module was updated to v0.56.0 for security fixes.
securitygolang.org/x/text v0.39.0
The golang.org/x/text module was updated to v0.39.0 for security fixes.
securityVulnerable dependency updates
Vulnerable dependencies were updated for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.1
The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.
securitygolang.org/x/mod v0.40.0
The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

breakingCrossplane CLI publication location and binary name
Applies if you use the Crossplane CLI.
breakingspec.replicas behavior in DeploymentRuntimeConfig
Applies if DeploymentRuntimeConfig configures spec.replicas.
breakingNarrowed composed resource garbage collection
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (1)

deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)
Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.

Source ↗

wasmCloudv2.7.0Orchestration & ManagementAug 11, 2026

ACTION 1OTHER 19View full analysis

wasmCloud v2.7.0 adds runtime, networking, plugin, TLS, and chart capabilities while correcting runtime and Helm/chart defects. It also changes defaults and updates dependencies.

Action needed (1)

breakingDefault-enabled implements and maps
implements and maps are enabled by default in wasmCloud v2.7.0.

Source ↗

Daprv1.17.12Orchestration & ManagementAug 6, 2026

ACTION 1OTHER 1View full analysis

This release contains a security-related build toolchain update and an input-binding startup fix. The probe timeout is configurable for applications with slow startup.

Action needed (1)

securityThe Go toolchain version, updated to 1.26.5
The Go version used to build Dapr is updated from 1.26.4 to 1.26.5 across the runtime, build tooling, and container images.

Source ↗

Karmadav1.18.2Orchestration & ManagementJul 31, 2026

ACTION 2CHECK 8PLAN 4OTHER 65View full analysis

A broad operator-impacting maintenance release with security-related base image updates, API and configuration changes, scheduling capabilities, and deprecations and removals. Operators should review changed defaults and constraints and account for migration work affecting their configurations, APIs, and metrics.

Action needed (2)

securityThe alpine base image update
The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns.
securityThe alpine base image update
The alpine base image is updated from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (8)

breakingThe cluster lease duration flags, removed
Applies if you configure either --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
breakingThe Estimator metric label value, removed
Applies if you use either estimating_plugin_execution_duration_seconds or estimating_plugin_extension_point_duration_seconds.
breakingThe Etcd.Local.InitImage configuration field, removed
Applies if you configure Etcd.Local.InitImage.
+ 5 more on the release page

Plan ahead (4)

deprecatedThe ReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ReplicaRequirements.resourceRequest.
deprecatedThe ComponentReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ComponentReplicaRequirements.resourceRequest.
deprecatedThe NodeClaim.nodeAffinity field deprecationdeprecated since v1.18.0
Applies if you use NodeClaim.nodeAffinity.
+ 1 more on the release page

Source ↗

Karmadav1.17.5Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 82View full analysis

A mixed maintenance and feature release with workload-affinity and anti-affinity support, encryption-at-rest capabilities, bug fixes, and updates to dependencies and default images. It also changes operational defaults and validation while deprecating or removing configuration flags and fields, so compatibility and configuration changes are part of the release.

Action needed (1)

breakingControllerPriorityQueue promotion to beta and default enablement
ControllerPriorityQueue is promoted to beta and enabled by default.

Check if affected (4)

breakingThe --etcd-init-image flag, removed from karmadactl init
Applies if you use the --etcd-init-image flag.
breakingnamespace validation for spec.resourceSelectors
Applies if you use PropagationPolicy or OverridePolicy.
breakingDistinct GroupByLabelKey values in WorkloadAffinity
Applies if you configure WorkloadAffinity.
+ 1 more on the release page

Plan ahead (2)

deprecatedEtcd.Local.InitImage deprecationdeprecated since v1.17.0 · removal date not announced
Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.
deprecatedDeprecation of cluster lease flagsdeprecated since v1.17.0 · removal date not announced
Applies if you use --cluster-lease-duration or --cluster-lease-renew-interval-fraction.

Source ↗

Karmadav1.16.8Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 104View full analysis

A mixed maintenance and feature release with bug fixes, new APIs and capabilities, performance and instrumentation improvements, dependency updates, and deprecated field removals. Operators should review the removed fields and the updated dependency, while the release also adds multi-component scheduling, configurable initialization, eviction queue support, and new workload interpreters.

Action needed (1)

securitymediumThe github.com/vektra/mockery dependency update
The github.com/vektra/mockery dependency was bumped to v3.5.5 to address security concerns identified by GO-2025-3900.

Check if affected (4)

breakingThe external etcd fields CAData, CertData, and KeyData, removed
Applies if you configure CAData, CertData, or KeyData.
breakingThe init command's default component images
Applies if you run the init command.
breakingA 32s default timeout for the member cluster client
Applies if you use the member cluster client.
+ 1 more on the release page

Plan ahead (2)

deprecatedThe --etcd-init-image flag, deprecatedremoval date not announced
Applies if you use --etcd-init-image.
breakingThe Prometheus metric labels cluster and cluster_name, replaced by member_clusterremoval planned in 1.18
Applies if you use the cluster or cluster_name metric labels.

Source ↗

KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github.com/moby/spdystream dependency, updated
The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

breakingStricter network interface binding admission
Applies if you configure network interface bindings.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
+ 6 more on the release page

Plan ahead (2)

deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗

Volcanov1.15.1Orchestration & ManagementJul 30, 2026

ACTION 1OTHER 16View full analysis

Volcano v1.15.1 is a maintenance release with a dependency update, configuration-format compatibility changes, and correctness fixes. It also includes implementation-only changes with no operator-facing impact.

Action needed (1)

securityThe golang.org/x/crypto dependency, upgraded
Volcano v1.15.1 upgrades golang.org/x/crypto from v0.49.0 to v0.53.0, incorporating upstream SSH security fixes released in v0.52.0.

Source ↗

wasmCloudv2.6.0Orchestration & ManagementJul 28, 2026

ACTION 1OTHER 36View full analysis

A feature and maintenance release that adds runtime, plugin, service, component, and pooling capabilities while changing the default NATS behavior. It also includes dependency updates and fixes for runtime and observability defects.

Action needed (1)

breakingThe NATS consumer-group default
NATS now uses consumer groups by default in the release.

Source ↗

Crossplanev2.3.4Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 5View full analysis

This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.

Action needed (7)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.3.4 updates the github.com/sigstore/rekor module to v1.5.2 for security fixes.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.3.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6 for security fixes.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.3.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0 for security fixes.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.3.4 updates the github.com/sigstore/sigstore-go module to v1.2.0 for security fixes.
securityCombined security dependency updates
Crossplane v2.3.4 includes combined security updates for grpc, golang.org/x/net, and golang.org/x/text.
securityThe golang.org/x/text module update to v0.39.0
Crossplane v2.3.4 updates the golang.org/x/text module to v0.39.0 for security fixes.
securityThe golang.org/x/net module update to v0.56.0
Crossplane v2.3.4 updates the golang.org/x/net module to v0.56.0 for security fixes.

Source ↗

Crossplanev2.2.4Orchestration & ManagementJul 23, 2026

ACTION 5OTHER 2View full analysis

Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.

Action needed (5)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.2.4 updates the github.com/sigstore/rekor module to v1.5.2.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.2.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.2.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.2.4 updates the github.com/sigstore/sigstore-go module to v1.2.0.
securityCombined grpc, x/net, and x/text dependency updates
Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.

Source ↗

Crossplanev2.1.8Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 1View full analysis

Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.

Action needed (7)

securityThe github.com/sigstore/rekor module at v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in Crossplane v2.1.8.
securityThe github.com/sigstore/timestamp-authority/v2 module at v2.1.0
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.1.0 in Crossplane v2.1.8.
securityThe github.com/sigstore/cosign/v2 module at v2.6.3
The github.com/sigstore/cosign/v2 module is updated to v2.6.3 in Crossplane v2.1.8.
securityThe Go toolchain at 1.25.12
The Go toolchain is updated to 1.25.12 in Crossplane v2.1.8.
securityThe github.com/sigstore/sigstore-go module at v1.2.0
The github.com/sigstore/sigstore-go module is updated to v1.2.0 in Crossplane v2.1.8.
securityCombined grpc, x/net, and x/text dependency updates
Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.
securityThe golang.org/x/text module at v0.39.0
The golang.org/x/text module is updated to v0.39.0 in Crossplane v2.1.8.

Source ↗

Crossplanev1.20.11Orchestration & ManagementJul 23, 2026

ACTION 4OTHER 1View full analysis

A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.

Action needed (4)

securityThe github.com/sigstore/rekor module, updated to v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in the release-1.20 line.
securityThe Go toolchain, updated to 1.25.12
The Go toolchain is updated to 1.25.12 in the release-1.20 line.
securityThe alpine Docker tag, updated to v3.24
The alpine Docker tag is updated to v3.24 in the release-1.20 line.
securitySecurity updates for grpc, x/net, and x/text
Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.

Source ↗

Daprv1.18.2Orchestration & ManagementJul 21, 2026

ACTION 3OTHER 18View full analysis

A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.

Action needed (3)

securitymediumgithub.com/go-chi/chi/v5 updated for CVE-2025-69725
github.com/go-chi/chi/v5 is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo.mongodb.org/mongo-driver and github.com/dapr/components-contrib updates
go.mongodb.org/mongo-driver is updated to v1.17.7, and the github.com/dapr/components-contrib dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.

Source ↗

wasmCloudv2.5.0Orchestration & ManagementJun 30, 2026

ACTION 1CHECK 1OTHER 21View full analysis

Version v2.5.0 adds runtime and WIT/API capabilities and includes correctness and dependency updates. The release also enables wasip3 by default and includes a quinn-proto fix for RUSTSEC-2026-0185.

Action needed (1)

securityhighThe quinn-proto security fix
The quinn-proto dependency fix ships in wasmCloud v2.5.0 and addresses RUSTSEC-2026-0185.

Check if affected (1)

breakingDefault wasip3 enablement with wasmtime 46
Applies if your workloads use wasip3.

Source ↗

Karmadav1.18.1Orchestration & ManagementJun 30, 2026

ACTION 1OTHER 1View full analysis

This release updates the Alpine base image and fixes a Helm chart TLS certificate issue. The Helm fix applies to deployments that use a custom namespace, while the base image change addresses security concerns.

Action needed (1)

securityThe alpine base image, upgraded
The alpine base image is promoted from alpine:3.23.4 to alpine:3.24.1 to address security concerns.

Source ↗

Karmadav1.17.4Orchestration & ManagementJun 30, 2026

ACTION 1OTHER 1View full analysis

Karmada v1.17.4 updates its Alpine base image to address security concerns. The release also fixes a Helm chart TLS certificate SAN mismatch when deploying to a custom namespace.

Action needed (1)

securityThe alpine base image, updated to alpine:3.24.1
The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns. The update ships in Karmada v1.17.4.

Source ↗

Karmadav1.16.7Orchestration & ManagementJun 30, 2026

ACTION 1OTHER 1View full analysis

Karmada v1.16.7 updates its Alpine base image for security concerns and includes a Helm chart fix for TLS certificate SANs in custom namespaces. The release affects deployments that use the updated image or the affected Helm chart configuration.

Action needed (1)

securityThe alpine base image, updated
The base image alpine is promoted from alpine:3.23.4 to alpine:3.24.1 to address security concerns.

Source ↗

Crossplanev2.3.3Orchestration & ManagementJun 22, 2026

ACTION 2OTHER 1View full analysis

Crossplane v2.3.3 is a maintenance release with security fixes delivered through dependency and toolchain updates. It also corrects namespace handling for injected resource references in crossplane render, so rendered output matches reconciler behavior for cluster-scoped XRs.

Action needed (2)

securityPackage signature verification TOCTOU fix, GHSA-mf7q-r4rv-jv94
The package signature verification TOCTOU flaw identified by GHSA-mf7q-r4rv-jv94 is fixed through the crossplane-runtime v2.3.3 dependency bump. The affected code moved from crossplane to crossplane-runtime during the v2.3 milestone, so this fix ships through that dependency in Crossplane v2.3.3.
securityGo 1.25.11, golang.org/x/net, and golang.org/x/sys updates
The release-2.3 branch bumps Go to 1.25.11 and updates golang.org/x/net and golang.org/x/sys for CVE-related security fixes.

Source ↗

Crossplanev2.2.3Orchestration & ManagementJun 22, 2026

ACTION 1OTHER 3View full analysis

This release includes a security fix for package signature verification and updates to dependencies. It concerns deployments affected by the disclosed package-signature-verification flaw or by the updated dependency versions.

Action needed (1)

securitycriticalPackage signature verification TOCTOU fix, GHSA-wfqx-gjrf-g28r
Crossplane v2.2.3 fixes the package signature verification TOCTOU issue identified by GHSA-wfqx-gjrf-g28r.

Source ↗

Crossplanev2.1.7Orchestration & ManagementJun 22, 2026

ACTION 3OTHER 1View full analysis

Crossplane v2.1.7 is a maintenance release with dependency and Go toolchain updates. The changes affect the software components shipped with this release.

Action needed (3)

securityThe github.com/quic-go/quic-go module update
The github.com/quic-go/quic-go module is updated to v0.59.1 in Crossplane v2.1.7.
securityThe golang.org/x/net module update
The golang.org/x/net module is updated to v0.55.0 in Crossplane v2.1.7.
securityThe Go toolchain at 1.25.11
The Go toolchain is bumped to 1.25.11 in Crossplane v2.1.7.

Source ↗

Crossplanev1.20.10Orchestration & ManagementJun 22, 2026

ACTION 2OTHER 2View full analysis

A dependency maintenance release with security updates to the Go toolchain and MongoDB driver, alongside routine dependency bumps. Cosign and Docker remediation items were not applied and remain limitations.

Action needed (2)

securityhighThe Go toolchain, updated to 1.25.11
The Go toolchain is updated to 1.25.11, the latest Go 1.25 security patch. The change addresses CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityThe go.mongodb.org/mongo-driver module, updated to v1.17.7
The go.mongodb.org/mongo-driver module is updated to v1.17.7 with a security update.

Source ↗

wasmCloudv2.4.0Orchestration & ManagementJun 17, 2026

ACTION 1CHECK 1OTHER 11View full analysis

wasmCloud v2.4.0 adds operator capabilities and configuration options while correcting runtime and tooling behavior. It also changes supported platform behavior and updates dependencies associated with Rust security advisories, so platform-specific users and deployments using the affected crates are most directly concerned.

Action needed (1)

securityThe postgres crates, updated for Rust security advisories
The postgres crates are updated for RUSTSEC-2026-0178, RUSTSEC-2026-1079, and RUSTSEC-2026-0180. This dependency update ships in wasmCloud v2.4.0.

Check if affected (1)

breakingwebgpu disabled for s390
Applicability is not stated in the release notes.

Source ↗

KubeVirtv1.8.4Orchestration & ManagementJun 16, 2026

ACTION 1OTHER 3View full analysis

KubeVirt v1.8.4 adds observability coverage, changes node-labeller CPU feature handling, and fixes a virt-handler resource leak. It also updates a dependency to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Action needed (1)

securityhighThe github.com/moby/spdystream dependency, upgraded for CVE-2026-35469
github.com/moby/spdystream is upgraded from v0.5.0 to v0.5.1 in KubeVirt v1.8.4 to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Source ↗

Daprv1.18.0Orchestration & ManagementJun 10, 2026

ACTION 8CHECK 6PLAN 1OTHER 108View full analysis

A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.

Action needed (8)

securitymediumThe golang.org/x/image dependency update for GO-2026-4962
golang.org/x/image is updated to v0.39.0 for GO-2026-4962.
securityThe durabletask-go and pgx dependency updates
durabletask-go is updated to v0.12.1, and pgx is updated as part of the vulnerability fixes.
breakingThe WorkflowsRemoteActivityReminder default, enabled
WorkflowsRemoteActivityReminder is enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.
breakingThe HotReload default, enabled
HotReload is enabled by default for Components, Subscriptions, MCPServers, Configurations, HTTPEndpoints, Resiliencies, and WorkflowAccessPolicies.
breakingSidecar probe defaults
Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.
breakingThe HotReload default, enabled in v1.18
HotReload is enabled by default in v1.18.
breakingLiveness and readiness probe defaults
The default liveness probe is widened, and the readiness probe default is tightened.
breakingChanged sidecar probe defaults
Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for daprd.

Check if affected (6)

securityService invocation path traversal ACL bypass fix
Applies if you use service invocation.
breakingThe MCPServerResource and WorkflowAccessPolicy feature gates, removed
Applies if you configure the MCPServerResource or WorkflowAccessPolicy feature gates.
breakingThe Sentry Ed25519 workload identity key rollback constraint
Applicability is not stated in the release notes.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe ScheduleJobAlpha1 alpha RPCs, deprecated
Applies if you use ScheduleJobAlpha1.

Source ↗

Crossplanev1.20.9Orchestration & ManagementJun 5, 2026

ACTION 1OTHER 2View full analysis

This Crossplane release combines dependency maintenance with a new CLI check for upgrade readiness. The check scans a live v1.x control plane for features removed or changed in Crossplane v2 and reports what would break before an upgrade.

Action needed (1)

securityThe golang.org/x/net module, updated to v0.55.0
The golang.org/x/net module is updated to v0.55.0 in Crossplane v1.20.9. The release note marks this dependency update as security-related, but does not identify a specific vulnerability.

Source ↗

KubeVirtv1.8.3Orchestration & ManagementJun 3, 2026

ACTION 2PLAN 1OTHER 13View full analysis

A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.

Action needed (2)

securitycriticalgoogle.golang.org/grpc update to 1.79.3
The google.golang.org/grpc dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.
securitySymlink traversal fix in the VMExport directory handler
The VMExport directory handler is fixed to prevent symlink traversal.

Plan ahead (1)

deprecatedDeprecated kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total recording rules
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗

KubeVirtv1.7.4Orchestration & ManagementJun 3, 2026

ACTION 1OTHER 5View full analysis

KubeVirt v1.7.4 includes correctness fixes and behavior changes affecting PCI topology and IPv6 migration. It also updates the gRPC dependency to address CVE-2026-33186.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency update for CVE-2026-33186
KubeVirt v1.7.4 updates google.golang.org/grpc to version 1.79.3 to remediate CVE-2026-33186.

Source ↗

KubeVirtv1.6.6Orchestration & ManagementJun 3, 2026

ACTION 1OTHER 8View full analysis

KubeVirt v1.6.6 includes a dependency update for CVE-2026-33186. The recorded change affects the gRPC dependency shipped with this release.

Action needed (1)

securitycriticalgoogle.golang.org/grpc update for CVE-2026-33186
KubeVirt v1.6.6 bumps google.golang.org/grpc to remediate CVE-2026-33186.

Source ↗

wasmCloudv2.3.0Orchestration & ManagementJun 3, 2026

ACTION 2OTHER 12View full analysis

Version v2.3.0 adds workload configuration and telemetry capabilities while correcting wash and runtime defects. It also changes RBAC scope support and updates dependencies, including security patches and reported advisory fixes.

Action needed (2)

securityThe wasmtime 44.0.2 security patch
The release updates wasmtime to 44.0.2 as a security patch.
securityReported dependency security advisories
The dependency set includes patches for reported security advisories.

Source ↗

Volcanov1.15.0Orchestration & ManagementJun 1, 2026

ACTION 4CHECK 2OTHER 83View full analysis

A feature and operational-hardening release that adds alpha scheduling capabilities, new scheduler and Helm configuration, and fixes scheduler and integration stability issues. Operators should review Kubernetes and DRA compatibility requirements, the changed DRA default, and the disclosed denial-of-service and Prometheus security fixes.

Action needed (4)

securitymediumPrometheus dependency update for GHSA-vffh-x6r8-xx99
Updates github.com/prometheus/prometheus to address stored XSS advisory GHSA-vffh-x6r8-xx99.
securitymediumAdmission webhook request body limits
The admission webhook now limits request bodies, fixing the denial-of-service risk identified by CVE-2026-44247 and GHSA-8wxp-xxp2-rcgx.
breakingDRA scheduling integration default
DRA scheduling integration is enabled by default.
breakingDRA scheduling integration default behavior
DRA scheduling integration is enabled by default to align with Kubernetes 1.34 and later behavior. Set predicate.DynamicResourceAllocationEnable to false to disable it.

Check if affected (2)

breakingOpt-in SchedulingGatesQueueAdmission
Applies if you enable SchedulingGatesQueueAdmission.
breakingOpt-in gang-aware preemption and reclamation
Applies if you configure gangPreempt and gangReclaim and do not configure preempt or reclaim.

Source ↗

Karmadav1.18.0Orchestration & ManagementMay 30, 2026

ACTION 1CHECK 9OTHER 35View full analysis

A feature and maintenance release that adds overflow scheduling and scheduling overcommit protection, along with API, default, constraint, metric, and flag changes. It also includes a security-related alpine base-image update and numerous defect corrections.

Action needed (1)

securityThe alpine base image update
The alpine base image has changed from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (9)

breakingThe overflowAffinities field
Applies if you configure overflowAffinities.
breakingStricter clusterTolerations operator validation
Applies if you set spec.placement.clusterTolerations with Lt or Gt.
breakingThe operator's default verbosity level
Applies if you run the operator.
+ 6 more on the release page

Source ↗

Crossplanev2.3.1Orchestration & ManagementMay 22, 2026

ACTION 1CHECK 13OTHER 1View full analysis

A maintenance release includes dependency updates and security fixes in golang.org/x/crypto. The fixes cover SSH, SSH agent, and known-hosts behavior.

Action needed (1)

securitygolang.org/x/crypto updated to v0.52.0
The release updates the golang.org/x/crypto module to v0.52.0.

Check if affected (13)

securitycriticalUnenforced invoking key constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
securitycriticalDropped invoking agent constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
securitycriticalServer deadlock on unexpected responses in golang.org/x/crypto/ssh
Applies if you use golang.org/x/crypto/ssh.
+ 10 more on the release page

Source ↗

Crossplanev1.20.8Orchestration & ManagementMay 22, 2026

ACTION 7OTHER 1View full analysis

Crossplane v1.20.8 is a dependency and toolchain maintenance release. It updates several modules and the Go version, with the recorded dependency changes addressing security fixes, and also bumps crossplane-runtime to v1.20.8.

Action needed (7)

securityThe github.com/docker/cli module, updated to v29.2.0+incompatible
The github.com/docker/cli module is updated to v29.2.0+incompatible in the release-1.20 branch.
securityThe golang.org/x/net module, updated to v0.53.0
The golang.org/x/net module is updated to v0.53.0 in the release-1.20 branch.
securityThe github.com/in-toto/in-toto-golang module, updated to v0.11.0
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module, updated to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in the release-1.20 branch.
securityThe Go toolchain, updated to 1.25.10
Go is updated to 1.25.10 to fix standard-library CVEs in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module, updated to v5.19.1
The github.com/go-git/go-git/v5 module is updated again, to v5.19.1, in the release-1.20 branch.
securityThe golang.org/x/crypto module, updated to v0.52.0
The golang.org/x/crypto module is updated to v0.52.0 in the release-1.20 branch.

Source ↗

Crossplanev2.1.6Orchestration & ManagementMay 22, 2026

ACTION 6CHECK 1OTHER 1View full analysis

A security-focused maintenance release updates Go and several dependencies, including a fix for an HTTP/2 transport infinite-loop vulnerability. The Go and dependency version increases require upgrading; no configuration migration or deprecation is announced.

Action needed (6)

securityThe go.opentelemetry.io/otel module update
The go.opentelemetry.io/otel module is updated to v1.41.0 in this release.
securityThe github.com/in-toto/in-toto-golang module update
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in this release.
securityThe github.com/go-git/go-git/v5 module update to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in this release.
securityGo 1.25.10
Go is updated to 1.25.10 to fix standard library CVEs.
securityThe github.com/go-git/go-git/v5 module update to v5.19.1
The github.com/go-git/go-git/v5 module is updated to v5.19.1 in this release.
securityThe golang.org/x/crypto module update
The golang.org/x/crypto module is updated to v0.52.0 in this release.

Check if affected (1)

securityhighThe golang.org/x/net HTTP/2 transport infinite loop
Applicability is not stated in the release notes.

Source ↗

Crossplanev2.2.2Orchestration & ManagementMay 22, 2026

ACTION 5OTHER 1View full analysis

Crossplane v2.2.2 is a dependency and toolchain maintenance release with security-focused updates. It concerns deployments and builds that rely on the updated Go toolchain and modules.

Action needed (5)

securitygithub.com/in-toto/in-toto-golang updated to v0.11.0
Crossplane v2.2.2 updates the github.com/in-toto/in-toto-golang module to v0.11.0. The update ships in the release-2.2 line.
securitygithub.com/go-git/go-git/v5 updated to v5.19.0
Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.0. The update ships in the release-2.2 line.
securityGo 1.25.10 update for standard-library CVEs
Crossplane v2.2.2 updates Go to 1.25.10 to fix standard-library CVEs. The toolchain update ships in the release-2.2 line.
securitygithub.com/go-git/go-git/v5 updated to v5.19.1
Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.1. The update ships in the release-2.2 line.
securitygolang.org/x/crypto updated to v0.52.0
Crossplane v2.2.2 updates the golang.org/x/crypto module to v0.52.0. The update ships in the release-2.2 line.

Source ↗

Crossplanev2.3.0Orchestration & ManagementMay 21, 2026

ACTION 14CHECK 3OTHER 20View full analysis

Crossplane v2.3.0 combines breaking API naming and path changes with new operator capabilities and correctness fixes. It also updates several Go dependencies and the Go toolchain, which matters to API consumers and builds that depend on the affected packages.

Action needed (14)

securityThe github.com/cloudflare/circl dependency, updated to v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3 in Crossplane v2.3.0.
securityThe google.golang.org/grpc dependency, updated to v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in Crossplane v2.3.0.
securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency, updated to v1.43.0
The go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module is updated to v1.43.0 in Crossplane v2.3.0.
securityThe github.com/go-git/go-git/v5 dependency, updated to v5.17.1
The github.com/go-git/go-git/v5 module is updated to v5.17.1 in Crossplane v2.3.0.
securityThe github.com/go-jose/go-jose/v4 dependency, updated to v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Crossplane v2.3.0.
securityThe github.com/sigstore/cosign/v3 dependency, updated to v3.0.5
The github.com/sigstore/cosign/v3 module is updated to v3.0.5 in Crossplane v2.3.0.
securityThe github.com/docker/cli dependency, updated to v29.2.0+incompatible
The github.com/docker/cli module is updated to v29.2.0+incompatible in Crossplane v2.3.0.
securityThe github.com/sigstore/timestamp-authority/v2 dependency, updated to v2.0.6
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.0.6 in Crossplane v2.3.0.
securityThe Go toolchain, updated to 1.25.9
The Go toolchain is updated to 1.25.9 in Crossplane v2.3.0.
securityThe github.com/moby/spdystream dependency, updated to v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1 in Crossplane v2.3.0.
securityThe github.com/go-git/go-git/v5 dependency, updated to v5.18.0
The github.com/go-git/go-git/v5 module is updated to v5.18.0 in Crossplane v2.3.0.
securityThe github.com/in-toto/in-toto-golang dependency, updated to v0.11.0
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in Crossplane v2.3.0.
securityThe golang.org/x/net dependency, updated to v0.53.0
The golang.org/x/net module is updated to v0.53.0 in Crossplane v2.3.0.
securityThe Go toolchain, updated to 1.25.10
The Go toolchain is updated to 1.25.10 in Crossplane v2.3.0 to fix standard library CVEs.

Check if affected (3)

breakingThe Crossplane API dependency path, renamed
Applies if you build external consumers of Crossplane APIs.
breakingThe common API package, moved
Applies if you use the common APIs from crossplane-runtime.
breakingThe v1.Resource* types, renamed
Applies if you use the old v1.Resource* types.

Source ↗

Aug 21, 2026 – May 21, 2026Older →

Browse by month