AI-analyzed release notes for CNCF graduated and incubating projects.
wasmCloud v2.7.0 adds runtime, networking, plugin, TLS, and chart capabilities while correcting runtime and Helm/chart defects. It also changes defaults and updates dependencies.
Action needed (1)
breakingDefault-enabled implements and maps
implements and maps are enabled by default in wasmCloud v2.7.0.
A mixed maintenance and feature release with workload-affinity and anti-affinity support, encryption-at-rest capabilities, bug fixes, and updates to dependencies and default images. It also changes operational defaults and validation while deprecating or removing configuration flags and fields, so compatibility and configuration changes are part of the release.
Action needed (1)
breakingControllerPriorityQueue promotion to beta and default enablement
ControllerPriorityQueue is promoted to beta and enabled by default.
Check if affected (4)
breakingThe --etcd-init-image flag, removed from karmadactl init
Applies if you use the --etcd-init-image flag.
breakingnamespace validation for spec.
Applies if you use PropagationPolicy or OverridePolicy.
breakingDistinct GroupByLabelKey values in WorkloadAffinity
Applies if you configure WorkloadAffinity.
Plan ahead (2)
deprecatedEtcd. deprecationdeprecated since v1.17.0 · removal date not announced
Applies if you configure Etcd. in Karmada Init Configuration.
deprecatedDeprecation of cluster lease flagsdeprecated since v1.17.0 · removal date not announced
Applies if you use --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
A feature and maintenance release that adds runtime, plugin, service, component, and pooling capabilities while changing the default NATS behavior. It also includes dependency updates and fixes for runtime and observability defects.
Action needed (1)
breakingThe NATS consumer-group default
NATS now uses consumer groups by default in the release.
A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.
Action needed (3)
securitymediumgithub. updated for CVE-2025-69725
github. is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo. and github. updates
go. is updated to v1.17.7, and the github. dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.
A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.
Action needed (8)
securitymediumThe golang. dependency update for GO-2026-4962
golang. is updated to v0.39.0 for GO-2026-4962.
securityThe durabletask-go and pgx dependency updates
durabletask-go is updated to v0.12.1, and pgx is updated as part of the vulnerability fixes.
breakingThe WorkflowsRemoteActivityReminder default, enabled
WorkflowsRemoteActivityReminder is enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.
breakingThe HotReload default, enabled
HotReload is enabled by default for Components, Subscriptions, MCPServers, Configurations, HTTPEndpoints, Resiliencies, and WorkflowAccessPolicies.
breakingSidecar probe defaults
Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.
breakingThe HotReload default, enabled in v1.18
HotReload is enabled by default in v1.18.
breakingLiveness and readiness probe defaults
The default liveness probe is widened, and the readiness probe default is tightened.
breakingChanged sidecar probe defaults
Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for daprd.
Check if affected (6)
securityService invocation path traversal ACL bypass fix
Applies if you use service invocation.
breakingThe MCPServerResource and WorkflowAccessPolicy feature gates, removed
Applies if you configure the MCPServerResource or WorkflowAccessPolicy feature gates.
breakingThe Sentry Ed25519 workload identity key rollback constraint
Applicability is not stated in the release notes.
Plan ahead (1)
deprecatedThe ScheduleJobAlpha1 alpha RPCs, deprecated
Applies if you use ScheduleJobAlpha1.
A feature and operational-hardening release that adds alpha scheduling capabilities, new scheduler and Helm configuration, and fixes scheduler and integration stability issues. Operators should review Kubernetes and DRA compatibility requirements, the changed DRA default, and the disclosed denial-of-service and Prometheus security fixes.
Action needed (4)
securitymediumPrometheus dependency update for GHSA-vffh-x6r8-xx99
Updates github. to address stored XSS advisory GHSA-vffh-x6r8-xx99.
securitymediumAdmission webhook request body limits
The admission webhook now limits request bodies, fixing the denial-of-service risk identified by CVE-2026-44247 and GHSA-8wxp-xxp2-rcgx.
breakingDRA scheduling integration default
DRA scheduling integration is enabled by default.
breakingDRA scheduling integration default behavior
DRA scheduling integration is enabled by default to align with Kubernetes 1.34 and later behavior. Set predicate. to false to disable it.
Check if affected (2)
breakingOpt-in SchedulingGatesQueueAdmission
Applies if you enable SchedulingGatesQueueAdmission.
breakingOpt-in gang-aware preemption and reclamation
Applies if you configure gangPreempt and gangReclaim and do not configure preempt or reclaim.
A maintenance release with correctness fixes for HTTP errors, NATS subscription readiness, and WorkloadDeployment readiness, plus dependency and toolchain updates. It removes canary-v2 now that canary exists and includes dependency cleanup.
Action needed (1)
breakingThe canary-v2 option, removed
canary-v2 is removed now that canary exists. The removal ships in this release.
A correctness-focused release also changes backend volume naming and removes permissions from the kubevirt. RBAC role. The RBAC change requires operator attention.
Action needed (1)
breakingThe kubevirt. RBAC role, with vnc and screenshot permissions removed
The vnc and screenshot permissions are removed from the kubevirt. RBAC role in this release.
This release adds Kubernetes-native service routing and related CRD fields, changes Helm behavior, fixes a NATS subscriber initialization race, and retires the runtime-gateway path. Operators using the deprecated gateway configuration need to account for the routing change and removed chart behavior.
Action needed (1)
breakingThe default chart tag is removed
The default tag is removed, so the chart uses chart.'s appVersion.
Check if affected (1)
breakingNative Kubernetes Service routing replaces runtime-gateway
Applies if you use runtime-gateway.
Plan ahead (1)
deprecatedThe Helm gateway section is deprecated
Applies if you configure gateway.
wasmCloud v2.0.0 adds operator-facing capabilities, changes CRD locations, updates dependencies, and fixes runtime and CLI behavior. The dependency update addresses the disclosed advisory RUSTSEC-2026-0007.
Action needed (2)
securitymediumLock file update for RUSTSEC-2026-0007
wasmCloud v2.0.0 updates the lock file to address RUSTSEC-2026-0007.
breakingCRD location moved from templates/crds to /crds
wasmCloud v2.0.0 moves CRDs from templates/crds to /crds.
A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.
Action needed (1)
breakingThe QuiesceFailed indication replaced by QuiesceTimeout
The QuiesceFailed indication was replaced with QuiesceTimeout.
This release changes NATS connection authentication and the component spec feature. Dependency and OCI image base updates are also included.
Action needed (1)
breakingThe component spec feature, removed
The component spec feature is removed in this release.
This release combines operator-facing additions with enforced defaults and restrictions, defect fixes, and dependency and image updates. New support includes native sidecar injection, ThinRuntime metadata configuration, and additional storage client types.
Action needed (1)
breakingRestricted service account permissions
Service account permissions are restricted. The sample file samples/juicefs/read_job. is included.
Check if affected (1)
breakingRemoval of the redundant SYS_ADMIN capability from runtime engines
Applies if you use runtime engines.
