AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with correctness fixes for HTTP errors, NATS subscription readiness, and WorkloadDeployment readiness, plus dependency and toolchain updates. It removes canary-v2 now that canary exists and includes dependency cleanup.
Action needed (1)
breakingThe canary-v2 option, removed
canary-v2 is removed now that canary exists. The removal ships in this release.
v1.17.2 contains correctness fixes and a security-related Alpine base-image dependency update. The alpine update requires upgrading to receive the new base image.
Action needed (1)
securityThe alpine base image, updated to alpine:3.
The base image alpine has been updated from alpine:3. to alpine:3. to address security concerns. The update ships in v1.17.2.
A maintenance release includes corrected operator and scheduler behavior, along with an updated Alpine base image. The Alpine update addresses security concerns.
Action needed (1)
securityThe alpine base image, updated
The base image alpine was updated from alpine:3. to alpine:3. to address security concerns. The update ships in the release.
This release adds the Val map type, Linux glibc GPU builds, and updates to wasmtime and its rustls dependency. It also corrects pooling allocator probing and includes a security update for rustls-webpki.
Action needed (1)
securityrustls-webpki security update, RUSTSEC-2026-0049
The release includes a security update for rustls-webpki, addressing RUSTSEC-2026-0049.
This release updates the Go toolchain in Crossplane to 1.. The change addresses undisclosed standard-library CVEs.
Action needed (1)
securityThe Go toolchain, updated to 1.
Crossplane v1.20.7 updates the Go toolchain to 1.. The update addresses undisclosed standard-library CVEs.
A correctness-focused release also changes backend volume naming and removes permissions from the kubevirt. RBAC role. The RBAC change requires operator attention.
Action needed (1)
breakingThe kubevirt. RBAC role, with vnc and screenshot permissions removed
The vnc and screenshot permissions are removed from the kubevirt. RBAC role in this release.
Crossplane v2.2.1 includes security-focused dependency updates and a move to Go 1.25.9. It also corrects operator-facing behavior around dependency upgrades with ImageConfig prefix rewrites and resource selectors, and bumps Crossplane Runtime to v2.2.1.
Action needed (10)
securityThe github. module, updated to v1.6.3
Crossplane v2.2.1 updates the github. module to v1.6.3 as a security dependency change.
securityThe go. module, updated to v1.43.0
Crossplane v2.2.1 updates the go. module to v1.43.0 as a security dependency change.
securityThe github. module, updated to v4.1.4
Crossplane v2.2.1 updates the github. module to v4.1.4 as a security dependency change.
securityThe github. module, updated to v3.0.5
Crossplane v2.2.1 updates the github. module to v3.0.5 as a security dependency change.
securityThe github. module, updated to v5.17.1
Crossplane v2.2.1 updates the github. module to v5.17.1 as a security dependency change.
securityThe github. module, updated to v29.2.0+incompatible
Crossplane v2.2.1 updates the github. module to v29.2.0+incompatible as a security dependency change.
securityGo 1.25.9
Crossplane v2.2.1 updates Go to 1.25.9 as a security dependency change.
securityThe github. module, updated to v0.5.1
Crossplane v2.2.1 updates the github. module to v0.5.1 as a security dependency change.
securityThe github. module, updated to v2.0.6
Crossplane v2.2.1 updates the github. module to v2.0.6 as a security dependency change.
securityThe github. module, updated to v5.18.0
Crossplane v2.2.1 updates the github. module to v5.18.0 as a security dependency change.
Crossplane v2.1.5 combines correctness fixes with dependency and Go toolchain updates. The release includes updated versions of several modules used by Crossplane.
Action needed (10)
securityThe github. module, updated to v1.6.3
Crossplane v2.1.5 updates the github. module to v1.6.3.
securityThe google. module, updated to v1.79.3
Crossplane v2.1.5 updates the google. module to v1.79.3.
securityThe go. module, updated to v1.43.0
Crossplane v2.1.5 updates the go. module to v1.43.0.
securityThe github. module, updated to v4.1.4
Crossplane v2.1.5 updates the github. module to v4.1.4.
securityThe Go toolchain, updated to 1.25.9
Crossplane v2.1.5 updates the Go toolchain to 1.25.9.
securityThe github. module, updated to v5.17.1
Crossplane v2.1.5 updates the github. module to v5.17.1.
securityThe github. module, updated to v0.5.1
Crossplane v2.1.5 updates the github. module to v0.5.1.
securityThe github. module, updated to v2.0.6
Crossplane v2.1.5 updates the github. module to v2.0.6.
securityThe github. module, updated to v29.2.0+incompatible
Crossplane v2.1.5 updates the github. module to v29.2.0+incompatible.
securityThe github. module, updated to v5.18.0
Crossplane v2.1.5 updates the github. module to v5.18.0.
Crossplane v2.0.8 corrects two operator-visible defects and updates Go plus several dependencies. The dependency changes are marked for security, but the disclosures identify only the affected components rather than specific advisory IDs.
Action needed (9)
securityThe github. module update
The github. module is updated to v1. in Crossplane v2.0.8.
securityThe OTLP HTTP trace exporter module update
The go. module is updated to v1. in Crossplane v2.0.8.
securityThe github. module update
The github. module is updated to v4. in Crossplane v2.0.8.
securityThe Go version update to 1.
Go is updated to 1. in Crossplane v2.0.8.
securityThe github. module update to v5.
The github. module is updated to v5. in Crossplane v2.0.8.
securityThe github. module update
The github. module is updated to v0. in Crossplane v2.0.8.
securityThe github. module update
The github. module is updated to v29. in Crossplane v2.0.8.
securityThe github. module update
The github. module is updated to v2. in Crossplane v2.0.8.
securityThe github. module update to v5.
The github. module is updated to v5. in Crossplane v2.0.8.
Crossplane v1. is a dependency-focused release with updates to several Go modules, including security-marked changes. It also includes an update to crossplane-runtime v1..
Action needed (5)
securityThe github. module, updated to v1.
The github. module is updated to v1. in Crossplane v1.. The release note marks this dependency update as security-related.
securityThe go. module, updated to v1.
The go. module is updated to v1. in Crossplane v1.. The release note marks this dependency update as security-related.
securityThe github. module, updated to v5.
The github. module is updated to v5. in Crossplane v1.. The release note marks this dependency update as security-related.
securityThe github. module, updated to v0.
The github. module is updated to v0. in Crossplane v1.. The release note marks this dependency update as security-related.
securityThe github. module, updated to v5.
The github. module is updated to v5. in Crossplane v1.. The release note marks this dependency update as security-related.
This is a security-focused maintenance release. It corrects a service-invocation ACL mismatch caused by path normalization and updates Go to v1. for CVE coverage.
Action needed (2)
securityNormalized service-invocation ACL and outbound dispatch paths
The normalized path form is used for both the ACL check and outbound dispatch, removing the mismatch in service invocation.
securityThe Go dependency, updated to v1.
The Go dependency is updated to v1. to address CVEs affecting the 1.24 line.
This release contains a security fix for service-invocation access-control policy handling. It aligns method-path normalization for ACL checks and outbound dispatch, which concerns operators using these policies.
Action needed (1)
securityService-invocation ACL path normalization
In Dapr v1.17.5, the normalized method path is used for both the service-invocation ACL check and outbound dispatch, eliminating the mismatch that caused the bypass.
A security-focused release fixes a service-invocation ACL bypass caused by inconsistent path normalization. It also rejects dangerous method-path characters, removes the purell dependency from ACL path handling, and applies additional path cleaning in constructRequest.
Action needed (3)
securityConsistent service-invocation method path normalization
Method paths are normalized at the service invocation edge for HTTP and gRPC public API calls, gRPC internal calls, and proxied calls. The normalized form is used for both the ACL check and outbound dispatch.
securityStricter method path validation
Normalization uses path. to resolve . segments and duplicate slashes. Method paths containing #, ?, null bytes, or control characters are rejected.
securityThe purell dependency, removed from the ACL path
The purell dependency has been removed from ACL path handling.
Dapr v1.16.13 includes a security-relevant Go dependency update and correctness fixes. The release also changes scheduler reliability and Pulsar pub/sub processing behavior.
Action needed (1)
securityThe Go version update
The Go version is updated from 1. to 1. in v1.16.13.
Check if affected (1)
breakingprocessMode initialization validation
Applies if you configure processMode.
This release adds Kubernetes-native service routing and related CRD fields, changes Helm behavior, fixes a NATS subscriber initialization race, and retires the runtime-gateway path. Operators using the deprecated gateway configuration need to account for the routing change and removed chart behavior.
Action needed (1)
breakingThe default chart tag is removed
The default tag is removed, so the chart uses chart.'s appVersion.
Check if affected (1)
breakingNative Kubernetes Service routing replaces runtime-gateway
Applies if you use runtime-gateway.
Plan ahead (1)
deprecatedThe Helm gateway section is deprecated
Applies if you configure gateway.
This release contains operator-relevant correctness fixes across messaging, workflows, HTTP proxying, placement, and scheduling. It also updates the Go toolchain across the repository and its Docker images.
Action needed (1)
securityThe Go toolchain, updated to 1.25.9
The Go toolchain was upgraded from 1.25.8 to 1.25.9 across all modules and Docker images in the repository.
A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.
Action needed (1)
securitycriticalThe google. dependency and CVE-2026-33186 resolution
The affected google. dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.
Check if affected (2)
breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
breakingStructural validation for . topics
Applies if you configure ..
Dapr v1.17.3 is a maintenance release with two dependency upgrades that resolve reported CVEs. It also includes correctness fixes for actor and service responses, placement dissemination, reconnect behavior, Scheduler participation, metrics, and Windows sidecar startup.
Action needed (2)
securitycriticalThe google. dependency, updated for CVE-2026-33186
The google. dependency is upgraded in this release to resolve CVE-2026-33186.
securitymediumThe golang. dependency, updated for CVE-2026-33809
This release upgrades golang. from v0.25.0 to v0.38.0, resolving CVE-2026-33809.
This release updates the Go toolchain and corrects Scheduler and container defects. The recorded Scheduler and Windows fixes require only an upgrade, with no operator configuration changes stated.
Action needed (1)
securityThe Go version, updated to 1.25.8
Dapr v1.16.11 updates the Go toolchain from 1.25.7 to 1.25.8.
wasmCloud v2.0.0 adds operator-facing capabilities, changes CRD locations, updates dependencies, and fixes runtime and CLI behavior. The dependency update addresses the disclosed advisory RUSTSEC-2026-0007.
Action needed (2)
securitymediumLock file update for RUSTSEC-2026-0007
wasmCloud v2.0.0 updates the lock file to address RUSTSEC-2026-0007.
breakingCRD location moved from templates/crds to /crds
wasmCloud v2.0.0 moves CRDs from templates/crds to /crds.
A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.
Action needed (3)
securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os. root boundaries
os. can no longer escape from a Root to access files outside the intended directory boundary.
Check if affected (2)
securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.
A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.
Action needed (1)
breakingThe QuiesceFailed indication replaced by QuiesceTimeout
The QuiesceFailed indication was replaced with QuiesceTimeout.
A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.
Action needed (1)
securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.
Check if affected (2)
breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.
This release focuses on dependency maintenance, including a security-related Go update, along with a grace-period behavior change. No operator setup changes are explicitly required beyond upgrading to obtain the security fix.
Action needed (1)
securityGo dependency updates for CVE remediation
The release updates go and its dependencies to address CVEs. The change ships in operator-framework v1.42.1.
This release corrects Avro publishing and WASM component registration defects, improves Avro publishing performance, and updates the Go and OpenTelemetry SDK dependencies. The Go update includes security fixes, while the OpenTelemetry update is presented without a disclosed security issue.
Action needed (1)
securityThe Go 1. update
Go 1. ships security fixes for the go command and crypto/tls package, plus compiler and crypto/x509 bug fixes.
A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.
Action needed (9)
securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang. dependency, updated
The golang. dependency is bumped.
securityThe github. dependency, updated
The github. dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github. dependency, updated
The github. dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.
Check if affected (3)
securityPlacement authorization for Dapr actor types
Applies if you use Placement.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.
Plan ahead (2)
deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1., BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.
A release with breaking changes to package installation and package-cache side-loading, alongside new operator capabilities and ordinary defect corrections. It also includes security-tagged dependency updates, but no advisory identifiers or vulnerability details are provided.
Action needed (7)
securitySecurity update for golang.
The golang. module was updated to v0. as a security update.
securitySecurity update for github.
The github. module was updated to v5. as a security update.
securitySecurity update for github.
The github. module was updated to v3. as a security update.
securitySecurity update for github.
The github. module was updated to v2. as a security update.
securitySecurity update for github.
The github. module was updated to v1. as a security update.
securitySecurity update for github.
The github. module was updated to v1. as a security update.
securitySecurity update for github.
The github. module was updated to v0. as a security update.
Check if affected (2)
breakingInput CRD installation from Function packages
Applies if you use Function packages and Input CRDs.
breakingPackage cache structure
Applicability is not stated in the release notes.
This release includes a Go toolchain dependency upgrade and a corrected Pulsar PubSub subscription-metadata defect. A regression test verifies that metadata is applied to consumer options.
Action needed (1)
securityhighThe Go toolchain upgrade to 1.
Dapr v1. upgrades Go to 1.. The upgrade addresses advisories GO-2026-4340 and GO-2026-4341.
This release changes NATS connection authentication and the component spec feature. Dependency and OCI image base updates are also included.
Action needed (1)
breakingThe component spec feature, removed
The component spec feature is removed in this release.
Crossplane v2.1.4 is a maintenance release with security-related dependency updates. It also includes corrections for shared transitive dependency upgrades, so the release concerns operators tracking dependency and security fixes.
Action needed (4)
securityThe github. module, updated to v0.
The release updates the github. module to v0. as a security-related dependency change.
securitysigstore dependency updates for CVEs
The release updates sigstore dependencies to fix CVEs.
securityThe github. module, updated to v2.
The release updates the github. module to v2. as a security-related dependency change.
securityThe github. module, updated to v5.
The release updates the github. module to v5. as a security-related dependency change.
This release updates a security-related dependency and corrects shared transitive dependency upgrades. It also fixes propagation of composite identity through nested XR trees.
Action needed (1)
securityThe github. dependency, updated to v2.
The github. module is updated to v2. in the release-2. branch.
Crossplane v1.20.5 is a maintenance release focused on dependency updates. It includes a security-related update to sigstore dependencies and addresses a defect in shared transitive dependency upgrades.
Action needed (1)
securityThe sigstore dependencies, updated for CVE fixes
The release-1. branch updates sigstore dependencies to fix CVEs.
This release combines operator-facing additions with enforced defaults and restrictions, defect fixes, and dependency and image updates. New support includes native sidecar injection, ThinRuntime metadata configuration, and additional storage client types.
Action needed (1)
breakingRestricted service account permissions
Service account permissions are restricted. The sample file samples/juicefs/read_job. is included.
Check if affected (1)
breakingRemoval of the redundant SYS_ADMIN capability from runtime engines
Applies if you use runtime engines.
