Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Kubescapev4.0.12SecurityAug 12, 2026

ACTION 3CHECK 3OTHER 220View full analysis

A corrective and performance-focused release with operator-visible default and constraint changes, deprecated flag removal, and dependency vulnerability fixes. It also expands scanning, output, registry, and MCP capabilities.

Action needed (3)

securityBatch dependency vulnerability fixes
Batch 1 and 2 dependency vulnerability fixes are included in this release.
breakingRegoV1 evaluation and v0 compatibility shim removal
Rego evaluation now uses RegoV1 and drops the v0 compatibility shim in this release.
breakingLoopback-only constraint
A loopback-only constraint is applied in this release.

Check if affected (3)

breakingOpt-in pprof debug server
Applies if you enable the pprof debug server.
breaking--frameworks default set to all
Applies if you do not configure --frameworks.
breakingDeprecated flags removal
Applies if you configure deprecated flags.

Source ↗

Open Policy Agent (OPA)v1.19.0SecurityJul 30, 2026

ACTION 3CHECK 2OTHER 36View full analysis

A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.

Action needed (3)

securityhighoras.land/oras-go/v2 update for GHSA-fxhp-mv3v-67qp
oras.land/oras-go/v2 is updated from 2.6.1 to 2.6.2 to address GHSA-fxhp-mv3v-67qp.
breakingReadHeaderTimeout default
All HTTP servers now set ReadHeaderTimeout to 32s.
breakingPartial set and -object rule name conflicts
The AST rejects partial set and -object rules that share a name.

Check if affected (2)

securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
breakingStricter := safety checking
Applicability is not stated in the release notes.

Source ↗

SPIREv1.15.2SecurityJul 9, 2026

ACTION 2CHECK 1OTHER 32View full analysis

A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.

Action needed (2)

securityMigration from github.com/docker/docker to github.com/moby/moby
Dependencies from github.com/docker/docker were migrated to their github.com/moby/moby equivalents to resolve CVEs. The migration ships in this release.
breakingRPC metrics from agent health check loopback calls
Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.

Check if affected (1)

breakingJWT-SVID serving by the delegated API
Applies if you use the delegated API for admin or downstream entries.

Source ↗

Falco0.44.0SecurityMay 26, 2026

ACTION 1CHECK 5OTHER 34View full analysis

A release that removes several supported engines and outputs and restricts falco-webui access. It also adds rule and configuration capabilities, includes defect fixes and dependency updates, and discloses no security advisory.

Action needed (1)

breakinggRPC server support, removed
gRPC server support is removed in this release.

Check if affected (5)

securityPlugin library path traversal prevention
Applies if you configure the plugin library path.
breakingThe gRPC output, removed
Applies if you use the gRPC output.
breakingThe gVisor engine, removed
Applies if you use the gVisor engine.
+ 2 more on the release page

Source ↗

Open Policy Agent (OPA)v1.16.0SecurityApr 30, 2026

ACTION 1OTHER 38View full analysis

OPA v1.16.0 adds URI built-ins, Data API metadata support, testing and WASM capabilities, along with broader Rego and schema support. It also changes formatting, logging, server, TLS, socket, storage, and dependency behavior, but includes a shutdown regression, so users should skip v1.16.0 and upgrade directly to v1.16.1.

Action needed (1)

breakingHTML index page query form removed
OPA v1.16.0 drops the HTML index page query form.

Source ↗

Keycloak26.6.0SecurityApr 8, 2026

ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

securityWorkflows admin permission boundaries
Applies if you use Workflows.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
+ 4 more on the release page

Plan ahead (1)

deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.

Source ↗

OpenFGAv1.12.0SecurityMar 13, 2026

ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

securityhighGo toolchain version 1.25.8
The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.

Source ↗

cert-managerv1.20.0SecurityMar 10, 2026

ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
+ 1 more on the release page

Source ↗

OpenFGAv1.11.3SecurityJan 28, 2026

ACTION 2OTHER 9View full analysis

This release adds configuration and observability capabilities while changing throttling and metric behavior. It also fixes correctness defects, including a described improper policy enforcement issue.

Action needed (2)

securitymediumThe CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9 policy enforcement fix
The release fixes improper policy enforcement associated with CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9.
breakingThe custom grpc_code metric label, removed
The custom grpc_prometheus fork is replaced with go-grpc-middleware's provider, and the custom grpc_code label is removed from the metric.

Source ↗

Browse by month