AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with a security-driven Ceph upgrade recommendation and a disabled Rook manager module. It also adds or changes CephCluster and CephX error-reporting behavior.
Action needed (1)
breakingThe Rook manager module, disabled
The Rook manager module is disabled in this release.
Check if affected (1)
securityCeph upgrade recommendation for CVE-2025-30156
Applies if you use Ceph.
v2.5.0 adds operator-facing capabilities and changes download and proxy behavior. Deprecated API surface is removed and correctness issues are fixed; no security advisory is disclosed.
Action needed (1)
breakingHealth checks consolidated to /healthy
Health checks are consolidated to the /healthy endpoint in v2.5.0.
Check if affected (1)
breakingDeprecated V1 preheat API endpoints removed
Applies if you use the deprecated V1 preheat API endpoints.
A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.
Action needed (2)
breakingUnqualified * rejection after commas in SELECT lists
vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.
breakingBare * restriction in the sqlparser grammar
sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.
Check if affected (1)
breakingEmergencyReparentShard replication-stop error validation
Applies if you use EmergencyReparentShard.
A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.
Action needed (3)
securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.
Check if affected (12)
securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
Plan ahead (4)
deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
This release combines an operator defect correction with changes to operator capabilities, configuration, and dependency or image versions. It contains no security advisories or explicitly described security fixes.
Action needed (1)
breakingThe default COSI sidecar image version, updated
The default version of the COSI sidecar image is updated in the COSI component.
A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.
Action needed (2)
securityBearer token validation
Harbor rejects bearer tokens issued before project creation.
breakingPort 9443 removed from the webhook event check
Port 9443 is removed from the Harbor IP used for webhook event checks.
Check if affected (2)
breakingThe pull-through cache is replaced by proxy cache
Applies if you use pull-through cache in Harbor.
breakingGCR replication removal
Applies if you use GCR replication in Harbor.
A feature and maintenance release that expands configuration and scheduler capabilities while changing configuration controls and the priorities type. Dependency versions are updated, and no security advisories or explicitly described vulnerabilities are mentioned.
Action needed (1)
breakingThe priorities type, changed to int32
The priorities type changed from string to int32 in v2.4.2.
Check if affected (1)
breakingThe Enable flag, removed from seedPeer
Applies if you configure Enable.
A maintenance release with operator-facing removals, default and behavior changes, new CRD fields, expanded configuration support, and dependency updates. No security advisory is disclosed.
Action needed (1)
breakingNodes/proxy RBAC enablement removal
The unnecessary nodes/proxy RBAC enablement is removed.
Check if affected (2)
breakingDefault Ceph image pull policy
Applies if you do not configure ceph image pull policy.
breakingAutomated node fencing code removal
Applies if automated node fencing runs.
