RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Mar 2026Clear ×
NATSv2.12.6Networking & MessagingMar 24, 2026
ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

  • breakingJWT size limit

    JWTs now have a 1MB size limit.

Check if affected (13)

  • securityhighMQTT security fixes

    Applies if you use MQTT.

  • securityhighLeafnode security fix

    Applies if you use leafnodes.

  • securityhighCommand-line credential security fix

    Applies if you provide credentials on the command line.

  • + 10 more on the release page
Source ↗
NATSv2.11.15Networking & MessagingMar 24, 2026
ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

  • breakingThe JWT size limit

    JWTs now have a 1MB size limit.

Check if affected (11)

Source ↗
wasmCloudv2.0.0Orchestration & ManagementMar 22, 2026
ACTION 2OTHER 8View full analysis

wasmCloud v2.0.0 adds operator-facing capabilities, changes CRD locations, updates dependencies, and fixes runtime and CLI behavior. The dependency update addresses the disclosed advisory RUSTSEC-2026-0007.

Action needed (2)

  • securitymediumLock file update for RUSTSEC-2026-0007

    wasmCloud v2.0.0 updates the lock file to address RUSTSEC-2026-0007.

  • breakingCRD location moved from templates/crds to /crds

    wasmCloud v2.0.0 moves CRDs from templates/crds to /crds.

Source ↗
Kubeflow26.03AI & MLMar 22, 2026
ACTION 1CHECK 1OTHER 18View full analysis

This release updates supported Kubernetes and pod-security configurations, installation behavior, and bundled component versions. The main operator-facing changes are the Kubernetes 1.34+ requirement and the baseline pod-security enforcement default, alongside fixes and new capabilities.

Action needed (1)

  • breakingBaseline pod security enforcement

    Pod security enforcement changes to the baseline level in this release.

Check if affected (1)

  • breakingKubernetes 1.34+ requirement

    Applies if you use Kubernetes 1.34+.

Source ↗
Harborv2.15.0Storage & DataMar 20, 2026
ACTION 2CHECK 2OTHER 72View full analysis

A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.

Action needed (2)

  • securityBearer token validation

    Harbor rejects bearer tokens issued before project creation.

  • breakingPort 9443 removed from the webhook event check

    Port 9443 is removed from the Harbor IP used for webhook event checks.

Check if affected (2)

  • breakingThe pull-through cache is replaced by proxy cache

    Applies if you use pull-through cache in Harbor.

  • breakingGCR replication removal

    Applies if you use GCR replication in Harbor.

Source ↗
KubeVirtv1.7.2Orchestration & ManagementMar 16, 2026
ACTION 1OTHER 7View full analysis

A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.

Action needed (1)

  • breakingThe QuiesceFailed indication replaced by QuiesceTimeout

    The QuiesceFailed indication was replaced with QuiesceTimeout.

Source ↗
KServev0.17.0AI & MLMar 13, 2026
ACTION 13CHECK 6OTHER 91View full analysis

An operator release with expanded configuration and LLMInferenceService capabilities, plus chart and dependency updates, behavior changes, removals, and defect corrections. It also includes security fixes for operators to review.

Action needed (13)

  • securitycriticalh11 malformed-body fix for CVE-2025-43859

    h11 malformed-body handling associated with CVE-2025-43859 is addressed in this release.

  • securityhighstarlette version 0.49.1

    starlette is pinned to version 0.49.1 to fix CVE-2025-62727 in this release.

  • securityhighlightgbm version 4.6.0

    lightgbm is updated to version 4.6.0 for CVE-2024-43598 in this release.

  • securityhighCVE-2025-66418 decompression-chain fix

    The unbounded number of links in the decompression chain associated with CVE-2025-66418 is addressed in this release.

  • securityhighexpr-lang/expr version v1.17.7

    expr-lang/expr is updated to v1.17.7 to fix CVE-2025-68156 in this release.

  • securityhighcryptography fix for CVE-2026-26007

    The cryptography issue associated with CVE-2026-26007 is addressed in this release.

  • securityhighpython-multipart fix for CVE-2026-24486

    The arbitrary file write issue in python-multipart associated with CVE-2026-24486 is addressed in this release.

  • securitymediumFixes for CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181

    This release addresses CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181.

  • securityhttps.go path traversal prevention

    The path traversal issue in https.go is prevented in this release.

  • securitySeveral CVE fixes

    This release addresses several CVEs.

  • securityAIOHTTP HTTP Parser auto_decompress fix

    The AIOHTTP HTTP Parser auto_decompress feature issue involving zip bombs is addressed in this release.

  • securityextractTarFiles path traversal fix

    The path traversal vulnerability in extractTarFiles is addressed in this release.

  • breakingminio replacement with seaweedfs

    minio is replaced with seaweedfs in this release.

Check if affected (6)

  • breakinginferenceservice CRD cert-manager annotation removal

    Applies if you use the inferenceservice CRD.

  • breakingPython 3.9 support removal

    Applies if you run Python 3.9.

  • breakingDeprecated --disable-log-requests flag removal

    Applies if you configure --disable-log-requests.

  • + 3 more on the release page
Source ↗
OpenFGAv1.12.0SecurityMar 13, 2026
ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

  • securityhighGo toolchain version 1.25.8

    The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.

  • breakingStricter tuple string validation

    Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

  • breakingThe pipeline_list_objects experimental default

    Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.

Source ↗
cert-managerv1.20.0SecurityMar 10, 2026
ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

  • securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729

    Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.

  • breakingIssuer reference kind and group defaults, reverted

    The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

  • securityPotential cert-manager controller panic from cached DNS responses

    Applicability is not stated in the release notes.

  • breakingThe OtherNames feature, enabled by default

    Applies if you use the OtherNames feature.

  • breakingDefault container user and group IDs

    Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).

  • + 1 more on the release page
Source ↗
Dragonflyv2.4.2Storage & DataMar 9, 2026
ACTION 1CHECK 1OTHER 19View full analysis

A feature and maintenance release that expands configuration and scheduler capabilities while changing configuration controls and the priorities type. Dependency versions are updated, and no security advisories or explicitly described vulnerabilities are mentioned.

Action needed (1)

  • breakingThe priorities type, changed to int32

    The priorities type changed from string to int32 in v2.4.2.

Check if affected (1)

  • breakingThe Enable flag, removed from seedPeer

    Applies if you configure Enable.

Source ↗
Jaegerv2.16.0ObservabilityMar 7, 2026
ACTION 1CHECK 2OTHER 5View full analysis

A release with breaking configuration and API changes, a Go 1.25.7 requirement, new capabilities, and bug and performance fixes. No security advisories or security-specific fixes are identified.

Action needed (1)

  • breakingGo 1.25.7 requirement

    The codebase now requires Go 1.25.7, with Go version consistency enforced across the codebase.

Check if affected (2)

  • breakingLegacy response format of the remote sampling endpoint, removed

    Applies if you use the remote sampling endpoint.

  • breakingtraces.topic renamed to traces.topics

    Applies if you configure traces.topic.

Source ↗
Strimzi0.51.0Networking & MessagingMar 6, 2026
ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

  • securityhighCVE-2026-27133 and CVE-2026-27134 security fixes

    Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.

  • breakingThe ServerSideApplyPhase1 feature gate default

    The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

  • breakingKubernetes version support

    Applies if you use Kubernetes 1.27, 1.28, or 1.29.

  • breakingKafka 4.0.0 and 4.0.1 support

    Applies if you use Kafka 4.0.0 or 4.0.1.

Plan ahead (1)

  • deprecatedThe ingress listener type deprecation

    Applies if you configure the ingress listener type.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023