Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

May 2026Clear ×

Prometheusv3.12.0ObservabilityMay 28, 2026

ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

breakingConcurrent fgprof profile rejection
The API rejects concurrent fgprof profiles.

Check if affected (3)

securityRemote Write decoded-length constraint
Applies if you use Remote Write.
securityPlaintext secret exposure in STACKIT SD
Applies if you use STACKIT SD.
breakingDecompressed body-size limit for OTLP write requests
Applies if you use OTLP.

Source ↗

Falco0.44.0SecurityMay 26, 2026

ACTION 1CHECK 5OTHER 34View full analysis

A release that removes several supported engines and outputs and restricts falco-webui access. It also adds rule and configuration capabilities, includes defect fixes and dependency updates, and discloses no security advisory.

Action needed (1)

breakinggRPC server support, removed
gRPC server support is removed in this release.

Check if affected (5)

securityPlugin library path traversal prevention
Applies if you configure the plugin library path.
breakingThe gRPC output, removed
Applies if you use the gRPC output.
breakingThe gVisor engine, removed
Applies if you use the gVisor engine.
+ 2 more on the release page

Source ↗

Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026

ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

securityModule Federation packages at v2.3.3
Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
+ 6 more on the release page

Plan ahead (4)

deprecatedThe PolicyQueryUser.identity field, deprecated
Applies if you use PolicyQueryUser.identity.
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated
Applies if you configure catalog.stitchingStrategy.mode.
+ 1 more on the release page

Source ↗

Istio1.30.0Networking & MessagingMay 18, 2026

ACTION 1CHECK 1OTHER 33View full analysis

A feature release adds Gateway API, ambient-mode, telemetry, Helm, and operability capabilities. Authenticated XDS debug endpoints and the new default image registry are the changes most likely to affect deployment and operational configuration.

Action needed (1)

breakingDefault Istio image registry
The default registry for Istio images is now registry.istio.io.

Check if affected (1)

breakingAuthentication required for XDS debug endpoints
Applies if ENABLE_DEBUG_ENDPOINT_AUTH is set.

Source ↗

Linkerdedge-26.5.2Networking & MessagingMay 15, 2026

ACTION 2OTHER 32View full analysis

A release that changes the default sidecar mode and promotes native sidecars to GA. It also fixes correctness issues, adds configurable timestamp handling, addresses eleven disclosed CVEs, and updates numerous dependencies.

Action needed (2)

securityhighEleven disclosed CVEs, fixed
The release fixes eleven disclosed CVEs: CVE-2026-42501, CVE-2026-42499, CVE-2026-39836, CVE-2026-39826, CVE-2026-39825, CVE-2026-39823, CVE-2026-39820, CVE-2026-39819, CVE-2026-39817, CVE-2026-33814, and CVE-2026-33811.
breakingThe config.linkerd.io/proxy-enable-native-sidecar default, changed
The default sidecar mode changes through config.linkerd.io/proxy-enable-native-sidecar, making native sidecars the default.

Source ↗

Ciliumv1.19.4Networking & MessagingMay 13, 2026

ACTION 2CHECK 1OTHER 46View full analysis

A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github.com/moby/spdystream dependency.

Action needed (2)

securityThe github.com/moby/spdystream module update
The github.com/moby/spdystream module is updated to v0.5.1.
breakingService-label filtering for EndpointSlice watches
The loadbalancer/reflectors component filters EndpointSlice watches by service labels.

Check if affected (1)

breakingLabel filtering for EndpointSlices
Applies if you set --k8s-service-proxy-name.

Source ↗

Jaegerv2.18.0ObservabilityMay 13, 2026

ACTION 2OTHER 23View full analysis

A release with breaking removals, API and metric changes, bug corrections, and experimental capabilities. It also adds storage, MCP, UI, and tracing functionality, with no security advisories or security-specific fixes disclosed.

Action needed (2)

breakingThe min step api in metricstore, removed
The min step api was removed from metricstore in this release.
breakingThe non-standard health MCP tool, removed
The non-standard health MCP tool was removed from jaegermcp in this release.

Source ↗

metal3-iov0.13.0Provisioning & RuntimeMay 8, 2026

ACTION 1CHECK 3PLAN 1OTHER 40View full analysis

This release removes the iRMC driver and legacy vbmctl entrypoint, deprecates BMH.Spec.Firmware, and changes defaults and constraints. It also adds HostClaim and vbmctl capabilities, corrects bugs, and updates dependencies.

Action needed (1)

breakingManager TLS default set to unset
The manager TLS default is set back to unset in this release.

Check if affected (3)

breakingThe iRMC driver, removed
Applies if you use the iRMC driver.
breakingPreprovisioningImage required for deprovisioning
Applies if cleaning is enabled.
breakingThe legacy vbmctl entrypoint, removed
Applies if you use the legacy vbmctl entrypoint.

Plan ahead (1)

deprecatedThe BMH.Spec.Firmware field, deprecated
Applies if you configure BMH.Spec.Firmware.

Source ↗

Vitessv23.0.4Storage & DataMay 7, 2026

ACTION 2CHECK 1OTHER 27View full analysis

A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.

Action needed (2)

breakingUnqualified * rejection after commas in SELECT lists
vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.
breakingBare * restriction in the sqlparser grammar
sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.

Check if affected (1)

breakingEmergencyReparentShard replication-stop error validation
Applies if you use EmergencyReparentShard.

Source ↗

Argov3.4.1CI/CD & App DeliveryMay 6, 2026

ACTION 4CHECK 2OTHER 275View full analysis

A broad maintenance and feature release with correctness, performance, dependency, and operator-facing changes. Operators should review the cluster-version annotation format and changed defaults, while dependency updates include Kubernetes and Helm changes; no explicitly disclosed exploitable vulnerability or security advisory is identified.

Action needed (4)

securityThe k8s.io/kubernetes module, updated to v1.34.2
The k8s.io/kubernetes module is updated to v1.34.2 as a security-related dependency update.
securityThe helm dependency, updated to 3.19.4
The helm dependency is updated to 3.19.4 due to a CVE.
breakinggRPC service config DNS TXT lookups, disabled by default
gRPC service config DNS TXT lookups are disabled by default.
breakingThe appset resource status count, defaulted to 5000
The default appset resource status count is changed to 5000.

Check if affected (2)

breakingThe --client flag in the Helm version command, removed
Applies if you use --client.
breakingThe cluster-version annotation format, renamed
Applies if you use Application Sets with Cluster Generators and configure argocd.argoproj.io/auto-label-cluster-info.

Source ↗

CRI-Ov1.35.3Kubernetes CoreMay 5, 2026

ACTION 2OTHER 4View full analysis

A maintenance release that adds a runtime metric and a GOMAXPROCS configuration field, fixes two runtime defects, and reverts CNI monitoring after node bootstrapping regressions. It also updates the spdystream dependency to address CVE-2026-35469.

Action needed (2)

securityhighThe spdystream dependency update for CVE-2026-35469
The spdystream dependency is updated to address CVE-2026-35469. The update ships in this release.
breakingCRI-O CNI monitoring, reverted
CRI-O reverts CNI monitoring because it caused node bootstrapping regressions. The change ships in this release.

Source ↗

wasmCloudv2.0.6Orchestration & ManagementMay 1, 2026

ACTION 1OTHER 10View full analysis

A maintenance release with correctness fixes for HTTP errors, NATS subscription readiness, and WorkloadDeployment readiness, plus dependency and toolchain updates. It removes canary-v2 now that canary exists and includes dependency cleanup.

Action needed (1)

breakingThe canary-v2 option, removed
canary-v2 is removed now that canary exists. The removal ships in this release.

Source ↗

Browse by month