AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release focused on correctness fixes and dependency updates, with a small number of new extension points. It does not introduce broad operator-facing configuration changes.
Action needed (1)
breakingRemoval of the Ingress HostFW Policy between RevSNAT and RevDNAT
The BPF NodePort path removes the Ingress HostFW Policy between RevSNAT and RevDNAT.
A maintenance release focused on bug fixes, dependency updates, and image refreshes. It also removes a datapath behavior and includes security dependency fixes that may require operator attention.
Action needed (3)
securityThe google. module, updated to v1.83.1
The google. module is updated to v1.83.1 in this release as a security dependency fix.
securityThe google. module, updated to v1.83.2
The google. module is updated to v1.83.2 in this release as a security dependency fix.
breakingThe Ingress HostFW Policy between RevSNAT and RevDNAT, removed
The Ingress HostFW Policy between RevSNAT and RevDNAT is removed in this release.
A broad feature and maintenance release adds scaffolder recovery and credential controls, TechDocs, notification and streaming capabilities, and Kubernetes and authentication improvements. It also includes dependency and tooling security updates, a security fix, and compatibility changes that affect users of the listed resolvers, catalog integrations, MCP configuration, and task recovery.
Action needed (6)
securityModule Federation dependency updates for security
This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.
securityYarn tooling dependency updates for security
This release updates the Yarn tooling dependencies to versions that avoid known security vulnerabilities.
securityModule Federation security dependency update
This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.
securityOpenAPI generator tooling security update
This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.
securityOpenAPI generator tooling security update
This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.
breakingLocale-insensitive Unicode casing
String handling now uses locale-insensitive Unicode casing for consistent results across environments.
Check if affected (6)
securityKubernetes catalog cluster locator URL validation
Applies if you use the catalog cluster locator.
securityPull request workspace handling security fix
Applies if you use pull request workspace handling.
breakingGitHub user ID catalog lookup matching
Applies if you use GitHub user ID catalog lookups.
Plan ahead (1)
deprecatedGitHub username sign-in resolver deprecation
Applies if you use the GitHub username sign-in resolver.
A feature-rich release with breaking API and configuration changes, expanded experimental query and storage capabilities, and many correctness fixes. It also includes routine dependency updates.
Action needed (1)
breakingThe searchdepth constraint
Query handling caps searchdepth at 10000 and rejects negative values.
Check if affected (4)
breakingRemoval of the v1 http endpoints
Applies if you use v1 http endpoints.
breakingThe ai. configuration, replaced by ai.
Applies if you configure ai..
breakingElasticsearch configuration key validation
Applicability is not stated in the release notes.
A maintenance release with breaking removal of deprecated APIs alongside performance and correctness fixes. It also tightens feature-gate identifier validation and updates configuration schema handling.
Action needed (5)
breakingRemoval of deprecated AddScraper
The deprecated AddScraper function is removed from pkg/scraperhelper/controller.
breakingRemoval of deprecated ZapOptions
The deprecated ZapOptions configuration is removed from pkg/service.
breakingRemoval of deprecated WithForceUnmarshaler
The deprecated WithForceUnmarshaler function is removed from pkg/xconfmap.
breakingRemoval of deprecated DefaultMetricsBuilderConfig
The deprecated DefaultMetricsBuilderConfig function is removed from cmd/mdatagen.
breakingRemoval of deprecated LoggingOptions
The deprecated LoggingOptions configuration is removed from pkg/service.
Check if affected (2)
breakingRemoval of deprecated AggregationTemporality, Duration, and SetDuration
Applies if you use AggregationTemporality, Duration, or SetDuration.
breakingReplacement of deprecated configuration watcher APIs
Applies if you use extensioncapabilities., Extensions., or service..
A security-focused maintenance release with extensive Linux and OpenSSH vulnerability remediation, broad dependency updates, and platform and image changes. Operators should account for the dropped platform and image support and the new Vagrant 2.2.5 requirement.
Action needed (41)
securitycriticalcontainerd vulnerability remediation
containerd is updated with remediation for CVE-2026-47262, CVE-2026-50195, CVE-2026-53488, CVE-2026-53489, and CVE-2026-53492.
securitycriticalgo vulnerability remediation
go is updated with remediation for the listed vulnerabilities, including CVE-2025-61726, CVE-2025-61727, and CVE-2025-61728.
securityhighbind vulnerability remediation
bind is updated with remediation for CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677.
securityhighglib vulnerability remediation
glib is updated with remediation for CVE-2025-13601 and CVE-2025-14087.
securityhighglibc vulnerability remediation
glibc is updated with remediation for CVE-2025-15281, CVE-2026-0861, and CVE-2026-0915.
securityhighgnutls vulnerability remediation
gnutls is updated with remediation for the listed vulnerabilities, including CVE-2025-14831, CVE-2025-9820, and CVE-2026-1584.
securityhighincus vulnerability remediation
incus is updated with remediation for CVE-2026-23953.
securityhighlibtasn1 vulnerability remediation
libtasn1 is updated with remediation for CVE-2025-13151.
securityhighnvidia-drivers vulnerability remediation
nvidia-drivers is updated with remediation for the listed vulnerabilities, including CVE-2025-33219, CVE-2025-33221, and CVE-2026-24182.
securityhighpodman vulnerability remediation
podman is updated with remediation for CVE-2025-52881 and CVE-2025-9566.
securityhighsssd vulnerability remediation
sssd is updated with remediation for CVE-2025-11561 and CVE-2026-6245.
securityhighurllib3 vulnerability remediation
urllib3 is updated with remediation for CVE-2025-66418 and CVE-2025-66471.
securityhighopenssh vulnerability remediation
openssh is updated with remediation for CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, and CVE-2026-60002.
securitymediumc-ares vulnerability remediation
c-ares is updated with remediation for CVE-2025-62408.
securityhighcurl vulnerability remediation
curl is updated with remediation for CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079, CVE-2025-15224, CVE-2026-1965, CVE-2026-3783, CVE-2026-3784, and CVE-2026-3805.
securitymediumlibarchive vulnerability remediation
libarchive is updated with remediation for CVE-2025-60753 and CVE-2026-4426.
securitymediumlibxml2 vulnerability remediation
libxml2 is updated with remediation for CVE-2026-0989, CVE-2026-0990, CVE-2026-0992, and CVE-2026-1757.
securitymediumlibxslt vulnerability remediation
libxslt is updated with remediation for CVE-2025-10911 and CVE-2025-11731.
securitymediump11-kit vulnerability remediation
p11-kit is updated with remediation for CVE-2026-2100.
securityhighrsync vulnerability remediation
rsync is updated with remediation for the listed vulnerabilities, including CVE-2025-10158, CVE-2026-29518, and CVE-2026-41035.
securitymediumutil-linux vulnerability remediation
util-linux is updated with remediation for CVE-2025-14104 and CVE-2026-27456.
securitylowintel-microcode vulnerability remediation
intel-microcode is updated with remediation for CVE-2025-31648.
securitylowlibpcap vulnerability remediation
libpcap is updated with remediation for CVE-2025-11961 and CVE-2025-11964.
securitycriticalLinux vulnerability remediation
Linux is updated with remediation for the listed vulnerabilities, including CVE-2026-80888 and the other advisories recorded for this change.
securityhighbubblewrap vulnerability remediation
bubblewrap is updated with remediation for CVE-2026-41163.
securitymediumexpat vulnerability remediation
expat is updated with remediation for CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-41080, and CVE-2026-45186.
securityhighgnupg vulnerability remediation
gnupg is updated with remediation for CVE-2026-24881, CVE-2026-24882, and CVE-2026-24883.
securitymediumlibcap vulnerability remediation
libcap is updated with remediation for CVE-2026-4878.
securitymediumlibgcrypt vulnerability remediation
libgcrypt is updated with remediation for CVE-2026-41989.
securityhighopenssh vulnerability remediation
openssh is updated with remediation for CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, and CVE-2026-35414.
securitycriticalopenssl vulnerability remediation
openssl is updated with remediation for the listed vulnerabilities, including CVE-2026-2673, CVE-2026-28386, and CVE-2026-28387.
securitylowrunc vulnerability remediation
runc is updated with remediation for CVE-2026-41579.
securitymediumsystemd vulnerability remediation
systemd is updated with remediation for CVE-2026-40223, CVE-2026-40225, and CVE-2026-40226.
securitylowxz-utils vulnerability remediation
xz-utils is updated with remediation for CVE-2026-34743.
securitylowzlib vulnerability remediation
zlib is updated with remediation for CVE-2026-27171.
breakingEquinix Metal (Packet) support removal
Support for Equinix Metal (Packet) is dropped.
breakingRackspace support removal
Support for Rackspace, including OnMetal, is dropped.
breakingThe Oklo release codename, removed
The Oklo release codename is dropped.
breakingVMware "insecure" image removal
The VMware "insecure" image is dropped.
breakingVagrant VirtualBox image removal
The Vagrant VirtualBox image is dropped.
breakingVagrant 2.2.5 requirement
Vagrant 2.2.5 is now required.
A maintenance release focused on correctness and data-exposure fixes. It also includes security-related dependency updates and a stricter default for namespaced Vault authentication.
Action needed (6)
securityACME server response body limit
ACME server response bodies are capped at 16 MiB to prevent unbounded-body denial-of-service conditions.
securityChallenge. response disclosure fix
The ACME HTTP-01 self-check no longer copies the fetched response body into Challenge.. This prevents internal response contents reached through redirects from being disclosed.
securityGo 1.26.6
The release upgrades Go to 1.26.6, which includes security fixes in the Go command and several standard library packages.
securitygoogle. v1.83.2
The release updates google. to v1.83.2 to fix reported security vulnerabilities.
securitygolang. v0.56.0
The release updates golang. to v0.56.0 to fix reported security vulnerabilities.
breakingValidation for converted AdmissionReview requests
Validation now also applies to equivalent-converted AdmissionReview requests on non-v1 API versions. These requests could previously bypass validation.
Check if affected (1)
breakingNamespaced Vault issuer ambient credentials default
Applies if you use a namespaced Issuer with Vault AWS IAM authentication.
A maintenance release that enables gRPC capabilities and observability, broadens xDS matching, removes a WRR guard, and corrects proxy hostname handling. It also updates connection scaling service configuration and server listener matching.
Action needed (2)
breakingThe v2_non_owning_waker_implementation experiment enabled
The v2_non_owning_waker_implementation experiment is enabled in the promise-based filter.
breakingThe WRR custom backend metrics guard removed
The release removes the WRR environment-variable guard for custom backend metrics.
A feature release adding new Helm capabilities and output options, alongside correctness fixes and performance improvements. It also includes dependency updates with two disclosed security-related bumps.
Action needed (3)
securitycriticalgolang. update for GO-2026-5026
Helm updates golang. to v0. to address GO-2026-5026.
securitymediumgo. update for GO-2026-5158
Helm updates go. to v1. for GO-2026-5158.
breakingPer-file decompression size limit removal
Helm removes the per-file decompression size limit from file decompression.
Check if affected (1)
breakingOwnership verification before resource deletion
Applicability is not stated in the release notes.
A workflow-heavy maintenance release corrects reliability, state-management, signing, and pub/sub delivery defects. It also changes binary gRPC metadata filtering for output bindings, with no newly announced operator configuration requirements.
Action needed (1)
breakingBinary gRPC metadata propagation in InvokeBinding, removed
Binary gRPC metadata with keys ending in -bin is no longer copied from incoming gRPC calls into output binding component metadata for InvokeBinding.
A feature release that adds plugin, runtime, concurrency, and observability capabilities. It also corrects runtime defects and enforces guest-memory limits.
Action needed (1)
breakingThe max-guest-memory limit is enforced
This release enforces the max-guest-memory limit.
Plan ahead (1)
deprecatedThe deprecated --enable-meters flag alias
A feature-rich release with breaking changes, new controllers, and expanded provisioning capabilities. It also includes correctness fixes and broad dependency updates.
Action needed (1)
breakingThe separate TryInit call, removed
Provisioner no longer makes a separate TryInit call in this release.
Plan ahead (1)
deprecatedThe BMH Taints field, deprecated
A maintenance release updates the proxy and dependencies, fixes destination behavior, and tightens multicluster credential and Link resource handling. The changes concern proxy, destination, and multicluster components, alongside routine dependency updates.
Action needed (2)
breakingCluster credential secrets and the exec auth provider
Cluster credential secrets created by linkerd multicluster link use the token auth provider. The exec auth provider is disallowed because it is not used or necessary.
breakingLink resource lookup scope
Link resource lookups are restricted to the linkerd-multicluster namespace.
A maintenance release with correctness fixes and dependency updates. The /debug/vrlog removal and newly enforced safety limits affect operators using those paths.
Action needed (2)
breakingRecursion-depth limit on the streaming recursive CTE path
A recursion-depth limit is enforced on the streaming recursive CTE path.
breakingStored-procedure safety checks on the streaming CALL path
Stored-procedure safety checks are enforced on the streaming CALL path.
Check if affected (1)
breakingThe /debug/vrlog endpoint, removed
Applies if you use /debug/vrlog.
Plan ahead (1)
deprecatedThe --vreplication-enable-http-log flag, deprecatedremoval planned in v26
Applies if you configure --vreplication-enable-http-log.
