RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Vitessv23.0.4Storage & DataMay 7, 2026
ACTION 2CHECK 1OTHER 27View full analysis

A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.

Action needed (2)

  • breakingUnqualified * rejection after commas in SELECT lists

    vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.

  • breakingBare * restriction in the sqlparser grammar

    sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.

Check if affected (1)

  • breakingEmergencyReparentShard replication-stop error validation

    Applies if you use EmergencyReparentShard.

Source ↗
Argov3.4.1CI/CD & App DeliveryMay 6, 2026
ACTION 4CHECK 2OTHER 275View full analysis

A broad maintenance and feature release with correctness, performance, dependency, and operator-facing changes. Operators should review the cluster-version annotation format and changed defaults, while dependency updates include Kubernetes and Helm changes; no explicitly disclosed exploitable vulnerability or security advisory is identified.

Action needed (4)

  • securityThe k8s.io/kubernetes module, updated to v1.34.2

    The k8s.io/kubernetes module is updated to v1.34.2 as a security-related dependency update.

  • securityThe helm dependency, updated to 3.19.4

    The helm dependency is updated to 3.19.4 due to a CVE.

  • breakinggRPC service config DNS TXT lookups, disabled by default

    gRPC service config DNS TXT lookups are disabled by default.

  • breakingThe appset resource status count, defaulted to 5000

    The default appset resource status count is changed to 5000.

Check if affected (2)

  • breakingThe --client flag in the Helm version command, removed

    Applies if you use --client.

  • breakingThe cluster-version annotation format, renamed

    Applies if you use Application Sets with Cluster Generators and configure argocd.argoproj.io/auto-label-cluster-info.

Source ↗
CRI-Ov1.35.3Kubernetes CoreMay 5, 2026
ACTION 2OTHER 4View full analysis

A maintenance release that adds a runtime metric and a GOMAXPROCS configuration field, fixes two runtime defects, and reverts CNI monitoring after node bootstrapping regressions. It also updates the spdystream dependency to address CVE-2026-35469.

Action needed (2)

  • securityhighThe spdystream dependency update for CVE-2026-35469

    The spdystream dependency is updated to address CVE-2026-35469. The update ships in this release.

  • breakingCRI-O CNI monitoring, reverted

    CRI-O reverts CNI monitoring because it caused node bootstrapping regressions. The change ships in this release.

Source ↗
wasmCloudv2.0.6Orchestration & ManagementMay 1, 2026
ACTION 1OTHER 10View full analysis

A maintenance release with correctness fixes for HTTP errors, NATS subscription readiness, and WorkloadDeployment readiness, plus dependency and toolchain updates. It removes canary-v2 now that canary exists and includes dependency cleanup.

Action needed (1)

  • breakingThe canary-v2 option, removed

    canary-v2 is removed now that canary exists. The removal ships in this release.

Source ↗
containerdv2.3.0Kubernetes CoreApr 30, 2026
ACTION 1PLAN 1OTHER 41View full analysis

A substantial operator-facing release with new capabilities, behavior changes, a compatibility constraint, and a deprecation. It is the first annual LTS release under a Kubernetes-aligned cadence, with support planned for at least two years.

Action needed (1)

  • breakingPlugin names disallow commas

    OCI hook adjustments accumulate owners, and commas are disallowed in plugin names in this release.

Plan ahead (1)

  • deprecatedThe shim.Command API, deprecated

    Applies if you use shim.Command.

Source ↗
Open Policy Agent (OPA)v1.16.0SecurityApr 30, 2026
ACTION 1OTHER 38View full analysis

OPA v1.16.0 adds URI built-ins, Data API metadata support, testing and WASM capabilities, along with broader Rego and schema support. It also changes formatting, logging, server, TLS, socket, storage, and dependency behavior, but includes a shutdown regression, so users should skip v1.16.0 and upgrade directly to v1.16.1.

Action needed (1)

  • breakingHTML index page query form removed

    OPA v1.16.0 drops the HTML index page query form.

Source ↗
Vitessv24.0.0Storage & DataApr 30, 2026
ACTION 3CHECK 12PLAN 4OTHER 244View full analysis

A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.

Action needed (3)

  • securityClear-text logging of sensitive information

    The release addresses a code scanning alert about clear-text logging of sensitive information.

  • securityDirectory traversal protection in GetBackups

    The file backup storage GetBackups RPC no longer permits directory traversal paths.

  • breakingStricter VTGate SELECT list validation

    VTGate rejects an unqualified * after a comma in a SELECT list.

Check if affected (12)

  • securityOpt-in compressor commands from MANIFEST

    Applicability is not stated in the release notes.

  • securityExternal decompressor commands from backup MANIFEST

    Applies if you use backup storage.

  • securityBackup MANIFEST path traversal protection

    Applies if backupengine runs.

  • + 9 more on the release page

Plan ahead (4)

  • deprecatedThe glog deprecationremoval planned in v25

    Applies if you use glog.

  • deprecatedThe OpenTracing backend deprecationsremoval planned in v25

    Applies if you use opentracing-jaeger or opentracing-datadog.

  • deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25

    Applies if you configure --snapshot-topology-interval.

  • + 1 more on the release page
Source ↗
KServev0.18.0AI & MLApr 29, 2026
ACTION 3CHECK 2OTHER 61View full analysis

A release with operator-facing fixes, new capabilities, API and configuration changes, and dependency updates. It also includes fixes for CVE-2026-32597 in PyJWT and CVE-2026-30922 in pyasn1.

Action needed (3)

  • securityhighCVE-2026-32597 PyJWT validation fix

    PyJWT crit header validation was fixed for CVE-2026-32597.

  • securityhighCVE-2026-30922 pyasn1 fix

    The pyasn1 dependency was updated to address CVE-2026-30922 and its denial-of-service vulnerability.

  • breakingRequired MaxReplicas field

    MaxReplicas is now required and must use the int32 type.

Check if affected (2)

  • breakingRemoval of the scheduler cert-hash restart annotation

    Applies if you configure cert-hash.

  • breakingPYTHONPATH blocked by ISVC and ServingRuntime webhooks

    Applies if you configure PYTHONPATH.

Source ↗
Strimzi1.0.0Networking & MessagingApr 28, 2026
ACTION 2CHECK 4OTHER 12View full analysis

A release that removes older CRD API versions, changes defaults and configuration locations, and adds Kafka and HTTP Bridge capabilities. Monitoring configurations and standalone Topic Operator setups may require updates.

Action needed (2)

  • breakingThe UseConnectBuildWithBuildah feature gate, enabled by default

    The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default.

  • breakingThe /metrics endpoint, moved to the HTTP management interface

    The /metrics endpoint is no longer available on the regular HTTP interface, which uses port 8080 by default. It is now available on the HTTP management interface on port 8081.

Check if affected (4)

  • breakingOlder CRD API versions, removed

    Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.

  • breakingThe Open Policy Agent (OPA) authorizer plugin, no longer bundled

    Applies if you use the Open Policy Agent (OPA) authorizer plugin.

  • breakingLegacy TLS environment variables, ignored

    Applies if you set any of STRIMZI_TLS_ENABLED, STRIMZI_TLS_AUTH_ENABLED, STRIMZI_PUBLIC_CA, STRIMZI_TRUSTSTORE_LOCATION, STRIMZI_TRUSTSTORE_PASSWORD, STRIMZI_KEYSTORE_LOCATION, or STRIMZI_KEYSTORE_PASSWORD.

  • + 1 more on the release page
Source ↗
Flatcar Container Linuxstable-4593.2.0Provisioning & RuntimeApr 27, 2026
ACTION 18CHECK 1OTHER 99View full analysis

A security- and maintenance-focused release with updates to Linux and bundled components, along with dependency updates. It also corrects minimal-initrd regressions and changes service startup, SSH defaults, kernel-module availability, and other operator-visible behavior and layout.

Action needed (18)

Check if affected (1)

  • breakingAutomatic startup for overlaybd sysext services

    Applies if you use the overlaybd sysext.

Source ↗
Cortexv1.21.0ObservabilityApr 27, 2026
ACTION 1CHECK 1PLAN 3OTHER 81View full analysis

A feature and maintenance release that adds Store Gateway, federation, overrides, caching, metric, and query capabilities while graduating several experimental features. It also changes defaults and configuration names, updates dependencies, and fixes correctness, memory, panic, and data-corruption defects.

Action needed (1)

  • breakingThe blocks storage bucket index default

    Blocks storage now enables the bucket index by default through -blocks-storage.bucket-store.bucket-index.enabled. Disabling it with -blocks-storage.bucket-store.bucket-index.enabled=false is not recommended for production.

Check if affected (1)

  • breakingThe Distributor type and unit label flag

    Applies if you configure either -distributor.enable-type-and-unit-labels or -distributor.otlp.enable-type-and-unit-labels for remote write v2 and OTLP requests.

Plan ahead (3)

  • breakingThe Ruler API flag rename

    Applies if you configure -experimental.ruler.enable-api.

  • breakingThe Alertmanager API flag rename

    Applies if you configure -experimental.alertmanager.enable-api.

  • breakingThe Users Scanner user index update configuration

    Applies if you configure either -*.users-scanner.user-index.cleanup-interval or clean_up_interval.

Source ↗
Kubernetesv1.36.0Kubernetes CoreApr 22, 2026
ACTION 11CHECK 25PLAN 6OTHER 293View full analysis

A broad operator-significant release with API, configuration, CLI default, scheduling, runtime, feature-gate, metric, and dependency changes. Upgrade review and testing matter for users of removed or deprecated interfaces, changed defaults, custom scheduler integrations, CRDs, audit logging, and affected metrics.

Action needed (11)

  • breakingStrictIPCIDRValidation enabled by default

    The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.

  • breakingThe default debug profile, changed to general

    The default debug profile changes from legacy to general.

  • breakingWatchCacheInitializationPostStartHook enabled by default

    The WatchCacheInitializationPostStartHook feature gate is enabled by default.

  • breakingKubeletPSI graduation to GA

    The KubeletPSI feature graduated to GA and is enabled by default.

  • breakingRelaxedServiceNameValidation at beta, enabled by default

    The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.

  • breakingRestartAllContainersOnContainerExits at beta, enabled by default

    The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.

  • breakingSuspended-job feature gates enabled by default

    The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.

  • breakingAtomicFIFO informer store updates

    Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.

  • breakingUnlockWhileProcessing informer behavior

    Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.

  • breakingClientsAllowCARotation functionality enabled by default

    This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.

  • breakingClientsAllowTLSCacheGC functionality enabled by default

    This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.

Check if affected (25)

  • breakingThe volume_operation_total_errors metric, renamed

    Applies if you use volume_operation_total_errors.

  • breakingThe git-repo volume plugin, disabled

    Applies if you use the git-repo volume plugin.

  • breakingAllowlistEntry.Name, renamed to AllowlistEntry.Command

    Applies if you configure AllowlistEntry.Name.

  • + 22 more on the release page

Plan ahead (6)

  • deprecatedService .spec.externalIPs deprecation

    Applies if you configure Service .spec.externalIPs.

  • deprecatedDirect access to metav1.FieldsV1.Raw, deprecated

    Applies if you use metav1.FieldsV1.Raw.

  • deprecatedMinNodeScore and MaxNodeScore, deprecated

    Applies if you use MinNodeScore or MaxNodeScore.

  • + 3 more on the release page
Source ↗
metal3-iov0.12.4Provisioning & RuntimeApr 22, 2026
ACTION 1OTHER 4View full analysis

This release fixes an HFC controller error loop, removes unused RBAC permissions, and updates project dependencies. The changes cover controller correctness and routine maintenance, with no stated security advisory.

Action needed (1)

  • breakingUnused permissions in the controller ClusterRole removed

    Unused RBAC permissions are removed from the controller ClusterRole.

Source ↗
metal3-iov0.11.7Provisioning & RuntimeApr 22, 2026
ACTION 1OTHER 4View full analysis

This release removes unused controller permissions and includes fixes and dependency updates. It may concern users tracking HFC controller behavior, CAPI, the Kubernetes group, or the Go build toolchain.

Action needed (1)

  • breakingUnused controller ClusterRole RBAC permissions removed

    Unused RBAC permissions are removed from the controller ClusterRole in this release.

Source ↗
KubeVirtv1.8.2Orchestration & ManagementApr 20, 2026
ACTION 1OTHER 11View full analysis

A correctness-focused release also changes backend volume naming and removes permissions from the kubevirt.io:edit RBAC role. The RBAC change requires operator attention.

Action needed (1)

  • breakingThe kubevirt.io:edit RBAC role, with vnc and screenshot permissions removed

    The vnc and screenshot permissions are removed from the kubevirt.io:edit RBAC role in this release.

Source ↗
Backstagev1.50.2CI/CD & App DeliveryApr 18, 2026
ACTION 1OTHER 4View full analysis

This release combines a new TechDocs sidebar styling capability with dependency updates and constraints. It also corrects an active tab indicator issue in Backstage UI.

Action needed (1)

  • breakingReact Aria dependency ranges constrained to patch-only updates

    React Aria dependency ranges are limited to patch-only updates in Backstage v1.50.2.

Source ↗
Rookv1.19.4Storage & DataApr 14, 2026
ACTION 1OTHER 6View full analysis

This release combines an operator defect correction with changes to operator capabilities, configuration, and dependency or image versions. It contains no security advisories or explicitly described security fixes.

Action needed (1)

  • breakingThe default COSI sidecar image version, updated

    The default version of the COSI sidecar image is updated in the COSI component.

Source ↗
wasmCloudv2.0.3Orchestration & ManagementApr 14, 2026
ACTION 1CHECK 1PLAN 1OTHER 10View full analysis

This release adds Kubernetes-native service routing and related CRD fields, changes Helm behavior, fixes a NATS subscriber initialization race, and retires the runtime-gateway path. Operators using the deprecated gateway configuration need to account for the routing change and removed chart behavior.

Action needed (1)

  • breakingThe default chart tag is removed

    The default tag is removed, so the chart uses chart.yaml's appVersion.

Check if affected (1)

  • breakingNative Kubernetes Service routing replaces runtime-gateway

    Applies if you use runtime-gateway.

Plan ahead (1)

  • deprecatedThe Helm gateway section is deprecated

    Applies if you configure gateway.

Source ↗
OpenCostv1.120.0ObservabilityApr 13, 2026
ACTION 1OTHER 26View full analysis

A maintenance release with dependency updates, defect corrections, expanded compatibility, and new integrations and configuration capabilities. An existing configuration source is replaced, so affected operators need to update their configuration.

Action needed (1)

  • breakingProvider configuration replaced by cloud-integration.json

    The provider config is no longer used, and configuration is read from cloud-integration.json instead. Operators using the replaced configuration source need to update their configuration.

Source ↗
Istio1.29.2Networking & MessagingApr 13, 2026
ACTION 1OTHER 15View full analysis

A maintenance release adds Helm v4 server-side apply support and includes numerous correctness fixes. The WASM decompression size-limit change affects inputs that were previously accepted and may require operator review.

Action needed (1)

  • breakingThe gzip decompression size limit for WASM binaries

    A size limit is now enforced on gzip-decompressed WASM binaries fetched over HTTP.

Source ↗
Keycloak26.6.0SecurityApr 8, 2026
ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

  • securitySeparate password and OTP brute force protection

    Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.

  • securityResourceAdminManager URL construction validation

    URL construction in ResourceAdminManager is validated against matrix parameter injection.

  • securityClient retrieval anti-ID phishing check

    Client retrieval now includes the missing anti-ID phishing check.

  • breakingZero-downtime patch releases enabled by default

    Zero-downtime patch releases are now promoted to supported and enabled by default.

  • breaking--truststore-kubernetes-enabled enabled by default

    The behavior controlled by --truststore-kubernetes-enabled is enabled by default.

  • breakingTen-second default not-before validation

    The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

  • securityWorkflows admin permission boundaries

    Applies if you use Workflows.

  • securityOrganizations login IdP alias disclosure

    Applies if you use Organizations.

  • securitySCIM PUT body ID override protection

    Applies if you use SCIM.

  • + 4 more on the release page

Plan ahead (1)

  • deprecatedToken Exchange v1 deprecation

    Applies if you use Token Exchange v1.

Source ↗
NATSv2.12.6Networking & MessagingMar 24, 2026
ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

  • breakingJWT size limit

    JWTs now have a 1MB size limit.

Check if affected (13)

  • securityhighMQTT security fixes

    Applies if you use MQTT.

  • securityhighLeafnode security fix

    Applies if you use leafnodes.

  • securityhighCommand-line credential security fix

    Applies if you provide credentials on the command line.

  • + 10 more on the release page
Source ↗
NATSv2.11.15Networking & MessagingMar 24, 2026
ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

  • breakingThe JWT size limit

    JWTs now have a 1MB size limit.

Check if affected (11)

Source ↗
wasmCloudv2.0.0Orchestration & ManagementMar 22, 2026
ACTION 2OTHER 8View full analysis

wasmCloud v2.0.0 adds operator-facing capabilities, changes CRD locations, updates dependencies, and fixes runtime and CLI behavior. The dependency update addresses the disclosed advisory RUSTSEC-2026-0007.

Action needed (2)

  • securitymediumLock file update for RUSTSEC-2026-0007

    wasmCloud v2.0.0 updates the lock file to address RUSTSEC-2026-0007.

  • breakingCRD location moved from templates/crds to /crds

    wasmCloud v2.0.0 moves CRDs from templates/crds to /crds.

Source ↗
Kubeflow26.03AI & MLMar 22, 2026
ACTION 1CHECK 1OTHER 18View full analysis

This release updates supported Kubernetes and pod-security configurations, installation behavior, and bundled component versions. The main operator-facing changes are the Kubernetes 1.34+ requirement and the baseline pod-security enforcement default, alongside fixes and new capabilities.

Action needed (1)

  • breakingBaseline pod security enforcement

    Pod security enforcement changes to the baseline level in this release.

Check if affected (1)

  • breakingKubernetes 1.34+ requirement

    Applies if you use Kubernetes 1.34+.

Source ↗
Harborv2.15.0Storage & DataMar 20, 2026
ACTION 2CHECK 2OTHER 72View full analysis

A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.

Action needed (2)

  • securityBearer token validation

    Harbor rejects bearer tokens issued before project creation.

  • breakingPort 9443 removed from the webhook event check

    Port 9443 is removed from the Harbor IP used for webhook event checks.

Check if affected (2)

  • breakingThe pull-through cache is replaced by proxy cache

    Applies if you use pull-through cache in Harbor.

  • breakingGCR replication removal

    Applies if you use GCR replication in Harbor.

Source ↗
KubeVirtv1.7.2Orchestration & ManagementMar 16, 2026
ACTION 1OTHER 7View full analysis

A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.

Action needed (1)

  • breakingThe QuiesceFailed indication replaced by QuiesceTimeout

    The QuiesceFailed indication was replaced with QuiesceTimeout.

Source ↗
KServev0.17.0AI & MLMar 13, 2026
ACTION 13CHECK 6OTHER 91View full analysis

An operator release with expanded configuration and LLMInferenceService capabilities, plus chart and dependency updates, behavior changes, removals, and defect corrections. It also includes security fixes for operators to review.

Action needed (13)

  • securitycriticalh11 malformed-body fix for CVE-2025-43859

    h11 malformed-body handling associated with CVE-2025-43859 is addressed in this release.

  • securityhighstarlette version 0.49.1

    starlette is pinned to version 0.49.1 to fix CVE-2025-62727 in this release.

  • securityhighlightgbm version 4.6.0

    lightgbm is updated to version 4.6.0 for CVE-2024-43598 in this release.

  • securityhighCVE-2025-66418 decompression-chain fix

    The unbounded number of links in the decompression chain associated with CVE-2025-66418 is addressed in this release.

  • securityhighexpr-lang/expr version v1.17.7

    expr-lang/expr is updated to v1.17.7 to fix CVE-2025-68156 in this release.

  • securityhighcryptography fix for CVE-2026-26007

    The cryptography issue associated with CVE-2026-26007 is addressed in this release.

  • securityhighpython-multipart fix for CVE-2026-24486

    The arbitrary file write issue in python-multipart associated with CVE-2026-24486 is addressed in this release.

  • securitymediumFixes for CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181

    This release addresses CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181.

  • securityhttps.go path traversal prevention

    The path traversal issue in https.go is prevented in this release.

  • securitySeveral CVE fixes

    This release addresses several CVEs.

  • securityAIOHTTP HTTP Parser auto_decompress fix

    The AIOHTTP HTTP Parser auto_decompress feature issue involving zip bombs is addressed in this release.

  • securityextractTarFiles path traversal fix

    The path traversal vulnerability in extractTarFiles is addressed in this release.

  • breakingminio replacement with seaweedfs

    minio is replaced with seaweedfs in this release.

Check if affected (6)

  • breakinginferenceservice CRD cert-manager annotation removal

    Applies if you use the inferenceservice CRD.

  • breakingPython 3.9 support removal

    Applies if you run Python 3.9.

  • breakingDeprecated --disable-log-requests flag removal

    Applies if you configure --disable-log-requests.

  • + 3 more on the release page
Source ↗
OpenFGAv1.12.0SecurityMar 13, 2026
ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

  • securityhighGo toolchain version 1.25.8

    The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.

  • breakingStricter tuple string validation

    Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

  • breakingThe pipeline_list_objects experimental default

    Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.

Source ↗
cert-managerv1.20.0SecurityMar 10, 2026
ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

  • securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729

    Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.

  • breakingIssuer reference kind and group defaults, reverted

    The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

  • securityPotential cert-manager controller panic from cached DNS responses

    Applicability is not stated in the release notes.

  • breakingThe OtherNames feature, enabled by default

    Applies if you use the OtherNames feature.

  • breakingDefault container user and group IDs

    Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).

  • + 1 more on the release page
Source ↗
Dragonflyv2.4.2Storage & DataMar 9, 2026
ACTION 1CHECK 1OTHER 19View full analysis

A feature and maintenance release that expands configuration and scheduler capabilities while changing configuration controls and the priorities type. Dependency versions are updated, and no security advisories or explicitly described vulnerabilities are mentioned.

Action needed (1)

  • breakingThe priorities type, changed to int32

    The priorities type changed from string to int32 in v2.4.2.

Check if affected (1)

  • breakingThe Enable flag, removed from seedPeer

    Applies if you configure Enable.

Source ↗
Jaegerv2.16.0ObservabilityMar 7, 2026
ACTION 1CHECK 2OTHER 5View full analysis

A release with breaking configuration and API changes, a Go 1.25.7 requirement, new capabilities, and bug and performance fixes. No security advisories or security-specific fixes are identified.

Action needed (1)

  • breakingGo 1.25.7 requirement

    The codebase now requires Go 1.25.7, with Go version consistency enforced across the codebase.

Check if affected (2)

  • breakingLegacy response format of the remote sampling endpoint, removed

    Applies if you use the remote sampling endpoint.

  • breakingtraces.topic renamed to traces.topics

    Applies if you configure traces.topic.

Source ↗
Strimzi0.51.0Networking & MessagingMar 6, 2026
ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

  • securityhighCVE-2026-27133 and CVE-2026-27134 security fixes

    Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.

  • breakingThe ServerSideApplyPhase1 feature gate default

    The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

  • breakingKubernetes version support

    Applies if you use Kubernetes 1.27, 1.28, or 1.29.

  • breakingKafka 4.0.0 and 4.0.1 support

    Applies if you use Kafka 4.0.0 or 4.0.1.

Plan ahead (1)

  • deprecatedThe ingress listener type deprecation

    Applies if you configure the ingress listener type.

Source ↗
Argov3.3.2CI/CD & App DeliveryFeb 22, 2026
ACTION 1OTHER 1View full analysis

This release fixes the client-side apply migration issue reported in versions 3.3.0 and 3.3.1. No security advisories are disclosed.

Action needed (1)

  • breakingClient-side apply migration failure

    The failed to perform client-side apply migration issue present in versions 3.3.0 and 3.3.1 is fixed in this release.

Source ↗
Istio1.29.0Networking & MessagingFeb 16, 2026
ACTION 1CHECK 4OTHER 18View full analysis

This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.

Action needed (1)

  • breakingAutomatic GOMEMLIMIT setting for istiod

    istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

  • breakingDefault iptables reconciliation

    Applies when the istio-cni DaemonSet is upgraded.

  • breakingDefault debug endpoint authorization

    Applies to debug endpoints on port 15014.

  • breakingDefault HTTP compression for Envoy metrics

    Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.

  • + 1 more on the release page
Source ↗
Ciliumv1.18.7Networking & MessagingFeb 13, 2026
ACTION 1OTHER 27View full analysis

A maintenance release combining an operator-facing configuration adjustment with bug fixes and routine dependency and image refreshes. No security advisories or security-specific fixes are disclosed.

Action needed (1)

  • breakingExclusion of topology.kubernetes.io labels from security labels by default

    The default security-label handling in this release excludes topology.kubernetes.io labels from security labels.

Source ↗
Jaegerv2.15.1ObservabilityFeb 9, 2026
ACTION 1OTHER 2View full analysis

This release removes a deprecated v1 adapter wrapper and changes the default span kind in API v3 operations. The remaining release notes do not describe distinct operator-facing changes.

Action needed (1)

  • breakingDeprecated protofromtraces wrapper removal

    The deprecated protofromtraces wrapper has been removed from v1adapter.

Source ↗
Rookv1.19.1Storage & DataFeb 5, 2026
ACTION 1CHECK 2OTHER 8View full analysis

A maintenance release with operator-facing removals, default and behavior changes, new CRD fields, expanded configuration support, and dependency updates. No security advisory is disclosed.

Action needed (1)

  • breakingNodes/proxy RBAC enablement removal

    The unnecessary nodes/proxy RBAC enablement is removed.

Check if affected (2)

  • breakingDefault Ceph image pull policy

    Applies if you do not configure ceph image pull policy.

  • breakingAutomated node fencing code removal

    Applies if automated node fencing runs.

Source ↗
wasmCloudv1.9.2Orchestration & ManagementFeb 4, 2026
ACTION 1OTHER 10View full analysis

This release changes NATS connection authentication and the component spec feature. Dependency and OCI image base updates are also included.

Action needed (1)

  • breakingThe component spec feature, removed

    The component spec feature is removed in this release.

Source ↗
Ciliumv1.19.0Networking & MessagingFeb 4, 2026
ACTION 15CHECK 30PLAN 7OTHER 436View full analysis

A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.

Action needed (15)

  • securityThe github.com/containerd/containerd dependency, updated

    The github.com/containerd/containerd module is updated to v1.7.29.

  • securityThe github.com/go-viper/mapstructure/v2 dependency, updated

    The github.com/go-viper/mapstructure/v2 module is updated to v2.4.0.

  • securityThe github.com/docker/docker dependency, updated

    The github.com/docker/docker module is updated to v28.3.3+incompatible.

  • securityThe golang.org/x/crypto dependency, updated

    The golang.org/x/crypto module is updated to v0.45.0.

  • securityThe helm.sh/helm/v3 dependency, updated to v3.18.4

    The helm.sh/helm/v3 module is updated to v3.18.4.

  • securityThe helm.sh/helm/v3 dependency, updated to v3.18.5

    The helm.sh/helm/v3 module is updated to v3.18.5.

  • breakingThe plpmtud default, set to blackhole

    The default plpmtud mode is now blackhole (blackhole-detected).

  • breakingThe AddressScopeMax default, set to 254

    The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.

  • breakingThe tls authMode default, set to migration

    tls authMode is set to migration by default.

  • breakingThe CNI deletion timeout, reduced to 1.5 seconds

    The CNI deletion timeout is reduced to 1.5 seconds.

  • breakingThe policy-default-local-cluster default

    policy-default-local-cluster is now set by default.

  • breakingHost firewall bypass, disabled by default

    Host firewall bypass is disabled by default.

  • breakingFQDN match pattern sanitization

    FQDN match pattern sanitization is refactored and tightened.

  • breakingEncrypted traffic forwarding via cilium_host, removed

    Forwarding encrypted traffic via cilium_host has been removed.

  • breakingCNI configuration in the container image, removed

    The CNI configuration is no longer installed in the container image.

Check if affected (30)

  • breakingLocal-cluster default for network policy selectors

    Applies if you do not set cluster in network policy selectors.

  • breakingThe CiliumBGPPeeringPolicy v1 API, removed

    Applies if you use CiliumBGPPeeringPolicy.

  • breakingMutual Authentication, disabled by default

    Applies if you enable Mutual Authentication.

  • + 27 more on the release page

Plan ahead (7)

  • deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced

    Applies if you use --enable-ipsec-encrypted-overlay.

  • deprecatedKafka match fields and ToRequires and FromRequires, deprecated

    Applies if you use ToRequires or FromRequires.

  • deprecatedTLS certificate and key Helm values, deprecated

    Applies if you pass TLS certificates or keys in Helm values.

  • + 4 more on the release page
Source ↗
← NewerOlder →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023