Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Crossplanev1.20.12Orchestration & ManagementYesterdayAug 21, 2026

ACTION 5OTHER 3View full analysis

A maintenance release with security-related dependency and toolchain updates, along with routine dependency and runtime version changes. No advisory identifiers are stated.

Action needed (5)

securityVulnerable dependency fixes
Vulnerable dependencies were updated in the release-1.20 branch.
securityVulnerable dependency updates
Vulnerable dependencies were updated in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module update
The github.com/go-git/go-git/v5 module was updated to version v5.19.2 in the release-1.20 branch.
securityThe golang.org/x/mod module update
The golang.org/x/mod module was updated to version v0.40.0 in the release-1.20 branch.
securityThe Go toolchain version 1.25.13
The Go toolchain was updated to version 1.25.13 in the release-1.20 branch.

Source ↗

Crossplanev2.2.5Orchestration & ManagementYesterdayAug 21, 2026

ACTION 1OTHER 2View full analysis

A maintenance release corrects binary checksum generation and deletion-protection indexing, and updates dependencies for upstream CVE fixes. The changes affect release verification, webhook deletion checks, and the dependency set shipped with the release.

Action needed (1)

securityDependency security updates
The release updates cel-go, golang.org/x/mod, sigstore-go, and go-git, along with a combined set of vulnerable dependency updates, to pick up upstream CVE fixes. It also bumps crossplane-runtime to v2.2.4, which carries its own security dependency updates.

Source ↗

Crossplanev2.3.5Orchestration & ManagementYesterdayAug 21, 2026

ACTION 4OTHER 4View full analysis

A maintenance release corrects binary checksum handling and the Usage index key, alongside updates to security-sensitive and build dependencies. The dependency changes require the new release, with no operator configuration migration stated.

Action needed (4)

securityThe golang.org/x/mod dependency update
The release updates golang.org/x/mod as a security-related dependency change.
securityThe github.com/sigstore/sigstore-go dependency, updated to v1.2.1
The release updates github.com/sigstore/sigstore-go to v1.2.1 as a security-related dependency change.
securityThe github.com/google/cel-go dependency, updated to v0.30.0
The release updates github.com/google/cel-go to v0.30.0 as a security-related dependency change.
securityThe crossplane-runtime dependency, bumped to v2.3.4
The release bumps crossplane-runtime to v2.3.4 as a security-related dependency change.

Source ↗

hamiv2.10.0AI & MLYesterdayAug 21, 2026

ACTION 3CHECK 7OTHER 195View full analysis

A substantial operator-focused maintenance release with broad bug and behavior fixes, alongside new scheduling, device, configuration, and observability capabilities. It also updates security-relevant dependencies and the runtime/toolchain while removing obsolete functionality that may affect compatibility and configuration.

Action needed (3)

securitytensorflow/tensorflow upgraded to 2.21.0rc0-gpu
The tensorflow/tensorflow dependency is upgraded from 2.20.0rc0-gpu to 2.21.0rc0-gpu.
securitytensorflow/tensorflow upgraded to 2.21.0rc1-gpu
The tensorflow/tensorflow dependency is upgraded from 2.21.0rc0-gpu to 2.21.0rc1-gpu.
securitygolang security upgrade
The golang runtime is upgraded to address a security issue.

Check if affected (7)

breakingDRA components removed from the HAMi main chart
Applies if you use DRA components in the HAMi main chart.
breakingWebhook denial of privileged containers
Applies if you use the webhook.
breakingDeprecated scheduler policy configmap removed
Applies if you configure the deprecated scheduler policy configmap.
+ 4 more on the release page

Source ↗

Crossplanev2.4.0Orchestration & ManagementAug 20, 2026

ACTION 15CHECK 4PLAN 1OTHER 33View full analysis

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

securityGo version and dependency security updates
Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.
securityGo 1.25.10
Go was updated to 1.25.10 to fix standard library CVEs.
securitygolang.org/x/crypto v0.52.0
The golang.org/x/crypto module was updated to v0.52.0 for security fixes.
securitygolang.org/x/sys v0.44.0
The golang.org/x/sys module was updated to v0.44.0 for security fixes.
securitygolang.org/x/net v0.55.0
The golang.org/x/net module was updated to v0.55.0 for security fixes.
securitygithub.com/sigstore/cosign/v3 v3.0.6
The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.
securitygithub.com/sigstore/rekor v1.5.2
The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.
securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0
The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.0
The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.
securityCombined grpc, x/net, and x/text security updates
Combined security updates were applied to grpc, x/net, and x/text.
securitygolang.org/x/net v0.56.0
The golang.org/x/net module was updated to v0.56.0 for security fixes.
securitygolang.org/x/text v0.39.0
The golang.org/x/text module was updated to v0.39.0 for security fixes.
securityVulnerable dependency updates
Vulnerable dependencies were updated for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.1
The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.
securitygolang.org/x/mod v0.40.0
The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

breakingCrossplane CLI publication location and binary name
Applies if you use the Crossplane CLI.
breakingspec.replicas behavior in DeploymentRuntimeConfig
Applies if DeploymentRuntimeConfig configures spec.replicas.
breakingNarrowed composed resource garbage collection
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (1)

deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)
Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.

Source ↗

Kubernetesv1.36.4Kubernetes CoreAug 20, 2026

ACTION 1OTHER 4View full analysis

A maintenance release with correctness fixes and a security-related dependency update. The dependency update is recorded in the manifest and has no standalone operator impact.

Action needed (1)

securitySecurity updates for golang.org/x/text and golang.org/x/net
The dependency manifest updates golang.org/x/text and golang.org/x/net to include security updates.

Source ↗

Kyvernov1.19.0SecurityAug 20, 2026

ACTION 7CHECK 6PLAN 1OTHER 160View full analysis

A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.

Action needed (7)

securityhighIntermediate certificate limits
Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.
securityhighGo toolchain 1.26.3
The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.
securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9
CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.
securityUpdated golang.org/x/crypto and x/net dependencies
The golang.org/x/crypto dependency was updated to v0.53.0 and x/net to v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.
securityPatched ORAS and sigstore vulnerabilities
The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.
securityCodeQL vulnerability fixes
Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.
securitycel-go v0.30.0
cel-go was updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.

Check if affected (6)

breakingRequired --resource for the migrate command
Applies when the migrate command runs.
breakingDefault userInfo groups and UID during background scans
Applies when background scans run.
breakingexcludeBootstrapResources webhook flag
Applies when you configure Fail webhooks.
+ 3 more on the release page

Plan ahead (1)

deprecatedDeprecation notices for legacy kyverno.io policy types
Applies when you use legacy kyverno.io policy types.

Source ↗

Rookv1.19.9Storage & DataAug 19, 2026

ACTION 1OTHER 5View full analysis

A maintenance release with security guidance for CVE-2025–30156 and updates across Ceph authentication, core behavior, Multus networking, and the Ceph base image. The release also includes a workaround for a Ceph authentication rotation race.

Action needed (1)

securityCVE-2025–30156 upgrade guidance
Rook users are advised to upgrade to Rook v1.20.5 or v1.19.9 with Ceph v20.2.4 or v19.2.6 in response to CVE-2025–30156.

Source ↗

Keycloak26.7.2SecurityAug 19, 2026

ACTION 2CHECK 6OTHER 14View full analysis

A maintenance release with disclosed security fixes, a cleartext vault-keystore password correction, a Quarkus dependency upgrade, and other bug corrections. The fixes cover account and permission flows, secret handling, and runtime dependencies.

Action needed (2)

securitymediumCVE-2026-59888 and CVE-2026-59889 fixes in jackson-databind
jackson-databind is upgraded to 2.21.5 to address CVE-2026-59888 and CVE-2026-59889. The dependency update ships in this Keycloak release.
securitymediumCVE-2026-45292 OpenTelemetry Java SDK memory allocation correction
CVE-2026-45292 corrects unbounded memory allocation in W3C Baggage Propagation in the OpenTelemetry Java SDK.

Check if affected (6)

securitycriticalCVE-2026-18963 reset-credentials flow bypass correction
Applies if you use the reset-credentials flow.
securityhighCVE-2026-15571 predictable account-linking hash correction
Applies if you use oidc.
securitymediumCVE-2026-14613 fine-grained admin permissions bypass correction
Applies if you use the admin/fine-grained-permissions API.
+ 3 more on the release page

Source ↗

CoreDNSv1.14.7Kubernetes CoreAug 19, 2026

ACTION 1CHECK 3OTHER 42View full analysis

A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.

Action needed (1)

securityhighGo 1.26.6 security fixes
The release is built with Go 1.26.6, including fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.

Check if affected (3)

securityplugin/acl autopath ACL checks
Applies if you use plugin/acl and autopath.
breakingplugin/forward default connection attempts
Applies if you use plugin/forward.
breakingplugin/hosts unsupported-type fallthrough
Applies if you use plugin/hosts.

Source ↗

Ciliumv1.18.13Networking & MessagingAug 18, 2026

ACTION 1OTHER 26View full analysis

A maintenance release that adds host-firewall protocol support, corrects networking and stability defects, and changes runtime behavior and observability. It also updates dependencies and container images, including a gRPC security fix with no disclosed vulnerability.

Action needed (1)

securityThe google.golang.org/grpc dependency, updated to v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.18 release line. The release note marks this dependency update as a security fix, but does not disclose the vulnerability.

Source ↗

Open Policy Agent (OPA)v1.19.1SecurityAug 17, 2026

ACTION 1View full analysis

A security-focused maintenance release updates the Go build dependency to 1.26.6 and addresses standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins. Operators building their own binaries or images control the Go version used in those builds.

Action needed (1)

securitycriticalGo 1.26.6 build dependency
OPA is built with Go 1.26.6, fixing standard-library vulnerabilities in code used by its HTTP handler and crypto builtins. The fixes address GO-2026-5026, GO-2026-5972, GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091, and GO-2026-6218.

Source ↗

OpenFeatureflagd-proxy/v0.9.8CI/CD & App DeliveryAug 14, 2026

ACTION 1OTHER 1View full analysis

A maintenance release for flagd-proxy resolves open Dependabot security alerts. The sync server also receives a gRPC keepalive enforcement policy update.

Action needed (1)

securityOpen Dependabot security alerts resolved
Open Dependabot security alerts are resolved in flagd-proxy v0.9.8.

Source ↗

Flatcar Container Linuxlts-4081.3.10Provisioning & RuntimeAug 13, 2026

ACTION 1OTHER 2View full analysis

A maintenance release with Linux security fixes identified by CVEs. It also updates the Linux and ca-certificates dependencies.

Action needed (1)

securitycriticalLinux security updates
The Linux update ships security fixes identified by the CVE advisories recorded for this change.

Source ↗

Flatcar Container Linuxstable-4593.2.5Provisioning & RuntimeAug 13, 2026

ACTION 2OTHER 3View full analysis

A security-focused release with Linux and OpenSSH fixes identified by CVE advisories. It also updates versions of Linux, ca-certificates, and OpenSSH.

Action needed (2)

securitycriticalLinux security fixes
The release includes Linux security fixes identified by CVE advisories, including CVE-2026-68480.
securityhighopenssh security fixes
The release includes openssh security fixes identified by CVE advisories, including CVE-2026-59995.

Source ↗

Helmv4.2.4Kubernetes CoreAug 13, 2026

ACTION 2OTHER 9View full analysis

A maintenance release with correctness fixes and dependency updates tied to GO advisories. The changes affect Helm users through both general fixes and updated Go dependencies.

Action needed (2)

securitymediumThe go.opentelemetry.io/otel dependency upgrade for GO-2026-5158
go.opentelemetry.io/otel was upgraded to v1.44.0 for advisory GO-2026-5158.
securityThe google.golang.org/grpc dependency upgrade for GO-2026-6061
google.golang.org/grpc was upgraded from 1.80.0 to 1.82.1 for advisory GO-2026-6061.

Source ↗

Contourv1.33.6Networking & MessagingAug 12, 2026

ACTION 1CHECK 1OTHER 3View full analysis

A maintenance release with a security fix for an external authorization bypass and dependency updates for CVE fixes. It also updates the tested Kubernetes range to 1.32 through 1.34, Go to 1.25.12, and Envoy to v1.38.3.

Action needed (1)

securityDependency updates for CVE fixes
Dependencies were updated to fix CVEs. The updates ship in Contour v1.33.6.

Check if affected (1)

securityExternal authorization bypass with disabled authPolicy
Applies if authPolicy is not configured.

Source ↗

Argov3.5.1CI/CD & App DeliveryAug 12, 2026

ACTION 1OTHER 7View full analysis

This release contains routine correctness fixes and a security fix in the server. The security change concerns users of the SSD CLI.

Action needed (1)

securitySSD CLI secret-mask spoofing prevention
The server prevents secret-mask spoofing in the SSD CLI. This fix ships in Argo CD v3.5.1.

Source ↗

Argov3.4.7CI/CD & App DeliveryAug 12, 2026

ACTION 1OTHER 4View full analysis

A maintenance release with correctness fixes, a server-side secret-mask spoofing fix, and a third-party dependency update. Ordinary fixes and the dependency update require no operator action, while upgrading addresses the security fix.

Action needed (1)

securitySSD CLI secret-mask spoofing prevention
The server now prevents secret-mask spoofing in the SSD CLI. This fix ships in the 3.4 release line.

Source ↗

Argov3.3.14CI/CD & App DeliveryAug 12, 2026

ACTION 2CHECK 2OTHER 2View full analysis

A maintenance release with fixes for secret masking and pprof endpoint configuration, alongside dependency updates for two listed CVEs. The secret-handling fixes and dependency updates are addressed by upgrading, while the remaining defect fixes require no operator action.

Action needed (2)

securityhighThe /ui brace-expansion dependency update for CVE-2026-69152
The /ui dependency brace-expansion is updated to 2.1.4 and 1.1.18 for CVE-2026-69152.
securitymediumThe DOMPurify dependency update for CVE-2026-49978
The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.

Check if affected (2)

securitySSD CLI secret mask spoofing prevention
Applies if you use SSD CLI.
securitySecret hiding in the last-applied-configuration annotation
Applies if you configure last-applied-configuration.

Source ↗

Kubescapev4.0.12SecurityAug 12, 2026

ACTION 3CHECK 3OTHER 220View full analysis

A corrective and performance-focused release with operator-visible default and constraint changes, deprecated flag removal, and dependency vulnerability fixes. It also expands scanning, output, registry, and MCP capabilities.

Action needed (3)

securityBatch dependency vulnerability fixes
Batch 1 and 2 dependency vulnerability fixes are included in this release.
breakingRegoV1 evaluation and v0 compatibility shim removal
Rego evaluation now uses RegoV1 and drops the v0 compatibility shim in this release.
breakingLoopback-only constraint
A loopback-only constraint is applied in this release.

Check if affected (3)

breakingOpt-in pprof debug server
Applies if you enable the pprof debug server.
breaking--frameworks default set to all
Applies if you do not configure --frameworks.
breakingDeprecated flags removal
Applies if you configure deprecated flags.

Source ↗

Buildpacksv0.40.9CI/CD & App DeliveryAug 9, 2026

ACTION 3OTHER 1View full analysis

This release updates dependencies associated with published security advisories. Builders created with the pack CLI from this release contain lifecycle v0.21.0 by default.

Action needed (3)

securityhighThe github.com/go-git/go-git/v5 dependency update
github.com/go-git/go-git/v5 updates from v5.19.1 to v5.19.2 in buildpacks v0.40.9. The release note cites GHSA-hc8v-wwc9-vgxm.
securitymediumThe go.opentelemetry.io/otel dependency update
go.opentelemetry.io/otel updates from v1.43.0 to v1.44.0 in buildpacks v0.40.9. The release note cites GO-2026-5158 and CVE-2026-41178 for a baggage header that was not length-capped.
securityThe github.com/klauspost/compress dependency update
github.com/klauspost/compress updates from v1.18.6 to v1.18.7 in buildpacks v0.40.9. The release note cites GO-2026-5841 and GHSA-259r-337f-4rfw for an out-of-bounds read in s2.

Source ↗

Daprv1.17.12Orchestration & ManagementAug 6, 2026

ACTION 1OTHER 1View full analysis

This release contains a security-related build toolchain update and an input-binding startup fix. The probe timeout is configurable for applications with slow startup.

Action needed (1)

securityThe Go toolchain version, updated to 1.26.5
The Go version used to build Dapr is updated from 1.26.4 to 1.26.5 across the runtime, build tooling, and container images.

Source ↗

KServev0.20.0AI & MLAug 6, 2026

ACTION 2CHECK 7OTHER 48View full analysis

This release adds new inference-service, storage, runtime, routing, and deployment capabilities, alongside correctness fixes and dependency updates. Operators should review the Starlette security update, changed defaults, and narrower readiness behavior.

Action needed (2)

securitymediumstarlette dependency update for CVE-2026-48710
The starlette dependency is bumped to >=1.0.1 for CVE-2026-48710.
breakingStandard default alignment with the llm-d optimized baseline
The standard default is aligned with the llm-d optimized baseline.

Check if affected (7)

breakinglora-affinity-scorer default for LoRA adapters
Applies if you use LoRA adapters.
breakingLLMInferenceServiceConfig deletion-prevention finalizer
Applies if you use LLMInferenceServiceConfig.
breakingendpointPickerRef default EPP port
Applies if you configure endpointPickerRef and do not configure port.
+ 4 more on the release page

Source ↗

Argov3.5.0CI/CD & App DeliveryAug 4, 2026

ACTION 3CHECK 1OTHER 286View full analysis

A maintenance release focused on operator-facing bug fixes, with additional feature and configuration work. It also includes dependency updates, including a UI dependency update for CVE-2026-41240.

Action needed (3)

securitymediumThe redoc/dompurify dependency update for CVE-2026-41240
The UI dependency redoc/dompurify is bumped to v3.4.0 to fix CVE-2026-41240.
securityThe formidable dependency update
The formidable dependency is updated to v2.1.3.
breakingThe auto-sync toggle removal from the app top bar
The auto-sync toggle is removed from the app top bar.

Check if affected (1)

breakingThe theme default changed to auto
Applies if theme is not configured.

Source ↗

CRI-Ov1.36.3Kubernetes CoreAug 4, 2026

ACTION 1OTHER 13View full analysis

This cri-o release includes a fix for a disclosed security vulnerability alongside runtime behavior, monitoring configuration, metric, and dependency updates. It is most relevant to deployments affected by the HOME environment-variable issue or the related observability and CNI configuration changes.

Action needed (1)

securityhighCVE-2026-15809 HOME environment-variable injection fix
cri-o v1.36.3 fixes CVE-2026-15809. The vulnerability allowed a bypass of the CVE-2022-4318 fix, enabling /etc/passwd injection through newline characters in the HOME environment variable.

Source ↗

OpenFGAv1.18.2SecurityAug 3, 2026

ACTION 1OTHER 6View full analysis

A maintenance release with diagnostic logging, experimental cache metric changes, and corrections for weighted-graph and tuple-validation defects. It also updates the Go toolchain and embedded grpc-health-probe in released images.

Action needed (1)

securityhighgrpc-health-probe rebuilt at v0.4.53
The embedded grpc-health-probe is rebuilt with Go 1.26.5 and bumped to v0.4.53 in released images. The update addresses the Go standard library vulnerabilities documented in the Go 1.26.5 release notes, including CVE-2026-39822.

Source ↗

Argov3.3.13CI/CD & App DeliveryJul 31, 2026

ACTION 1OTHER 10View full analysis

A maintenance release with bug fixes and dependency updates. The form-data update in /ui addresses CVE-2026-12143.

Action needed (1)

securityhighThe form-data dependency update for CVE-2026-12143
The form-data dependency is updated to version 4.0.6 in /ui to address CVE-2026-12143.

Source ↗

Karmadav1.18.2Orchestration & ManagementJul 31, 2026

ACTION 2CHECK 8PLAN 4OTHER 65View full analysis

A broad operator-impacting maintenance release with security-related base image updates, API and configuration changes, scheduling capabilities, and deprecations and removals. Operators should review changed defaults and constraints and account for migration work affecting their configurations, APIs, and metrics.

Action needed (2)

securityThe alpine base image update
The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns.
securityThe alpine base image update
The alpine base image is updated from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (8)

breakingThe cluster lease duration flags, removed
Applies if you configure either --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
breakingThe Estimator metric label value, removed
Applies if you use either estimating_plugin_execution_duration_seconds or estimating_plugin_extension_point_duration_seconds.
breakingThe Etcd.Local.InitImage configuration field, removed
Applies if you configure Etcd.Local.InitImage.
+ 5 more on the release page

Plan ahead (4)

deprecatedThe ReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ReplicaRequirements.resourceRequest.
deprecatedThe ComponentReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ComponentReplicaRequirements.resourceRequest.
deprecatedThe NodeClaim.nodeAffinity field deprecationdeprecated since v1.18.0
Applies if you use NodeClaim.nodeAffinity.
+ 1 more on the release page

Source ↗

Karmadav1.16.8Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 104View full analysis

A mixed maintenance and feature release with bug fixes, new APIs and capabilities, performance and instrumentation improvements, dependency updates, and deprecated field removals. Operators should review the removed fields and the updated dependency, while the release also adds multi-component scheduling, configurable initialization, eviction queue support, and new workload interpreters.

Action needed (1)

securitymediumThe github.com/vektra/mockery dependency update
The github.com/vektra/mockery dependency was bumped to v3.5.5 to address security concerns identified by GO-2025-3900.

Check if affected (4)

breakingThe external etcd fields CAData, CertData, and KeyData, removed
Applies if you configure CAData, CertData, or KeyData.
breakingThe init command's default component images
Applies if you run the init command.
breakingA 32s default timeout for the member cluster client
Applies if you use the member cluster client.
+ 1 more on the release page

Plan ahead (2)

deprecatedThe --etcd-init-image flag, deprecatedremoval date not announced
Applies if you use --etcd-init-image.
breakingThe Prometheus metric labels cluster and cluster_name, replaced by member_clusterremoval planned in 1.18
Applies if you use the cluster or cluster_name metric labels.

Source ↗

Open Policy Agent (OPA)v1.19.0SecurityJul 30, 2026

ACTION 3CHECK 2OTHER 36View full analysis

A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.

Action needed (3)

securityhighoras.land/oras-go/v2 update for GHSA-fxhp-mv3v-67qp
oras.land/oras-go/v2 is updated from 2.6.1 to 2.6.2 to address GHSA-fxhp-mv3v-67qp.
breakingReadHeaderTimeout default
All HTTP servers now set ReadHeaderTimeout to 32s.
breakingPartial set and -object rule name conflicts
The AST rejects partial set and -object rules that share a name.

Check if affected (2)

securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
breakingStricter := safety checking
Applicability is not stated in the release notes.

Source ↗

KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github.com/moby/spdystream dependency, updated
The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

breakingStricter network interface binding admission
Applies if you configure network interface bindings.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
+ 6 more on the release page

Plan ahead (2)

deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗

Prometheusv3.13.2ObservabilityJul 30, 2026

ACTION 2OTHER 2View full analysis

Prometheus v3.13.2 updates dependencies for two disclosed vulnerabilities and includes related transitive dependency upgrades. It also fixes a PromQL SIGBUS crash when the data disk is full.

Action needed (2)

securityhighgolang.org/x/text update for CVE-2026-56852
golang.org/x/text updates from v0.38.0 to v0.39.0 in Prometheus v3.13.2 for CVE-2026-56852.
securityhighgoogle.golang.org/grpc update for GHSA-hrxh-6v49-42gf
google.golang.org/grpc updates from v1.81.1 to v1.82.1 in Prometheus v3.13.2 for GHSA-hrxh-6v49-42gf.

Source ↗

Volcanov1.15.1Orchestration & ManagementJul 30, 2026

ACTION 1OTHER 16View full analysis

Volcano v1.15.1 is a maintenance release with a dependency update, configuration-format compatibility changes, and correctness fixes. It also includes implementation-only changes with no operator-facing impact.

Action needed (1)

securityThe golang.org/x/crypto dependency, upgraded
Volcano v1.15.1 upgrades golang.org/x/crypto from v0.49.0 to v0.53.0, incorporating upstream SSH security fixes released in v0.52.0.

Source ↗

cert-managerv1.21.1SecurityJul 29, 2026

ACTION 4OTHER 4View full analysis

cert-manager v1.21.1 is a maintenance release with fixes for regressions and updates to dependencies affected by reported security vulnerabilities. The dependency updates concern all installations, while the regression fixes address controller behavior and require no setup change.

Action needed (4)

securityThe golang.org/x/text dependency, updated to v0.40.0
The golang.org/x/text dependency is updated to v0.40.0 to fix a reported security vulnerability.
securityThe google.golang.org/grpc dependency, updated to v1.82.1
The google.golang.org/grpc dependency is updated to v1.82.1 to fix a reported security vulnerability.
securityThe github.com/google/cel-go dependency, updated to v0.29.0
The github.com/google/cel-go dependency is updated to v0.29.0 to fix a reported security vulnerability.
securityThe go.opentelemetry.io/otel dependency, updated to v1.44.0
The go.opentelemetry.io/otel dependency is updated to v1.44.0 to fix a reported security vulnerability.

Source ↗

Ciliumv1.20.0Networking & MessagingJul 29, 2026

ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

securitygoogle.golang.org/grpc v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in the main branch.
securitygoogle.golang.org/grpc v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.
securityhelm.sh/helm/v4 v4.1.4
The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.
securitygithub.com/cloudflare/circl v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3.
securitygithub.com/go-jose/go-jose/v4 v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.
securitygithub.com/moby/spdystream v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1.
breakingcni.customConf CNI configuration version
The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.

Check if affected (28)

securitytbid traffic host namespace handling
Applies if you use tbid traffic.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
+ 25 more on the release page

Plan ahead (6)

deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[].subnet or interfaces[].cidr.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
+ 3 more on the release page

Source ↗

Rookv1.19.8Storage & DataJul 28, 2026

ACTION 1OTHER 4View full analysis

v1.19.8 is a maintenance release with a security-related dependency update and behavioral improvements. The recorded dependency change updates the vulnerable go text package from v0.37 to a newer version.

Action needed (1)

securityThe go text package, updated from v0.37
The go text package is updated from v0.37 to the latest version because v0.37 has a vulnerability. This dependency update ships in v1.19.8.

Source ↗

OpenFeaturecore/v0.16.1CI/CD & App DeliveryJul 27, 2026

ACTION 2OTHER 8View full analysis

This release combines ordinary bug fixes with security-related updates. It also improves blob/HTTP synchronization, with no announced operator-facing removals, deprecations, or default changes.

Action needed (2)

securityThe google.golang.org/grpc module update to v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in core v0.16.1.
securityThe vulnerability-updates update
vulnerability-updates is updated in core v0.16.1.

Source ↗

OpenFeatureflagd-proxy/v0.9.7CI/CD & App DeliveryJul 27, 2026

ACTION 2OTHER 3View full analysis

A maintenance release with a bug-fix heading, a new server timeout setting, dependency updates, and security-related updates. The google.golang.org/grpc update requires upgrading.

Action needed (2)

securityThe google.golang.org/grpc module, updated to v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 as a security-related dependency change.
securityThe vulnerability-updates dependency update
The release updates vulnerability-updates as a security-related dependency change.

Source ↗

OpenFeatureflagd/v0.16.1CI/CD & App DeliveryJul 27, 2026

ACTION 3OTHER 5View full analysis

flagd/v0.16.1 combines bug fixes with security dependency updates and a configurable sync-server capability. The security notes do not include advisory identifiers or flaw details, while the sync-server changes include server timeouts and configurable gRPC keepalive enforcement.

Action needed (3)

securitySecurity dependency updates
Security dependencies are updated in flagd/v0.16.1.
securityThe google.golang.org/grpc module update
The google.golang.org/grpc module is updated to v1.82.1 in flagd/v0.16.1.
securityVulnerability updates
Vulnerability updates are included in flagd/v0.16.1 as a security change.

Source ↗

Aug 21, 2026 – Jul 27, 2026Older →

Browse by month