AI-analyzed release notes for CNCF graduated and incubating projects.
Dapr v1.16.13 includes a security-relevant Go dependency update and correctness fixes. The release also changes scheduler reliability and Pulsar pub/sub processing behavior.
Action needed (1)
securityThe Go version update
The Go version is updated from 1. to 1. in v1.16.13.
Check if affected (1)
breakingprocessMode initialization validation
Applies if you configure processMode.
A maintenance release with several defect fixes, including prevention of stale configuration leakage and a frontend base-image update to address a Python vulnerability. It also includes fixes for workflow event handling, branding, and experiment image-registry behavior.
Action needed (2)
securityStale configuration across probes of the same type
Stale configuration no longer leaks across multiple probes of the same type.
securityFrontend base image updated to ubi9
The frontend base image is updated to ubi9 to resolve a Python vulnerability.
A substantial feature and maintenance release with API, UI, plugin, authentication-token, catalog, scaffolder, frontend, and SCM changes. It also updates vulnerable glob and rollup dependencies, fixes the . URL, and includes broad correctness and dependency updates.
Action needed (4)
securityhighThe glob and rollup dependencies, upgraded
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe glob dependency, upgraded to v13
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.
securityThe rollup dependency, upgraded to v4.59+
rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe . URL
The . resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.
Check if affected (22)
breakingThe auth. setting
Applies if you do not configure auth..
breakingThe SignInResolverFactoryOptions type parameters
Applies if you use SignInResolverFactoryOptions.
breakingThe catalog permission exports, removed
Applies if you use CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, or catalogPermissionExtensionPoint.
Plan ahead (6)
deprecatedThe show and showModal compatibility implementation, deprecated
Applies if you use show or showModal.
deprecatedThe auth. setting, deprecatedremoval date not announced
Applies if you configure auth..
deprecatedThe config. callback format, deprecated
Applies if you use config..
containerd v2.2.3 includes a disclosed security-related update to spdystream, alongside correctness, runtime, extraction, and dependency/toolchain changes. The recorded advisory is CVE-2026-35469.
Action needed (1)
securityhighspdystream dependency update for CVE-2026-35469
The spdystream dependency is updated in containerd v2.2.3 in connection with CVE-2026-35469.
containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.
Action needed (1)
securityhighThe spdystream update for CVE-2026-35469
The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.
Check if affected (1)
securityCredential sanitization before gRPC returns
Applies if you use pod events through the Container Runtime Interface (CRI).
A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.
Action needed (2)
securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2
The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.
securityhighgithub. v0.5.1 update
The release updates github. to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Check if affected (1)
securityCredential sanitization before gRPC returns
Applies if pod events are used.
containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.
Action needed (1)
securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Check if affected (1)
securitySanitized gRPC errors in pod events
Applies if you use pod events.
cert-manager v1.20.2 fixes invalid Helm YAML generation and updates Go to 1.. It also includes a security-related update to Go dependencies with reported vulnerabilities.
Action needed (1)
securityGo dependency updates
Go dependencies with reported vulnerabilities were updated in cert-manager v1.20.2. No advisory identifier is provided for this update.
This release contains operator-relevant correctness fixes across messaging, workflows, HTTP proxying, placement, and scheduling. It also updates the Go toolchain across the repository and its Docker images.
Action needed (1)
securityThe Go toolchain, updated to 1.25.9
The Go toolchain was upgraded from 1.25.8 to 1.25.9 across all modules and Docker images in the repository.
This release contains two security updates whose affected vulnerabilities are not identified. It also adds experimental incremental updates for gRPC synchronization.
Action needed (1)
securityThe vulnerability-updates security update
OpenFeature Core v0.15.2 includes a security update for vulnerability-updates.
This release contains security updates for flagd-proxy/v0.. The available notes do not identify the affected vulnerabilities or describe their scope.
Action needed (2)
securityThe vulnerability-updates entry for issue #1933
The vulnerability-updates entry records a security update for flagd-proxy/v0., tracked in issue #1933. The notes do not describe the affected vulnerability.
securityThe vulnerability-updates entry for issue #1934
The vulnerability-updates entry records a security update for flagd-proxy/v0., tracked in issue #1934. The notes do not describe the affected vulnerability.
flagd v0.15.2 includes two undisclosed security updates and a new experimental gRPC incremental-update capability. The experimental addition concerns deployments that use gRPC synchronization.
Action needed (2)
securityThe vulnerability-updates security update for issue #1933
flagd v0.15.2 includes the vulnerability-updates security update linked to issue #1933.
securityThe vulnerability-updates security update for issue #1934
flagd v0.15.2 includes the vulnerability-updates security update linked to issue #1934.
A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.
Action needed (1)
securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.
Check if affected (2)
securityhighPlugin verification when . is missing
Applies if you use plugins.
securityhighPlugin metadata version path traversal
Applies if you use plugins.
This release updates the Go dependency and toolchain to address multiple disclosed CVEs. It concerns deployments that rely on the release's bundled Go version.
Action needed (1)
securitycriticalThe Go toolchain, updated to 1.
The release updates the Go toolchain to 1. to address CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281.
This release updates the Go dependency to address multiple disclosed CVEs. It concerns deployments that receive their Go runtime or builds from this release.
Action needed (1)
securitycriticalThe Go dependency, upgraded to 1.
The release upgrades Go to 1. to address CVE-2026-32282, CVE-2026-32289, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281. The update ships in this release.
This release updates the Go toolchain used to build OPA binaries and images. It also includes multiple security fixes in that Go version.
Action needed (1)
securityThe Go toolchain, updated to 1.26.2
The Go version used to build OPA binaries and images is updated to 1.. This Go version contains multiple security fixes.
A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.
Action needed (6)
securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.
Check if affected (7)
securityWorkflows admin permission boundaries
Applies if you use Workflows.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
Plan ahead (1)
deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.
Release 0.15.1 fixes a memory leak caused by unbounded metrics cardinality and updates a dependency for an undisclosed security fix. The dependency update ships in the core v0.15.1 release.
Action needed (1)
securityThe github. dependency update
The github. module is updated to v4.1.4 for a security fix. This change ships in core v0.15.1.
This release includes a security update to the github. dependency. The release note does not disclose the nature of the vulnerability.
Action needed (1)
securitygithub. updated to v4.1.4
The github. module is updated to v4.1.4 in flagd-proxy v0.9.3 as a security fix. The note does not disclose the nature of the vulnerability.
This release fixes RPC flag defaulting, metrics-server process handling, and unbounded metrics cardinality. It also updates a dependency for an undisclosed security fix, which is the main consideration for users evaluating the release.
Action needed (1)
securityThe github. dependency, updated to v4.1.4
The github. module is updated to v4.1.4 in flagd/v0. for an undisclosed security fix.
This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.
Action needed (1)
securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.
Check if affected (1)
breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
Plan ahead (2)
deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
A security maintenance release fixes seven disclosed vulnerabilities. It also upgrades Quarkus and corrects an error caused by requests without a Host header.
Action needed (1)
securitymediumCVE-2026-1002 static handler component cache
CVE-2026-1002 fixes a flaw in the io. static handler component cache that could deny access to static files.
Check if affected (6)
securityhighCVE-2026-4634 scope processing
Applies if you use Scope Processing.
securityhighCVE-2026-4636 UMA policy resource injection
Applies if you use UMA.
securityhighCVE-2026-3872 OIDC redirect URI validation
Applies if you use OIDC.
A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.
Action needed (1)
securitycriticalThe google. dependency and CVE-2026-33186 resolution
The affected google. dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.
Check if affected (2)
breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
breakingStructural validation for . topics
Applies if you configure ..
cert-manager v1.20.1 contains bug corrections and a security-related dependency update. The gRPC vulnerability details are limited to the scanner reports, which state that it does not affect cert-manager.
Action needed (1)
securityThe google. dependency update
The google. dependency is bumped in cert-manager v1.20.1 to address a vulnerability reported by scanners. The report states that the vulnerability does not affect cert-manager.
A release with operator-facing compatibility changes, including feature removals, aligned chart and application versions, GHCR-only chart distribution, and a changed CRD conversion-webhook default. It also updates dependencies and the Python interpreter to resolve CVEs, with additional defect fixes and new service and architecture capabilities.
Action needed (1)
securityDependency and Python interpreter updates for CVE fixes
Many dependencies and the Python interpreter were updated to resolve CVEs.
Check if affected (6)
breakingCustom error responses and header-case mangling, removed
Applies if you use Ambassador Edge Stack's custom error responses or header-case mangling features.
breakingHelm chart and Emissary version alignment
Applies if you use the Helm chart.
breakingGHCR-only Helm chart distribution
Applies if you use Emissary's Helm charts.
Dapr v1.17.3 is a maintenance release with two dependency upgrades that resolve reported CVEs. It also includes correctness fixes for actor and service responses, placement dissemination, reconnect behavior, Scheduler participation, metrics, and Windows sidecar startup.
Action needed (2)
securitycriticalThe google. dependency, updated for CVE-2026-33186
The google. dependency is upgraded in this release to resolve CVE-2026-33186.
securitymediumThe golang. dependency, updated for CVE-2026-33809
This release upgrades golang. from v0.25.0 to v0.38.0, resolving CVE-2026-33809.
This release updates the Go toolchain and corrects Scheduler and container defects. The recorded Scheduler and Windows fixes require only an upgrade, with no operator configuration changes stated.
Action needed (1)
securityThe Go version, updated to 1.25.8
Dapr v1.16.11 updates the Go toolchain from 1.25.7 to 1.25.8.
This maintenance release includes a security mitigation for CVE-2026-33186 in grpc-go. It also contains ordinary fixes to application behavior and the user interface.
Action needed (1)
securitycriticalgrpc-go CVE-2026-33186 mitigation
A mitigation for CVE-2026-33186 in grpc-go ships in the release-3. line.
Argo CD v3.1.13 focuses on release artifact provenance and maintenance, with a security mitigation, a UI correction, and a dependency update. Container images are signed, and qualifying container images and CLI binaries receive SLSA Level 3 provenance.
Action needed (1)
securitycriticalgrpc-go CVE-2026-33186 mitigation
The release includes a mitigation for CVE-2026-33186 in grpc-go for release-3.1.
A maintenance release deprecates and removes install., updates the Go toolchain and JSON-RPC dependency, and corrects dashboard and webhook issues. It also includes vulnerability fixes in Go and UI packages.
Action needed (2)
securityGo package updates for vulnerability fixes
Go packages are upgraded to fix vulnerabilities.
securityUI package updates for vulnerability fixes
UI packages are upgraded to fix vulnerabilities.
Check if affected (1)
breakingThe install. installer, removed
Applies if you use install..
Plan ahead (1)
deprecatedThe install. installer, deprecated
Applies if you use install..
A maintenance release with security-related dependency updates and removal of the hostPort setting from example manifests. It also documents compatibility testing with Kubernetes 1.32 through 1.34.
Action needed (2)
securitycriticalgoogle. v1. update
google. is updated to v1., which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected by this advisory.
securityEnvoy v1. update
The Envoy dependency is updated to v1. to address security vulnerabilities.
Check if affected (1)
breakingRemoval of hostPort: 8002 from example manifests
Applies if you use hostPort in example manifests.
A maintenance release with updated Envoy and gRPC dependencies, plus a change to the example manifests. It is tested against Kubernetes 1.31 through 1.33.
Action needed (2)
securitycriticalgoogle. updated to v1.
google. is updated to v1., which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.
securityEnvoy updated to v1.
Envoy is updated to v1. to address security vulnerabilities and improve stability.
Check if affected (1)
breakinghostPort: 8002 removed from example manifests
Applies if hostPort: 8002 is configured in example manifests.
A maintenance release contains dependency security updates and an example-manifest cleanup. It also documents testing against Kubernetes 1.30 through 1.32.
Action needed (2)
securitycriticalgoogle. updated to v1.79.3 for CVE-2026-33186
The release updates google. to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.
securityEnvoy updated to v1.34.13
The release bumps Envoy to v1.34.13.
Check if affected (1)
breakingEnvoy metrics hostPort: 8002 removed from example manifests
Applies if example manifests use hostPort: 8002.
wasmCloud v2.0.0 adds operator-facing capabilities, changes CRD locations, updates dependencies, and fixes runtime and CLI behavior. The dependency update addresses the disclosed advisory RUSTSEC-2026-0007.
Action needed (2)
securitymediumLock file update for RUSTSEC-2026-0007
wasmCloud v2.0.0 updates the lock file to address RUSTSEC-2026-0007.
breakingCRD location moved from templates/crds to /crds
wasmCloud v2.0.0 moves CRDs from templates/crds to /crds.
A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.
Action needed (4)
securitycriticalgoogle. updated to 1.
The release updates google. to 1. to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo. updated to v1.
The release updates go. to v1.. The update addresses GO-2026-4394.
securityhighgolang. updated to v0.
The release updates golang. to v0. to resolve GO-2026-4559.
Check if affected (1)
securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.
A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.
Action needed (3)
securitycriticalThe google. dependency, updated to 1.
The release updates google. to 1. to resolve CVE-2026-33186.
securityhighThe go. dependency, updated to v1.
The release updates go. to v1. to resolve GO-2026-4394.
securityhighThe golang. dependency, updated to v0.
The release updates golang. to v0. to resolve GO-2026-4559.
Check if affected (2)
securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.
A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang. and google. to address reported issues.
Action needed (4)
securitycriticalgoogle. updated to 1.
The google. dependency is updated to 1. to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang. updated to v0.
The golang. dependency is updated to v0. to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.
A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.
Action needed (2)
securityBearer token validation
Harbor rejects bearer tokens issued before project creation.
breakingPort 9443 removed from the webhook event check
Port 9443 is removed from the Harbor IP used for webhook event checks.
Check if affected (2)
breakingThe pull-through cache is replaced by proxy cache
Applies if you use pull-through cache in Harbor.
breakingGCR replication removal
Applies if you use GCR replication in Harbor.
A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.
Action needed (3)
securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os. root boundaries
os. can no longer escape from a Root to access files outside the intended directory boundary.
Check if affected (2)
securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.
A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.
Action needed (1)
securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.
Check if affected (1)
securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.
