AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with bug fixes and dependency updates. The form-data update in /ui addresses CVE-2026-12143.
Action needed (1)
securityhighThe form-data dependency update for CVE-2026-12143
The form-data dependency is updated to version 4.0.6 in /ui to address CVE-2026-12143.
A broad operator-impacting maintenance release with security-related base image updates, API and configuration changes, scheduling capabilities, and deprecations and removals. Operators should review changed defaults and constraints and account for migration work affecting their configurations, APIs, and metrics.
Action needed (2)
securityThe alpine base image update
The alpine base image is updated from alpine:3. to alpine:3. to address security concerns.
securityThe alpine base image update
The alpine base image is updated from alpine:3. to alpine:3. to address security concerns.
Check if affected (8)
breakingThe cluster lease duration flags, removed
Applies if you configure either --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
breakingThe Estimator metric label value, removed
Applies if you use either estimating_plugin_execution_duration_seconds or estimating_plugin_extension_point_duration_seconds.
breakingThe Etcd. configuration field, removed
Applies if you configure Etcd..
Plan ahead (4)
deprecatedThe ReplicaRequirements. field deprecationdeprecated since v1.18.0
Applies if you use ReplicaRequirements..
deprecatedThe ComponentReplicaRequirements. field deprecationdeprecated since v1.18.0
Applies if you use ComponentReplicaRequirements..
deprecatedThe NodeClaim. field deprecationdeprecated since v1.18.0
Applies if you use NodeClaim..
A mixed maintenance and feature release with workload-affinity and anti-affinity support, encryption-at-rest capabilities, bug fixes, and updates to dependencies and default images. It also changes operational defaults and validation while deprecating or removing configuration flags and fields, so compatibility and configuration changes are part of the release.
Action needed (1)
breakingControllerPriorityQueue promotion to beta and default enablement
ControllerPriorityQueue is promoted to beta and enabled by default.
Check if affected (4)
breakingThe --etcd-init-image flag, removed from karmadactl init
Applies if you use the --etcd-init-image flag.
breakingnamespace validation for spec.
Applies if you use PropagationPolicy or OverridePolicy.
breakingDistinct GroupByLabelKey values in WorkloadAffinity
Applies if you configure WorkloadAffinity.
Plan ahead (2)
deprecatedEtcd. deprecationdeprecated since v1.17.0 · removal date not announced
Applies if you configure Etcd. in Karmada Init Configuration.
deprecatedDeprecation of cluster lease flagsdeprecated since v1.17.0 · removal date not announced
Applies if you use --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
A mixed maintenance and feature release with bug fixes, new APIs and capabilities, performance and instrumentation improvements, dependency updates, and deprecated field removals. Operators should review the removed fields and the updated dependency, while the release also adds multi-component scheduling, configurable initialization, eviction queue support, and new workload interpreters.
Action needed (1)
securitymediumThe github. dependency update
The github. dependency was bumped to v3.5.5 to address security concerns identified by GO-2025-3900.
Check if affected (4)
breakingThe external etcd fields CAData, CertData, and KeyData, removed
Applies if you configure CAData, CertData, or KeyData.
breakingThe init command's default component images
Applies if you run the init command.
breakingA 32s default timeout for the member cluster client
Applies if you use the member cluster client.
Plan ahead (2)
deprecatedThe --etcd-init-image flag, deprecatedremoval date not announced
Applies if you use --etcd-init-image.
breakingThe Prometheus metric labels cluster and cluster_name, replaced by member_clusterremoval planned in 1.18
Applies if you use the cluster or cluster_name metric labels.
A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.
Action needed (3)
securityhighoras. update for GHSA-fxhp-mv3v-67qp
oras. is updated from 2. to 2. to address GHSA-fxhp-mv3v-67qp.
breakingReadHeaderTimeout default
All HTTP servers now set ReadHeaderTimeout to 32s.
breakingPartial set and -object rule name conflicts
The AST rejects partial set and -object rules that share a name.
Check if affected (2)
securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
breakingStricter := safety checking
Applicability is not stated in the release notes.
A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.
Action needed (2)
securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github. dependency, updated
The github. dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).
Check if affected (9)
breakingStricter network interface binding admission
Applies if you configure network interface bindings.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
Plan ahead (2)
deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.
A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.
Action needed (1)
breakingThe disk concurrency semaphore, increased to 4096 slots
The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.
Check if affected (2)
securityAuthentication checks with no_auth_user and auth callouts
Applies if you configure no_auth_user and use auth callouts.
securityTLS verify_and_map authentication with blank passwords
Applies if you use TLS and configure verify_and_map.
Prometheus v3.13.2 updates dependencies for two disclosed vulnerabilities and includes related transitive dependency upgrades. It also fixes a PromQL SIGBUS crash when the data disk is full.
Action needed (2)
securityhighgolang. update for CVE-2026-56852
golang. updates from v0.38.0 to v0.39.0 in Prometheus v3.13.2 for CVE-2026-56852.
securityhighgoogle. update for GHSA-hrxh-6v49-42gf
google. updates from v1.81.1 to v1.82.1 in Prometheus v3.13.2 for GHSA-hrxh-6v49-42gf.
Volcano v1.15.1 is a maintenance release with a dependency update, configuration-format compatibility changes, and correctness fixes. It also includes implementation-only changes with no operator-facing impact.
Action needed (1)
securityThe golang. dependency, upgraded
Volcano v1.15.1 upgrades golang. from v0. to v0., incorporating upstream SSH security fixes released in v0..
cert-manager v1.21.1 is a maintenance release with fixes for regressions and updates to dependencies affected by reported security vulnerabilities. The dependency updates concern all installations, while the regression fixes address controller behavior and require no setup change.
Action needed (4)
securityThe golang. dependency, updated to v0.40.0
The golang. dependency is updated to v0.40.0 to fix a reported security vulnerability.
securityThe google. dependency, updated to v1.82.1
The google. dependency is updated to v1.82.1 to fix a reported security vulnerability.
securityThe github. dependency, updated to v0.29.0
The github. dependency is updated to v0.29.0 to fix a reported security vulnerability.
securityThe go. dependency, updated to v1.44.0
The go. dependency is updated to v1.44.0 to fix a reported security vulnerability.
A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.
Action needed (11)
securitygoogle. v1.79.3
The google. module is updated to v1.79.3 in the main branch.
securitygoogle. v1.82.1
The google. module is updated to v1.82.1 in the v1.20 branch.
securityhelm. v4.1.4
The helm. module is updated to v4.1.4 in the main branch.
securitygithub. v1.6.3
The github. module is updated to v1.6.3.
securitygithub. v4.1.4
The github. module is updated to v4.1.4.
securitygithub. v0.5.1
The github. module is updated to v0.5.1.
breakingcni. CNI configuration version
The default CNI configuration version for cni. changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.
Check if affected (28)
securitytbid traffic host namespace handling
Applies if you use tbid traffic.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
Plan ahead (6)
deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[]. or interfaces[]..
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
A feature and maintenance release that adds runtime, plugin, service, component, and pooling capabilities while changing the default NATS behavior. It also includes dependency updates and fixes for runtime and observability defects.
Action needed (1)
breakingThe NATS consumer-group default
NATS now uses consumer groups by default in the release.
v1.19.8 is a maintenance release with a security-related dependency update and behavioral improvements. The recorded dependency change updates the vulnerable go text package from v0.37 to a newer version.
Action needed (1)
securityThe go text package, updated from v0.37
The go text package is updated from v0.37 to the latest version because v0.37 has a vulnerability. This dependency update ships in v1.19.8.
This release combines ordinary bug fixes with security-related updates. It also improves blob/HTTP synchronization, with no announced operator-facing removals, deprecations, or default changes.
Action needed (2)
securityThe google. module update to v1.82.1
The google. module is updated to v1.82.1 in core v0.16.1.
securityThe vulnerability-updates update
vulnerability-updates is updated in core v0.16.1.
A maintenance release with a bug-fix heading, a new server timeout setting, dependency updates, and security-related updates. The google. update requires upgrading.
Action needed (2)
securityThe google. module, updated to v1.82.1
The google. module is updated to v1.82.1 as a security-related dependency change.
securityThe vulnerability-updates dependency update
The release updates vulnerability-updates as a security-related dependency change.
flagd/v0. combines bug fixes with security dependency updates and a configurable sync-server capability. The security notes do not include advisory identifiers or flaw details, while the sync-server changes include server timeouts and configurable gRPC keepalive enforcement.
Action needed (3)
securitySecurity dependency updates
Security dependencies are updated in flagd/v0..
securityThe google. module update
The google. module is updated to v1. in flagd/v0..
securityVulnerability updates
Vulnerability updates are included in flagd/v0. as a security change.
A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.
Action needed (3)
securityhighThe google. dependency update
The release updates google. to version 1. to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.
Check if affected (1)
securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.
A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.
Action needed (5)
securitycriticalThe golang. dependency update
The golang. dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.
securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8
An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3
The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.
securityhighThe google. dependency update
The google. dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default value
The default value for snapshotLimitByte is set to a reasonable value in this release.
A maintenance release with correctness and security fixes, timeout behavior changes, and dependency and toolchain updates. It also updates the build toolchain used to compile binaries.
Action needed (5)
securityhighWatch response authorization for key ranges
The watch authorization issue is fixed: a user with read permission on one key could no longer receive watch responses for every key starting from that key. The fix addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener
A tlsHandshakeTimeout is set for tlsListener. The change addresses GHSA-6vch-q96h-7gc3.
securityhighThe golang. dependency, updated to v0.56.0
The golang. dependency is updated to v0.56.0 to address GO-2026-5942.
securityhighThe golang. dependency, updated to v0.39.0
The golang. dependency is updated to v0.39.0 to address GO-2026-5970.
securityhighThe google. dependency, updated to 1.82.1
The google. dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.
Action needed (7)
securityThe github. module update to v1.
Crossplane v2.3.4 updates the github. module to v1. for security fixes.
securityThe github. module update to v3.
Crossplane v2.3.4 updates the github. module to v3. for security fixes.
securityThe github. module update to v2.
Crossplane v2.3.4 updates the github. module to v2. for security fixes.
securityThe github. module update to v1.
Crossplane v2.3.4 updates the github. module to v1. for security fixes.
securityCombined security dependency updates
Crossplane v2.3.4 includes combined security updates for grpc, golang., and golang..
securityThe golang. module update to v0.
Crossplane v2.3.4 updates the golang. module to v0. for security fixes.
securityThe golang. module update to v0.
Crossplane v2.3.4 updates the golang. module to v0. for security fixes.
Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.
Action needed (5)
securityThe github. module update to v1.5.2
Crossplane v2.2.4 updates the github. module to v1.5.2.
securityThe github. module update to v3.0.6
Crossplane v2.2.4 updates the github. module to v3.0.6.
securityThe github. module update to v2.1.0
Crossplane v2.2.4 updates the github. module to v2.1.0.
securityThe github. module update to v1.2.0
Crossplane v2.2.4 updates the github. module to v1.2.0.
securityCombined grpc, x/net, and x/text dependency updates
Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.
Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.
Action needed (7)
securityThe github. module at v1.
The github. module is updated to v1. in Crossplane v2.1.8.
securityThe github. module at v2.
The github. module is updated to v2. in Crossplane v2.1.8.
securityThe github. module at v2.
The github. module is updated to v2. in Crossplane v2.1.8.
securityThe Go toolchain at 1.
The Go toolchain is updated to 1. in Crossplane v2.1.8.
securityThe github. module at v1.
The github. module is updated to v1. in Crossplane v2.1.8.
securityCombined grpc, x/net, and x/text dependency updates
Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.
securityThe golang. module at v0.
The golang. module is updated to v0. in Crossplane v2.1.8.
A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.
Action needed (4)
securityThe github. module, updated to v1.5.2
The github. module is updated to v1.5.2 in the release-1.20 line.
securityThe Go toolchain, updated to 1.25.12
The Go toolchain is updated to 1.25.12 in the release-1.20 line.
securityThe alpine Docker tag, updated to v3.24
The alpine Docker tag is updated to v3.24 in the release-1.20 line.
securitySecurity updates for grpc, x/net, and x/text
Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.
This release tightens Gateway API and service-port handling and corrects tracing identity construction. It also updates dependencies and shipped components, with no security advisories or explicitly described vulnerabilities.
Action needed (1)
breakingUndefined service port requests disallowed
The destination component now disallows requests to service ports that are not defined.
Check if affected (1)
breakingGateway API checks during Helm installation
Applies when you use Helm.
A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.
Action needed (3)
securitymediumgithub. updated for CVE-2025-69725
github. is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo. and github. updates
go. is updated to v1.17.7, and the github. dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.
A release with backend compatibility removals, forced migrations, new configuration and CLI capabilities, and correctness fixes across storage, extensions, and related components. It does not disclose security advisories or security-specific flaws.
Action needed (1)
breakingTemplate creation through esclient
Template creation moves to esclient, and legacy mapping rendering is retired.
Check if affected (3)
breakingSupport for elasticsearch v6, removed
Applies if you use elasticsearch v6.
breakingThe jaegermcp extension, merged into jaegerquery
Applies if you use the jaegermcp extension.
breakingExpired stable feature gates, removed
Applicability is not stated in the release notes.
Plan ahead (1)
deprecatedThe legacy flag, deprecated
Applies if you use legacy flag.
Release 3.31.0 contains a dependency update addressing vulnerabilities in graphql/server. It also includes correctness fixes across probes, GraphQL, authentication, infrastructure, and experiment handling.
Action needed (1)
securityDependencies in graphql/server updated
Dependencies in graphql/server are updated to fix vulnerabilities. The update ships in Release 3.31.0.
A substantial mixed feature and maintenance release adds backend, frontend, catalog, authentication, webhook, and TechDocs capabilities alongside dependency updates and defect fixes. It also includes operator-visible changes to APIs, configuration validation, OpenAPI tooling, and MCP transport behavior; no security advisories or security-specific fixes are disclosed.
Action needed (1)
breakingOpenAPI breaking change detection with oasdiff
@useoptic/optic and @useoptic/openapi-utilities have been replaced with oasdiff for OpenAPI breaking change detection.
Check if affected (12)
breakingSchema loading rejects invalid imports
Applicability is not stated in the release notes.
breakingThe package schema openapi init and repo schema openapi test commands, removed
Applies if you use package schema openapi init or repo schema openapi test.
breakingMutually exclusive userGroupMember. and user. configuration
Applies if you configure both userGroupMember. and user..
Plan ahead (3)
deprecatedOpaque entity header extension point deprecation
Applies if you use the opaque entity header extension point.
deprecatedDynamic Client Registration deprecation warning
Applies if you enable Dynamic Client Registration.
deprecatedStable auth. configuration
Applies if you configure auth. or auth..
A maintenance release with operator-relevant fixes and behavior changes, plus security work in the 1.18 release line. It includes namespace-boundary enforcement for generators and security dependency updates.
Action needed (1)
securitySecurity dependency updates
Security dependency updates from #16340 are backported to release-1..
Check if affected (1)
securityNamespace-boundary enforcement in generator.
Applies if you use generator..
A release with operator-visible behavior corrections, new capabilities, configuration changes, and updated defaults. The changes span CoreDNS core behavior and multiple plugins, with no security advisories or explicitly described vulnerabilities.
Action needed (1)
breakingGo TLS defaults in core
The core component uses Go TLS defaults in this release.
Check if affected (1)
breakingDefault truncate amount for bare truncate
Applies if you configure truncate.
A maintenance release with CRI and image-distribution fixes. The CRI constraint on CreateContainer requests may require action, while the other fixes take effect through the upgrade.
Action needed (1)
breakingCreateContainer rejection for stopped sandboxes
The CRI now rejects CreateContainer requests when the sandbox is not running. This constraint ships in containerd v2.2.6.
This release includes a security-related dependency cleanup and a dependency update. The github. dependency moves from 1. to 1..
Action needed (1)
securityThe containerd v1 dependency, removed
The containerd v1 dependency is removed in Helm v3. to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.
A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.
Action needed (2)
securityMigration from github. to github.
Dependencies from github. were migrated to their github. equivalents to resolve CVEs. The migration ships in this release.
breakingRPC metrics from agent health check loopback calls
Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.
Check if affected (1)
breakingJWT-SVID serving by the delegated API
Applies if you use the delegated API for admin or downstream entries.
This Flatcar release is a security update focused on fixes for disclosed Linux vulnerabilities. It also updates the Linux and ca-certificates dependencies.
Action needed (1)
securitycriticalLinux security fixes for disclosed CVEs
The Linux package carries fixes associated with CVE-2026-46242, CVE-2026-52908, CVE-2026-52910, CVE-2026-52917, CVE-2026-52924, CVE-2026-52929, CVE-2026-52930, CVE-2026-52935, CVE-2026-52939, CVE-2026-52942, CVE-2026-52946, CVE-2026-52947, CVE-2026-52948, CVE-2026-53131, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53140, CVE-2026-53143, CVE-2026-53144, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53152, CVE-2026-53154, CVE-2026-53156, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160, CVE-2026-53161, CVE-2026-53168, CVE-2026-53175, CVE-2026-53176, CVE-2026-53177, CVE-2026-53180, CVE-2026-53181, CVE-2026-53182, CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53186, CVE-2026-53189, CVE-2026-53190, CVE-2026-53191, CVE-2026-53192, CVE-2026-53193, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53198, CVE-2026-53199, CVE-2026-53202, CVE-2026-53203, CVE-2026-53205, CVE-2026-53207, CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53212, CVE-2026-53213, CVE-2026-53214, CVE-2026-53215, CVE-2026-53216, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53221, CVE-2026-53223, CVE-2026-53225, CVE-2026-53227, CVE-2026-53228, CVE-2026-53229, CVE-2026-53230, CVE-2026-53233, CVE-2026-53234, CVE-2026-53235, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238, CVE-2026-53239, CVE-2026-53241, CVE-2026-53242, CVE-2026-53245, CVE-2026-53247, CVE-2026-53249, CVE-2026-53251, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53271, CVE-2026-53272, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53328, CVE-2026-53329, CVE-2026-53331, CVE-2026-53332, CVE-2026-53336, CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53346, CVE-2026-53347, CVE-2026-53349, CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-53354, CVE-2026-53355, CVE-2026-53356, CVE-2026-53359, CVE-2026-53361, CVE-2026-53362. The fixes ship in Flatcar stable-4593..
This Flatcar release is a security update with fixes for Linux issues identified by CVE advisories. It also updates Linux and ca-certificates.
Action needed (1)
securitycriticalLinux security fixes for CVE advisories
Linux receives security fixes associated with CVE-2026-46242, CVE-2026-46243, CVE-2026-46244, CVE-2026-46275, CVE-2026-46323, CVE-2026-52908, CVE-2026-52910, CVE-2026-52912, CVE-2026-52913, CVE-2026-52914, CVE-2026-52915, CVE-2026-52916, CVE-2026-52917, CVE-2026-52918, CVE-2026-52919, CVE-2026-52921, CVE-2026-52922, CVE-2026-52923, CVE-2026-52924, CVE-2026-52926, CVE-2026-52927, CVE-2026-52929, CVE-2026-52930, CVE-2026-52931, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52941, CVE-2026-52942, CVE-2026-52943, CVE-2026-52944, CVE-2026-52946, CVE-2026-52947, CVE-2026-52948, CVE-2026-53080, CVE-2026-53131, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53143, CVE-2026-53144, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53154, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160, CVE-2026-53161, CVE-2026-53168, CVE-2026-53176, CVE-2026-53177, CVE-2026-53181, CVE-2026-53182, CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53186, CVE-2026-53189, CVE-2026-53190, CVE-2026-53192, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53198, CVE-2026-53199, CVE-2026-53207, CVE-2026-53208, CVE-2026-53209, CVE-2026-53212, CVE-2026-53213, CVE-2026-53214, CVE-2026-53215, CVE-2026-53216, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53221, CVE-2026-53223, CVE-2026-53225, CVE-2026-53227, CVE-2026-53228, CVE-2026-53230, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238, CVE-2026-53239, CVE-2026-53242, CVE-2026-53245, CVE-2026-53247, CVE-2026-53249, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53271, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53329, CVE-2026-53331, CVE-2026-53336, CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53347, CVE-2026-53349, CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-53354, CVE-2026-53355, CVE-2026-53356, CVE-2026-53357, CVE-2026-53358, CVE-2026-53359, CVE-2026-53361, and CVE-2026-53362.
Prometheus v3.5.5 includes a Go 1.25.12 toolchain change and a disclosed security fix in the UI. The security fix concerns the sanitize-html dependency and CVE-2026-53606.
Action needed (1)
securitymediumThe sanitize-html dependency update for CVE-2026-53606
The Prometheus UI updates sanitize-html to v2.17.5 to fix CVE-2026-53606.
A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.
Action needed (1)
securityPre-account takeover attack exposure
The release corrects an issue that provided room for pre-account takeover attacks.
Check if affected (19)
securitymediumCVE-2026-9796, admin role rename authorization
Applies if you use manage-clients.
securitymediumCVE-2026-9689, OIDC redirect URI parameter handling
Applies if you use OIDC.
securitymediumCVE-2026-9798, CIBA account lockout
Applies if you run the CIBA authentication flow.
Plan ahead (4)
deprecatedThe V1 API, deprecated
Applies if you use V1.
deprecatedThe Require Discoverable Credential option, deprecated
Applies if you configure the Require Discoverable Credential option.
deprecatedThe Twitter IDP implementation, deprecated
Applies if you use the Twitter IDP implementation.
A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.
Action needed (1)
securityThird-party dependency upgrades for TiKV 8.5
TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.
Check if affected (1)
breakingInvalid max_ts updates rejected by default
Applies if you do not set storage..
A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang..
Action needed (1)
securityhighgolang. updated to v0.
The release updates golang. to v0. to resolve CVE-2026-46598, CVE-2026-39835, CVE-2026-39828, and CVE-2026-46597.
Check if affected (1)
securityCRL enforcement bypass on the gRPC listener, fixed
Applies if you configure --listen-client-http-urls.
A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.
Action needed (1)
securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186
The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.
Check if affected (4)
securityReceive tenant ID validation
Applies if you run Receive.
breakingQuery-Frontend time_taken field renamed to time_taken_ms
Applies if you run Query-Frontend.
breaking--shipper. flag removed
Applies if you configure --shipper..
