RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
OpenFGAv1.17.1SecurityJun 5, 2026
ACTION 2OTHER 3View full analysis

OpenFGA v1.17.1 combines correctness fixes with security-related Go toolchain and image dependency updates. The security updates address Go standard library vulnerabilities in the toolchain and released images.

Action needed (2)

  • securityThe Go toolchain, updated to 1.26.4

    OpenFGA v1.17.1 updates the Go toolchain version to 1.26.4 to address Go standard library vulnerabilities.

  • securitygrpc-health-probe updated to v0.4.52

    Released images update grpc-health-probe to v0.4.52, rebuilt with Go 1.26.4, so they no longer ship the Go standard library vulnerabilities addressed by this update.

Source ↗
Istio1.29.4Networking & MessagingJun 4, 2026
ACTION 1OTHER 6View full analysis

A maintenance release with a security fix for Envoy and operator-relevant correctness fixes across Istio ambient, gateway, routing, and CNI behavior. It also adds automatic fallback from the nftables backend to iptables when the bundled nft binary lacks JSON support.

Action needed (1)

  • securityhighCVE-2026-47774 Envoy memory exhaustion fix

    CVE-2026-47774 fixes an Envoy memory exhaustion issue in which specially crafted HTTP/2 requests could bypass request header size accounting and trigger excessive memory use. The fix ships in Envoy.

Source ↗
Istio1.28.8Networking & MessagingJun 4, 2026
ACTION 1OTHER 3View full analysis

A maintenance release with a disclosed Envoy denial-of-service fix and additional correctness fixes. The security fix addresses memory exhaustion from specially crafted HTTP/2 requests, while the other corrections do not require setup changes.

Action needed (1)

  • securityhighThe Envoy denial-of-service vulnerability CVE-2026-47774, fixed

    CVE-2026-47774 fixes an Envoy denial-of-service vulnerability in which specially crafted HTTP/2 requests could cause excessive memory consumption. The fix accounts for cookie header bytes during request header size validation and limits total decoded header size in HPACK processing.

Source ↗
Istio1.30.1Networking & MessagingJun 4, 2026
ACTION 1CHECK 1OTHER 15View full analysis

A maintenance release with an Envoy denial-of-service security fix, defect corrections, new operator-facing capabilities, a dependency update, and removal of a feature-gate guard. The security fix addresses disclosed advisory CVE-2026-47774.

Action needed (1)

  • securityhighCVE-2026-47774 Envoy denial-of-service fix

    The fix addresses CVE-2026-47774 in Envoy, where specially crafted HTTP/2 requests could exhaust process memory because decoded header size was not fully limited during request validation.

Check if affected (1)

  • breakingPILOT_ENABLE_ALPHA_GATEWAY_API guard removed from ListenerSet

    Applies if you use the ListenerSet API.

Source ↗
Envoyv1.38.1Networking & MessagingJun 4, 2026
ACTION 1CHECK 4OTHER 2View full analysis

A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.

Action needed (1)

  • securityhighnghttp2 patch for CVE-2026-27135

    The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Check if affected (4)

  • securityhighHTTP/2 header-limit enforcement and cookie accounting

    Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.

  • securityOAuth2 HMAC verification timing side-channel fix

    Applies if you use oauth2.

  • breakingRouter transport-failure reason response body

    Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.

  • + 1 more on the release page
Source ↗
Keycloak26.6.3SecurityJun 4, 2026
ACTION 2CHECK 15OTHER 30View full analysis

A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.

Action needed (2)

  • securityhighCVE-2026-4800 lodash code injection

    CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.

  • securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization

    CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Check if affected (15)

Source ↗
Envoyv1.37.3Networking & MessagingJun 4, 2026
ACTION 1CHECK 2OTHER 2View full analysis

A maintenance release focused on security and correctness fixes. The remaining heading-only items have no operator-facing changes.

Action needed (1)

  • securityhighnghttp2 CVE-2026-27135 patch

    The nghttp2 CVE-2026-27135 patch is applied in the release.

Check if affected (2)

  • securityhighHTTP/2 header list limits and cookie accounting

    Applies if you use HTTP/2.

  • securityOAuth2 HMAC verification timing

    Applies if you use oauth2.

Source ↗
Envoyv1.36.7Networking & MessagingJun 4, 2026
ACTION 1CHECK 2OTHER 2View full analysis

Envoy v1.36.7 is a security-focused update with changes to HTTP/2 handling and OAuth2 authentication. It also includes an nghttp2 security patch, so deployments using these components are directly affected.

Action needed (1)

  • securityhighThe nghttp2 CVE-2026-27135 patch

    Envoy v1.36.7 applies the nghttp2 patch for CVE-2026-27135 in its HTTP/2 handling.

Check if affected (2)

  • securityhighHTTP/2 header-limit enforcement and cookie accounting

    Applies if you use HTTP/2 with configured header list or request-header limits.

  • securityOAuth2 HMAC verification timing side-channel fix

    Applies if you use the OAuth2 filter.

Source ↗
Envoyv1.35.11Networking & MessagingJun 3, 2026
ACTION 1CHECK 2OTHER 4View full analysis

Envoy v1.35.11 is a security-focused release with fixes in HTTP/2, OAuth2, and nghttp2. It also includes ordinary bug fixes and new statistics capabilities, while the security changes are the ones that require upgrading.

Action needed (1)

  • securityhighThe nghttp2 CVE-2026-27135 patch

    Envoy v1.35.11 applies the nghttp2 patch for CVE-2026-27135.

Check if affected (2)

  • securityhighHTTP/2 header limits and cookie accounting

    Applies if you use HTTP/2 request header limits.

  • securityOAuth2 HMAC verification timing protection

    Applies if you use OAuth2 HMAC verification.

Source ↗
KubeVirtv1.8.3Orchestration & ManagementJun 3, 2026
ACTION 2PLAN 1OTHER 13View full analysis

A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc update to 1.79.3

    The google.golang.org/grpc dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.

  • securitySymlink traversal fix in the VMExport directory handler

    The VMExport directory handler is fixed to prevent symlink traversal.

Plan ahead (1)

  • deprecatedDeprecated kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total recording rules

    Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗
KubeVirtv1.7.4Orchestration & ManagementJun 3, 2026
ACTION 1OTHER 5View full analysis

KubeVirt v1.7.4 includes correctness fixes and behavior changes affecting PCI topology and IPv6 migration. It also updates the gRPC dependency to address CVE-2026-33186.

Action needed (1)

  • securitycriticalThe google.golang.org/grpc dependency update for CVE-2026-33186

    KubeVirt v1.7.4 updates google.golang.org/grpc to version 1.79.3 to remediate CVE-2026-33186.

Source ↗
KubeVirtv1.6.6Orchestration & ManagementJun 3, 2026
ACTION 1OTHER 8View full analysis

KubeVirt v1.6.6 includes a dependency update for CVE-2026-33186. The recorded change affects the gRPC dependency shipped with this release.

Action needed (1)

  • securitycriticalgoogle.golang.org/grpc update for CVE-2026-33186

    KubeVirt v1.6.6 bumps google.golang.org/grpc to remediate CVE-2026-33186.

Source ↗
Jaegerv2.19.0ObservabilityJun 3, 2026
ACTION 1OTHER 15View full analysis

This release adds API and storage capabilities, updates API query naming and defaults, and includes correctness fixes. No security advisories or security-specific fixes are disclosed.

Action needed (1)

  • breakingThe searchdepth default in the trace-summaries endpoint

    The default for searchdepth changed in the trace-summaries endpoint.

Source ↗
wasmCloudv2.3.0Orchestration & ManagementJun 3, 2026
ACTION 2OTHER 12View full analysis

Version v2.3.0 adds workload configuration and telemetry capabilities while correcting wash and runtime defects. It also changes RBAC scope support and updates dependencies, including security patches and reported advisory fixes.

Action needed (2)

  • securityThe wasmtime 44.0.2 security patch

    The release updates wasmtime to 44.0.2 as a security patch.

  • securityReported dependency security advisories

    The dependency set includes patches for reported security advisories.

Source ↗
containerdv2.1.8Kubernetes CoreJun 2, 2026
ACTION 1OTHER 4View full analysis

containerd v2.1.8 includes a disclosed security correction identified by CVE-2026-46680 and GHSA-fqw6-gf59-qr4w. The release also contains operator-facing runtime and snapshotter changes in its broader changelog.

Action needed (1)

  • securityhighCVE-2026-46680 security correction

    containerd v2.1.8 includes a correction for CVE-2026-46680, associated with GHSA-fqw6-gf59-qr4w.

Source ↗
OpenFGAv1.17.0SecurityJun 2, 2026
ACTION 1OTHER 1View full analysis

OpenFGA v1.17.0 adds configurable trace sampling and changes cache key generation. The release concerns deployments that configure tracing or depend on cache key behavior.

Action needed (1)

  • securityTLV-based cache key generation

    OpenFGA v1.17.0 redesigns cache key generation with TLV binary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.

Source ↗
etcdv3.5.31Kubernetes CoreJun 1, 2026
ACTION 1OTHER 3View full analysis

A maintenance release with correctness fixes and dependency updates. The golang.org/x/crypto update addresses GO-2026-5026.

Action needed (1)

  • securitycriticalThe golang.org/x/crypto dependency update for GO-2026-5026

    The golang.org/x/crypto dependency is updated to v0.52.0 to address GO-2026-5026.

Source ↗
Volcanov1.15.0Orchestration & ManagementJun 1, 2026
ACTION 4CHECK 2OTHER 83View full analysis

A feature and operational-hardening release that adds alpha scheduling capabilities, new scheduler and Helm configuration, and fixes scheduler and integration stability issues. Operators should review Kubernetes and DRA compatibility requirements, the changed DRA default, and the disclosed denial-of-service and Prometheus security fixes.

Action needed (4)

  • securitymediumPrometheus dependency update for GHSA-vffh-x6r8-xx99

    Updates github.com/prometheus/prometheus to address stored XSS advisory GHSA-vffh-x6r8-xx99.

  • securitymediumAdmission webhook request body limits

    The admission webhook now limits request bodies, fixing the denial-of-service risk identified by CVE-2026-44247 and GHSA-8wxp-xxp2-rcgx.

  • breakingDRA scheduling integration default

    DRA scheduling integration is enabled by default.

  • breakingDRA scheduling integration default behavior

    DRA scheduling integration is enabled by default to align with Kubernetes 1.34 and later behavior. Set predicate.DynamicResourceAllocationEnable to false to disable it.

Check if affected (2)

  • breakingOpt-in SchedulingGatesQueueAdmission

    Applies if you enable SchedulingGatesQueueAdmission.

  • breakingOpt-in gang-aware preemption and reclamation

    Applies if you configure gangPreempt and gangReclaim and do not configure preempt or reclaim.

Source ↗
Karmadav1.18.0Orchestration & ManagementMay 30, 2026
ACTION 1CHECK 9OTHER 35View full analysis

A feature and maintenance release that adds overflow scheduling and scheduling overcommit protection, along with API, default, constraint, metric, and flag changes. It also includes a security-related alpine base-image update and numerous defect corrections.

Action needed (1)

  • securityThe alpine base image update

    The alpine base image has changed from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (9)

  • breakingThe overflowAffinities field

    Applies if you configure overflowAffinities.

  • breakingStricter clusterTolerations operator validation

    Applies if you set spec.placement.clusterTolerations with Lt or Gt.

  • breakingThe operator's default verbosity level

    Applies if you run the operator.

  • + 6 more on the release page
Source ↗
OpenCostv1.120.3ObservabilityMay 29, 2026
ACTION 1CHECK 1OTHER 51View full analysis

A maintenance release with dependency updates, correctness fixes, and new cloud and query capabilities. Configuration and output behavior also change, along with a Go dependency upgrade for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Action needed (1)

  • securityhighGo dependency upgrades for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986

    Go dependencies are upgraded for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Check if affected (1)

  • breakingThe MCP_SERVER_ENABLED default is false

    Applies if you do not configure MCP_SERVER_ENABLED.

Source ↗
Confidential Containersv0.21.0SecurityMay 29, 2026
ACTION 1PLAN 4OTHER 16View full analysis

A release with Trustee, KBS, attestation, and platform-support changes, plus a security advisory fix. It also deprecates several CAA components and images planned for removal in 0.22.

Action needed (1)

  • securityGHSA-84rc-2q4r-45pc advisory fix

    The release patches GHSA-84rc-2q4r-45pc in the guest components.

Plan ahead (4)

  • deprecatedpacker-built CAA podvm image deprecationdeprecated since 0.17 · removal planned in 0.22

    Applies if you use the packer-built CAA podvm image.

  • deprecatedCAA docker provider deprecationdeprecated since 0.20 · removal planned in 0.22

    Applies if you use the CAA docker provider.

  • deprecatedFedora-based mkosi-built CAA podvm image deprecationdeprecated since 0.20 · removal planned in 0.22

    Applies if you use the Fedora-based mkosi-built CAA podvm image.

  • + 1 more on the release page
Source ↗
Kubescapev4.0.9SecurityMay 29, 2026
ACTION 3CHECK 3OTHER 105View full analysis

A broad maintenance release with correctness fixes, new CLI and reporting capabilities, anonymization updates, a performance improvement, added validation, and dependency refreshes. It also includes security fixes alongside changes to output and push defaults.

Action needed (3)

  • securityDependency updates for security advisories

    Dependencies are updated to address security advisories.

  • securityEnvFrom clearing in container data removal

    removeContainersData now clears EnvFrom to prevent secret name leakage.

  • securityEnv[].ValueFrom clearing in container data removal

    removeContainersData and removeEphemeralContainersData now clear Env[].ValueFrom.

Check if affected (3)

  • security/v1/results access control hardening

    Applies if you use /v1/results.

  • breakingThe pdf/html output default changed to file output

    Applies if you use pdf/html output.

  • breakingThe push default changed to opt-in

    Applies if you use push.

Source ↗
Contourv1.33.5Networking & MessagingMay 28, 2026
ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a security fix for invalid HTTPProxy configurations and an update to golang.org/x/net. It also updates the Go toolchain to 1.25.10 and is tested against Kubernetes 1.32 through 1.34.

Action needed (1)

  • securitycriticalgolang.org/x/net updated to v0.55.0, CVE-2026-39821

    Contour v1.33.5 updates golang.org/x/net to v0.55.0. The change addresses CVE-2026-39821.

Check if affected (1)

  • securitymediumInvalid HTTPProxy configuration rejected, GHSA-g3xr-5w5j-w4q4

    Applies if you configure HTTPProxy with a fallback certificate and enable JWT verification.

Source ↗
Prometheusv3.12.0ObservabilityMay 28, 2026
ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

  • breakingConcurrent fgprof profile rejection

    The API rejects concurrent fgprof profiles.

Check if affected (3)

  • securityRemote Write decoded-length constraint

    Applies if you use Remote Write.

  • securityPlaintext secret exposure in STACKIT SD

    Applies if you use STACKIT SD.

  • breakingDecompressed body-size limit for OTLP write requests

    Applies if you use OTLP.

Source ↗
OpenFGAv1.16.1SecurityMay 28, 2026
ACTION 1OTHER 3View full analysis

OpenFGA v1.16.1 includes a third-party dependency update for multiple CVEs in the Go standard library. It also corrects defects in the experimental weighted_graph_check behavior.

Action needed (1)

  • securityThe grpc-health-probe dependency update

    grpc-health-probe is updated to v0.4.50 to address multiple CVEs in the Go standard library.

Source ↗
Argov3.3.11CI/CD & App DeliveryMay 28, 2026
ACTION 1OTHER 6View full analysis

Argo CD v3.3.11 contains bug fixes and a UI dependency update addressing CVE-2026-41240. The release concerns deployments using the affected UI dependency.

Action needed (1)

  • securitymediumThe redoc/dompurify dependency, updated to v3.4.0

    The /ui dependency redoc/dompurify is updated to v3.4.0 to address CVE-2026-41240.

Source ↗
Rookv1.19.6Storage & DataMay 27, 2026
ACTION 1OTHER 8View full analysis

This release includes a security-related dependency update in CI. The change affects builds that use golang.org/x/net.

Action needed (1)

  • securitycriticalThe golang.org/x/net dependency, updated to v0.55.0

    CI updates golang.org/x/net from its previous version to v0.55.0 to fix GO-2026-5026.

Source ↗
Flatcar Container Linuxlts-4081.3.8Provisioning & RuntimeMay 27, 2026
ACTION 1OTHER 1View full analysis

This Flatcar LTS release contains Linux security fixes identified by CVEs, plus ca-certificates and Linux component updates. It is most relevant to deployments tracking the lts-4081.3.8 release.

Action needed (1)

  • securitycriticalLinux security fixes for CVE-2026-43316

    Linux receives security fixes associated with the listed CVEs, including CVE-2026-43316. The update ships in Flatcar LTS lts-4081.3.8.

Source ↗
Falco0.44.0SecurityMay 26, 2026
ACTION 1CHECK 5OTHER 34View full analysis

A release that removes several supported engines and outputs and restricts falco-webui access. It also adds rule and configuration capabilities, includes defect fixes and dependency updates, and discloses no security advisory.

Action needed (1)

  • breakinggRPC server support, removed

    gRPC server support is removed in this release.

Check if affected (5)

  • securityPlugin library path traversal prevention

    Applies if you configure the plugin library path.

  • breakingThe gRPC output, removed

    Applies if you use the gRPC output.

  • breakingThe gVisor engine, removed

    Applies if you use the gVisor engine.

  • + 2 more on the release page
Source ↗
Crossplanev2.3.1Orchestration & ManagementMay 22, 2026
ACTION 1CHECK 13OTHER 1View full analysis

A maintenance release includes dependency updates and security fixes in golang.org/x/crypto. The fixes cover SSH, SSH agent, and known-hosts behavior.

Action needed (1)

  • securitygolang.org/x/crypto updated to v0.52.0

    The release updates the golang.org/x/crypto module to v0.52.0.

Check if affected (13)

  • securitycriticalUnenforced invoking key constraints in golang.org/x/crypto/ssh/agent

    Applies if you use golang.org/x/crypto/ssh/agent.

  • securitycriticalDropped invoking agent constraints in golang.org/x/crypto/ssh/agent

    Applies if you use golang.org/x/crypto/ssh/agent.

  • securitycriticalServer deadlock on unexpected responses in golang.org/x/crypto/ssh

    Applies if you use golang.org/x/crypto/ssh.

  • + 10 more on the release page
Source ↗
Crossplanev1.20.8Orchestration & ManagementMay 22, 2026
ACTION 7OTHER 1View full analysis

Crossplane v1.20.8 is a dependency and toolchain maintenance release. It updates several modules and the Go version, with the recorded dependency changes addressing security fixes, and also bumps crossplane-runtime to v1.20.8.

Action needed (7)

  • securityThe github.com/docker/cli module, updated to v29.2.0+incompatible

    The github.com/docker/cli module is updated to v29.2.0+incompatible in the release-1.20 branch.

  • securityThe golang.org/x/net module, updated to v0.53.0

    The golang.org/x/net module is updated to v0.53.0 in the release-1.20 branch.

  • securityThe github.com/in-toto/in-toto-golang module, updated to v0.11.0

    The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in the release-1.20 branch.

  • securityThe github.com/go-git/go-git/v5 module, updated to v5.19.0

    The github.com/go-git/go-git/v5 module is updated to v5.19.0 in the release-1.20 branch.

  • securityThe Go toolchain, updated to 1.25.10

    Go is updated to 1.25.10 to fix standard-library CVEs in the release-1.20 branch.

  • securityThe github.com/go-git/go-git/v5 module, updated to v5.19.1

    The github.com/go-git/go-git/v5 module is updated again, to v5.19.1, in the release-1.20 branch.

  • securityThe golang.org/x/crypto module, updated to v0.52.0

    The golang.org/x/crypto module is updated to v0.52.0 in the release-1.20 branch.

Source ↗
Crossplanev2.1.6Orchestration & ManagementMay 22, 2026
ACTION 6CHECK 1OTHER 1View full analysis

A security-focused maintenance release updates Go and several dependencies, including a fix for an HTTP/2 transport infinite-loop vulnerability. The Go and dependency version increases require upgrading; no configuration migration or deprecation is announced.

Action needed (6)

  • securityThe go.opentelemetry.io/otel module update

    The go.opentelemetry.io/otel module is updated to v1.41.0 in this release.

  • securityThe github.com/in-toto/in-toto-golang module update

    The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in this release.

  • securityThe github.com/go-git/go-git/v5 module update to v5.19.0

    The github.com/go-git/go-git/v5 module is updated to v5.19.0 in this release.

  • securityGo 1.25.10

    Go is updated to 1.25.10 to fix standard library CVEs.

  • securityThe github.com/go-git/go-git/v5 module update to v5.19.1

    The github.com/go-git/go-git/v5 module is updated to v5.19.1 in this release.

  • securityThe golang.org/x/crypto module update

    The golang.org/x/crypto module is updated to v0.52.0 in this release.

Check if affected (1)

  • securityhighThe golang.org/x/net HTTP/2 transport infinite loop

    Applicability is not stated in the release notes.

Source ↗
Crossplanev2.2.2Orchestration & ManagementMay 22, 2026
ACTION 5OTHER 1View full analysis

Crossplane v2.2.2 is a dependency and toolchain maintenance release with security-focused updates. It concerns deployments and builds that rely on the updated Go toolchain and modules.

Action needed (5)

  • securitygithub.com/in-toto/in-toto-golang updated to v0.11.0

    Crossplane v2.2.2 updates the github.com/in-toto/in-toto-golang module to v0.11.0. The update ships in the release-2.2 line.

  • securitygithub.com/go-git/go-git/v5 updated to v5.19.0

    Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.0. The update ships in the release-2.2 line.

  • securityGo 1.25.10 update for standard-library CVEs

    Crossplane v2.2.2 updates Go to 1.25.10 to fix standard-library CVEs. The toolchain update ships in the release-2.2 line.

  • securitygithub.com/go-git/go-git/v5 updated to v5.19.1

    Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.1. The update ships in the release-2.2 line.

  • securitygolang.org/x/crypto updated to v0.52.0

    Crossplane v2.2.2 updates the golang.org/x/crypto module to v0.52.0. The update ships in the release-2.2 line.

Source ↗
Crossplanev2.3.0Orchestration & ManagementMay 21, 2026
ACTION 14CHECK 3OTHER 20View full analysis

Crossplane v2.3.0 combines breaking API naming and path changes with new operator capabilities and correctness fixes. It also updates several Go dependencies and the Go toolchain, which matters to API consumers and builds that depend on the affected packages.

Action needed (14)

  • securityThe github.com/cloudflare/circl dependency, updated to v1.6.3

    The github.com/cloudflare/circl module is updated to v1.6.3 in Crossplane v2.3.0.

  • securityThe google.golang.org/grpc dependency, updated to v1.79.3

    The google.golang.org/grpc module is updated to v1.79.3 in Crossplane v2.3.0.

  • securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency, updated to v1.43.0

    The go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module is updated to v1.43.0 in Crossplane v2.3.0.

  • securityThe github.com/go-git/go-git/v5 dependency, updated to v5.17.1

    The github.com/go-git/go-git/v5 module is updated to v5.17.1 in Crossplane v2.3.0.

  • securityThe github.com/go-jose/go-jose/v4 dependency, updated to v4.1.4

    The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Crossplane v2.3.0.

  • securityThe github.com/sigstore/cosign/v3 dependency, updated to v3.0.5

    The github.com/sigstore/cosign/v3 module is updated to v3.0.5 in Crossplane v2.3.0.

  • securityThe github.com/docker/cli dependency, updated to v29.2.0+incompatible

    The github.com/docker/cli module is updated to v29.2.0+incompatible in Crossplane v2.3.0.

  • securityThe github.com/sigstore/timestamp-authority/v2 dependency, updated to v2.0.6

    The github.com/sigstore/timestamp-authority/v2 module is updated to v2.0.6 in Crossplane v2.3.0.

  • securityThe Go toolchain, updated to 1.25.9

    The Go toolchain is updated to 1.25.9 in Crossplane v2.3.0.

  • securityThe github.com/moby/spdystream dependency, updated to v0.5.1

    The github.com/moby/spdystream module is updated to v0.5.1 in Crossplane v2.3.0.

  • securityThe github.com/go-git/go-git/v5 dependency, updated to v5.18.0

    The github.com/go-git/go-git/v5 module is updated to v5.18.0 in Crossplane v2.3.0.

  • securityThe github.com/in-toto/in-toto-golang dependency, updated to v0.11.0

    The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in Crossplane v2.3.0.

  • securityThe golang.org/x/net dependency, updated to v0.53.0

    The golang.org/x/net module is updated to v0.53.0 in Crossplane v2.3.0.

  • securityThe Go toolchain, updated to 1.25.10

    The Go toolchain is updated to 1.25.10 in Crossplane v2.3.0 to fix standard library CVEs.

Check if affected (3)

  • breakingThe Crossplane API dependency path, renamed

    Applies if you build external consumers of Crossplane APIs.

  • breakingThe common API package, moved

    Applies if you use the common APIs from crossplane-runtime.

  • breakingThe v1.Resource* types, renamed

    Applies if you use the old v1.Resource* types.

Source ↗
containerdv2.2.4Kubernetes CoreMay 20, 2026
ACTION 2OTHER 8View full analysis

A maintenance release with security updates, including a dependency update tied to an advisory. It also includes compatibility and runtime changes across storage, policy, sandbox, validation, and toolchain areas.

Action needed (2)

Source ↗
containerdv2.0.9Kubernetes CoreMay 20, 2026
ACTION 1CHECK 1OTHER 7View full analysis

A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.

Action needed (1)

Check if affected (1)

  • breakingThe default seccomp socket policy

    Applies if you use seccomp.

Source ↗
containerdv1.7.32Kubernetes CoreMay 20, 2026
ACTION 1OTHER 5View full analysis

containerd v1.7.32 includes a disclosed security advisory alongside correctness and compatibility fixes. The release concerns users assessing security exposure or changes in runtime and configuration behavior.

Action needed (1)

Source ↗
containerdv2.3.1Kubernetes CoreMay 20, 2026
ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

  • securityhighCVE-2026-46680 correction

    The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

  • breakingThe overlayfs "rebase" capability, disabled in user namespaces

    Applies if you use overlayfs and run in a user namespace.

Plan ahead (1)

  • deprecatedTask fields in Runc options, deprecated

    Applies if you configure task fields in Runc options.

Source ↗
OpenFGAv1.16.0SecurityMay 20, 2026
ACTION 1OTHER 6View full analysis

Release v1.16.0 adds datastore timeout configuration and additional tracing output. It also fixes defects in experimental weighted_graph_check and OIDC authentication, and updates the Go toolchain for standard-library vulnerability fixes.

Action needed (1)

  • securityThe Go toolchain, updated to 1.26.3

    The toolchain now uses Go version 1.26.3 to address vulnerabilities in the Go standard library. This update ships in v1.16.0.

Source ↗
← NewerOlder →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023