AI-analyzed release notes for CNCF graduated and incubating projects.
Flux v2.8.8 is a maintenance release with defect corrections, expanded compatibility, and dependency updates. It also includes two disclosed security fixes in go-git.
Action needed (1)
securitymediumThe go-git security fixes for CVE-2026-45571 and CVE-2026-45570
Flux v2.8.8 includes security fixes in go-git associated with CVE-2026-45571, CVE-2026-45570, GHSA-crhj-59gh-8x96, and GHSA-m7cr-m3pv-hgrp.
A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.
Action needed (2)
securityModule Federation packages at v2.
Module Federation packages were upgraded to v2. to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4. because of a license change.
Check if affected (9)
securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
Plan ahead (4)
deprecatedThe PolicyQueryUser. field, deprecated
Applies if you use PolicyQueryUser..
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
deprecatedThe catalog. setting, deprecated
Applies if you configure catalog..
A maintenance release with numerous disclosed security fixes, dependency updates, enhancements, and bug fixes. It also corrects forced object deletion during the operator upgrade path.
Action needed (6)
securityhighCVE-2026-33871: HTTP/2 CONTINUATION frame flood denial of service
The release fixes the HTTP/2 CONTINUATION frame flood denial-of-service issue identified by CVE-2026-33871.
securityhighCVE-2026-33870: HTTP request smuggling through chunked extension parsing
The release corrects the HTTP request smuggling primitive caused by chunked extension quoted-string parsing, identified by CVE-2026-33870.
securityhighBouncycastle updates for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598
The release updates bouncycastle for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598.
securityhighCVE-2026-7504: Redirect URI validation bypass
The release corrects the redirect URI validation bypass in Keycloak, identified by CVE-2026-7504.
securitymediumCVE-2026-5588: Bouncy Castle bcpkix cryptographic algorithm vulnerability
The release updates the bcpkix modules affected by the broken or risky cryptographic algorithm vulnerability in the Bouncy Castle Crypto Package for Java, identified by CVE-2026-5588.
securityPermission and policy call ordering in admin/api
The release corrects the ordering of permission and policy calls in admin/api that led to exposure of a client ID.
Check if affected (12)
securityhighCVE-2026-7307: Denial of service at the /saml endpoint
Applies if you use /saml.
securityhighCVE-2026-7571: Access token disclosure and implicit flow bypass
Applies if you use implicit flow.
securityhighCVE-2026-7507: Session fixation in the OIDC login flow
Applies if you use OIDC login flow.
A feature and maintenance release that adds HAMi-core, Ascend and vNPU virtualization, DRA, CDI, monitoring, metrics, deployment, and debugging capabilities. It also includes scheduling, allocation, device, chart, and compatibility fixes, security updates, dependency upgrades, and removal of a deprecated scheduler policy ConfigMap.
Action needed (3)
securityThe tensorflow/tensorflow dependency, upgraded
The tensorflow/tensorflow dependency was upgraded from 2.20.0rc0-gpu to 2.21.0rc0-gpu in this release.
securityThe tensorflow/tensorflow dependency, upgraded again
The tensorflow/tensorflow dependency was upgraded from 2.21.0rc0-gpu to 2.21.0rc1-gpu in this release.
securityThe golang dependency, upgraded
The golang dependency was upgraded for a security issue in this release.
Check if affected (3)
breakingThe deprecated scheduler policy configmap, removed
Applies if you configure scheduler policy configmap.
breakingThe Helm nvidia. default
Applies if you use Helm.
breakingHost networking for the device plugin, disabled
Applies if the device plugin runs.
A maintenance release with dependency updates, operator-visible configuration and behavior changes, new integrations and capabilities, and correctness fixes. It also includes an explicitly disclosed security-related Go dependency upgrade.
Action needed (1)
securityhighGo dependency upgrades for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986
Go dependencies were upgraded to address GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.
Check if affected (2)
breakingThe provider config source, changed
Applies if you configure provider config.
breakingThe MCP_SERVER_ENABLED default, changed to false
Applies if you use the MCP server.
A feature release adds Gateway API, ambient-mode, telemetry, Helm, and operability capabilities. Authenticated XDS debug endpoints and the new default image registry are the changes most likely to affect deployment and operational configuration.
Action needed (1)
breakingDefault Istio image registry
The default registry for Istio images is now registry..
Check if affected (1)
breakingAuthentication required for XDS debug endpoints
Applies if ENABLE_DEBUG_ENDPOINT_AUTH is set.
A maintenance release adds Gateway API compatibility, analyzer and HBONE tuning capabilities, and fixes certificate, controller, probe, output, and authorization issues. The authorization fixes address cross-namespace configuration access and regex handling in AuthorizationPolicy.
Action needed (1)
securityCross-namespace access to istio. and istio.
Authorization is fixed so an authenticated workload cannot enumerate proxies or retrieve configuration dumps for workloads in other namespaces through istio. and istio..
Check if affected (2)
securityRegex handling in AuthorizationPolicy identity fields
Applicability is not stated in the release notes.
breakingThe AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE setting and kubelet health probes
Applies when ambient mesh pods run on AWS EKS and use Security Groups for Pods (branch ENI).
A maintenance release that adds Gateway API v1.4.1 support and new diagnostics and configuration controls while fixing several correctness issues. It also includes two described security fixes for XDS debug endpoint authorization and regex handling in AuthorizationPolicy.
Action needed (1)
securitySame-namespace authorization for StatusGen XDS debug endpoints
The StatusGen-served XDS debug endpoints istio. and istio. now enforce same-namespace authorization for non-system callers. Authenticated workloads can no longer enumerate proxies or retrieve configuration dumps for workloads in other namespaces.
Check if affected (1)
securityEscaped regex metacharacters in AuthorizationPolicy identity fields
Applies if you configure source. or source..
Litmus 3.29.0 includes operator-facing changes across dependencies and platform behavior. This release includes a google. update to v1. for CVE-2026-33186.
Action needed (1)
securitycriticalThe google. dependency, updated for CVE-2026-33186
The release updates google. to v1.. The dependency update addresses CVE-2026-33186 in Litmus 3.29.0.
A release focused on a security fix and API evolution. It tightens the Updater() contract and begins preparation for removal of an existing module.
Action needed (1)
securitymediumGHSA-qp9x-wp8f-qgjj fixed
The release fixes GHSA-qp9x-wp8f-qgjj.
Check if affected (1)
breakingThe Updater() bootstrap argument, now required
Applies if you use Updater().
Plan ahead (1)
deprecatedPreparation for removal of securesystemslib.
Applies if you use securesystemslib..
A release that changes the default sidecar mode and promotes native sidecars to GA. It also fixes correctness issues, adds configurable timestamp handling, addresses eleven disclosed CVEs, and updates numerous dependencies.
Action needed (2)
securityhighEleven disclosed CVEs, fixed
The release fixes eleven disclosed CVEs: CVE-2026-42501, CVE-2026-42499, CVE-2026-39836, CVE-2026-39826, CVE-2026-39825, CVE-2026-39823, CVE-2026-39820, CVE-2026-39819, CVE-2026-39817, CVE-2026-33814, and CVE-2026-33811.
breakingThe config. default, changed
The default sidecar mode changes through config., making native sidecars the default.
Helm v3.21.0 is a maintenance release with dependency updates and fixes to chart and OCI handling. It also includes a security fix in the opentelemetry packages.
Action needed (1)
securityThe opentelemetry packages, upgraded for CVE patches
Helm v3.21.0 upgrades the opentelemetry packages to patch CVEs.
A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.
Action needed (1)
securityhighgo. update for GO-2026-4394
Helm v4.2.0 updates go. to v1.40.0 for GO-2026-4394.
Check if affected (1)
securityPlugin version path traversal fix
Applies if you use the Plugin extension.
Plan ahead (1)
deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated
Applies if you use --hide-notes or --render-subchart-notes.
A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github. dependency.
Action needed (2)
securityThe github. module update
The github. module is updated to v0..
breakingService-label filtering for EndpointSlice watches
The loadbalancer/reflectors component filters EndpointSlice watches by service labels.
Check if affected (1)
breakingLabel filtering for EndpointSlices
Applies if you set --k8s-service-proxy-name.
A maintenance release with an enforced policy behavior change, bug fixes, new metrics, and Helm image overrides. It also updates dependencies and container images and refreshes container image manifests.
Action needed (1)
securityThe github. dependency update
The github. module is updated to v0. in v1.17.16.
Check if affected (1)
breakingCiliumLocalRedirectPolicy addressMatcher override behavior
Applies if you use addressMatcher in CiliumLocalRedirectPolicy and do not enable --enable-lrp-address-matcher-override=true.
Cilium v1.18.10 contains correctness fixes, Helm support for overriding images, and dependency and image updates. The github. update is marked as a security update, but no advisory identifier is provided.
Action needed (1)
securityThe github. module update to v0.5.1
Cilium v1.18.10 updates the github. module to v0.5.1 as an undisclosed security update.
A release with breaking removals, API and metric changes, bug corrections, and experimental capabilities. It also adds storage, MCP, UI, and tracing functionality, with no security advisories or security-specific fixes disclosed.
Action needed (2)
breakingThe min step api in metricstore, removed
The min step api was removed from metricstore in this release.
breakingThe non-standard health MCP tool, removed
The non-standard health MCP tool was removed from jaegermcp in this release.
This release combines bug fixes with dependency and toolchain updates. The Go update to 1. addresses CVEs and concerns deployments using this release.
Action needed (1)
securityThe Go toolchain, updated to 1.
The Go toolchain is updated to 1. on release-3. to resolve CVEs.
Flux v2. includes a security update to the go-git dependency alongside toolkit component updates. The go-git update addresses CVE-2026-45022 and GHSA-389r-gv7p-r3rp.
Action needed (1)
securityhighThe go-git dependency update to v5.
The go-git dependency is updated to v5., which fixes CVE-2026-45022 and addresses GHSA-389r-gv7p-r3rp. This update ships in Flux v2..
OPA v1.16.2 is a security-focused maintenance release. It updates the Go version used to build OPA binaries and images to 1. to address vulnerabilities.
Action needed (1)
securityThe Go build version, updated to 1.
The version of Go used to build OPA binaries and images is updated to 1. to address vulnerabilities.
This is a security-focused Flatcar release with disclosed Linux security fixes. It also updates the Linux and ca-certificates dependencies.
Action needed (1)
securitycriticalLinux security updates, including CVE-2026-31733
Linux receives security updates in Flatcar stable-4593., including CVE-2026-31733 and the other disclosed Linux advisories listed for this change.
This release removes the iRMC driver and legacy vbmctl entrypoint, deprecates BMH., and changes defaults and constraints. It also adds HostClaim and vbmctl capabilities, corrects bugs, and updates dependencies.
Action needed (1)
breakingManager TLS default set to unset
The manager TLS default is set back to unset in this release.
Check if affected (3)
breakingThe iRMC driver, removed
Applies if you use the iRMC driver.
breakingPreprovisioningImage required for deprovisioning
Applies if cleaning is enabled.
breakingThe legacy vbmctl entrypoint, removed
Applies if you use the legacy vbmctl entrypoint.
Plan ahead (1)
deprecatedThe BMH. field, deprecated
Applies if you configure BMH..
A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.
Action needed (2)
breakingUnqualified * rejection after commas in SELECT lists
vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.
breakingBare * restriction in the sqlparser grammar
sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.
Check if affected (1)
breakingEmergencyReparentShard replication-stop error validation
Applies if you use EmergencyReparentShard.
Harbor v2.15.1 is a maintenance release with defect corrections, behavior changes, and dependency and base-image updates. It also updates photon packages to fix CVEs.
Action needed (1)
securityphoton packages CVE fixes
The photon packages are updated to fix CVEs in Harbor v2.15.1.
A broad maintenance and feature release with correctness, performance, dependency, and operator-facing changes. Operators should review the cluster-version annotation format and changed defaults, while dependency updates include Kubernetes and Helm changes; no explicitly disclosed exploitable vulnerability or security advisory is identified.
Action needed (4)
securityThe k8s. module, updated to v1.
The k8s. module is updated to v1. as a security-related dependency update.
securityThe helm dependency, updated to 3.
The helm dependency is updated to 3. due to a CVE.
breakinggRPC service config DNS TXT lookups, disabled by default
gRPC service config DNS TXT lookups are disabled by default.
breakingThe appset resource status count, defaulted to 5000
The default appset resource status count is changed to 5000.
Check if affected (2)
breakingThe --client flag in the Helm version command, removed
Applies if you use --client.
breakingThe cluster-version annotation format, renamed
Applies if you use Application Sets with Cluster Generators and configure argocd..
CRI-O v1.36.0 is a substantive operator-facing feature and maintenance release with runtime and operational changes. It also includes a security update to spdystream and a broad dependency refresh.
Action needed (1)
securityhighThe spdystream dependency update for CVE-2026-35469
CRI-O v1.36.0 updates the spdystream dependency to fix CVE-2026-35469.
Confidential Containers v0.20.0 combines operator-visible capability and compatibility updates with deprecations of several image and provider paths. It also includes a security fix identified by GHSA-q49m-57vm-c8cc.
Action needed (1)
securityhighGHSA-q49m-57vm-c8cc security fix
The release includes a fix for the security issue identified by GHSA-q49m-57vm-c8cc.
Plan ahead (3)
deprecatedThe Docker CAA provider, deprecatedremoval date not announced
Applies if you use the Docker CAA provider.
breakingThe Fedora-based mkosi CAA podvm image, deprecatedremoval date not announced
Applies if you use the Fedora-based mkosi CAA podvm image.
deprecatedSupport for packer images, deprecatedremoval date not announced
Applies if you use packer images.
A maintenance release that adds a runtime metric and a GOMAXPROCS configuration field, fixes two runtime defects, and reverts CNI monitoring after node bootstrapping regressions. It also updates the spdystream dependency to address CVE-2026-35469.
Action needed (2)
securityhighThe spdystream dependency update for CVE-2026-35469
The spdystream dependency is updated to address CVE-2026-35469. The update ships in this release.
breakingCRI-O CNI monitoring, reverted
CRI-O reverts CNI monitoring because it caused node bootstrapping regressions. The change ships in this release.
CRI-O v1.34.8 includes a security-relevant dependency update and adds operator-facing observability and configuration capabilities. The dependency update is the release change that requires upgrading, while the other additions concern optional setup or informational use.
Action needed (1)
securityhighCVE-2026-35469 fix in the spdystream dependency
CRI-O v1.34.8 updates the spdystream dependency to fix CVE-2026-35469.
CRI-O v1.33.12 includes a security fix for a disclosed vulnerability in the spdystream dependency. It also adds the min_injected_gomaxprocs configuration field for controlling the floor of injected GOMAXPROCS values.
Action needed (1)
securityhighCVE-2026-35469 fix in the spdystream dependency
CVE-2026-35469 is fixed by updating the spdystream dependency in CRI-O v1.33.12.
A maintenance release with correctness fixes for HTTP errors, NATS subscription readiness, and WorkloadDeployment readiness, plus dependency and toolchain updates. It removes canary-v2 now that canary exists and includes dependency cleanup.
Action needed (1)
breakingThe canary-v2 option, removed
canary-v2 is removed now that canary exists. The removal ships in this release.
A maintenance release with a correctness fix, an RBAC authorization bypass fix, and a security-related dependency update for GO-2026-4962. It also records Go 1. as the toolchain used to build the binaries.
Action needed (1)
securitymediumgolang. update for GO-2026-4962
The release updates golang. to v0. to resolve GO-2026-4962.
Check if affected (1)
securityRBAC authorization bypass in nested Put requests
Applies if you use RBAC.
A maintenance release with a security fix for an RBAC authorization bypass in transaction handling. It also includes an ordinary correctness fix and a Go toolchain dependency update.
Action needed (1)
securityRBAC authorization bypass in nested etcd transactions
The release fixes an RBAC authorization bypass that allowed read access through PrevKv or lease attachment in Put requests nested in etcd transactions. The fix ships in this release.
A substantial operator-facing release with new capabilities, behavior changes, a compatibility constraint, and a deprecation. It is the first annual LTS release under a Kubernetes-aligned cadence, with support planned for at least two years.
Action needed (1)
breakingPlugin names disallow commas
OCI hook adjustments accumulate owners, and commas are disallowed in plugin names in this release.
Plan ahead (1)
deprecatedThe shim. API, deprecated
Applies if you use shim..
OpenFeature core/v0.15.5 is a maintenance release with operator-relevant corrections and a security-related dependency update. The security announcement does not identify a specific advisory in the release text.
Action needed (1)
securityOpen Dependabot security alerts resolved
Open Dependabot security alerts were resolved in the OpenFeature core release.
This release resolves open Dependabot security alerts in the flagd proxy. The release note does not identify which vulnerabilities or dependencies were fixed.
Action needed (1)
securityDependabot security alerts resolved
The flagd-proxy/v0. release resolves open Dependabot security alerts. The release note does not identify the affected dependencies or vulnerabilities.
v3.3.9 is a maintenance release with a disclosed security fix and a go version update to resolve CVEs. It also includes bug fixes in the release.
Action needed (2)
securitycriticalGHSA-3v3m-wc6v-x4x3 security fix
This release fixes the vulnerability identified by GHSA-3v3m-wc6v-x4x3.
securityThe go version update for CVE resolution
The go version is bumped to resolve CVEs in v3.3.9.
Version v3. includes a disclosed security fix and additional correctness and dependency updates. The security fix is the release change that concerns users evaluating whether to upgrade.
Action needed (1)
securitycriticalSecurity fix for GHSA-3v3m-wc6v-x4x3
Version v3. contains a security fix for the vulnerability identified by GHSA-3v3m-wc6v-x4x3.
OPA v1.16.0 adds URI built-ins, Data API metadata support, testing and WASM capabilities, along with broader Rego and schema support. It also changes formatting, logging, server, TLS, socket, storage, and dependency behavior, but includes a shutdown regression, so users should skip v1.16.0 and upgrade directly to v1.16.1.
Action needed (1)
breakingHTML index page query form removed
OPA v1.16.0 drops the HTML index page query form.
A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.
Action needed (3)
securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.
Check if affected (12)
securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
Plan ahead (4)
deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
