Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

containerdv1.7.31Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 9View full analysis

containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.

Action needed (1)

securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securitySanitized gRPC errors in pod events
Applies if you use pod events.

wasmCloudv2.0.3Orchestration & ManagementApr 14, 2026

ACTION 1CHECK 1PLAN 1OTHER 10View full analysis

This release adds Kubernetes-native service routing and related CRD fields, changes Helm behavior, fixes a NATS subscriber initialization race, and retires the runtime-gateway path. Operators using the deprecated gateway configuration need to account for the routing change and removed chart behavior.

Action needed (1)

breakingThe default chart tag is removed
The default tag is removed, so the chart uses chart.yaml's appVersion.

Check if affected (1)

breakingNative Kubernetes Service routing replaces runtime-gateway
Applies if you use runtime-gateway.

Plan ahead (1)

deprecatedThe Helm gateway section is deprecated
Applies if you configure gateway.

OpenCostv1.120.0ObservabilityApr 13, 2026

ACTION 1OTHER 26View full analysis

A maintenance release with dependency updates, defect corrections, expanded compatibility, and new integrations and configuration capabilities. An existing configuration source is replaced, so affected operators need to update their configuration.

Action needed (1)

breakingProvider configuration replaced by cloud-integration.json
The provider config is no longer used, and configuration is read from cloud-integration.json instead. Operators using the replaced configuration source need to update their configuration.

Istio1.29.2Networking & MessagingApr 13, 2026

ACTION 1OTHER 15View full analysis

A maintenance release adds Helm v4 server-side apply support and includes numerous correctness fixes. The WASM decompression size-limit change affects inputs that were previously accepted and may require operator review.

Action needed (1)

breakingThe gzip decompression size limit for WASM binaries
A size limit is now enforced on gzip-decompressed WASM binaries fetched over HTTP.

cert-managerv1.20.2SecurityApr 11, 2026

ACTION 1OTHER 2View full analysis

cert-manager v1.20.2 fixes invalid Helm YAML generation and updates Go to 1.26.2. It also includes a security-related update to Go dependencies with reported vulnerabilities.

Action needed (1)

securityGo dependency updates
Go dependencies with reported vulnerabilities were updated in cert-manager v1.20.2. No advisory identifier is provided for this update.

Daprv1.17.4Orchestration & ManagementApr 10, 2026

ACTION 1OTHER 11View full analysis

This release contains operator-relevant correctness fixes across messaging, workflows, HTTP proxying, placement, and scheduling. It also updates the Go toolchain across the repository and its Docker images.

Action needed (1)

securityThe Go toolchain, updated to 1.25.9
The Go toolchain was upgraded from 1.25.8 to 1.25.9 across all modules and Docker images in the repository.

OpenFeaturecore/v0.15.2CI/CD & App DeliveryApr 9, 2026

ACTION 1OTHER 1View full analysis

This release contains two security updates whose affected vulnerabilities are not identified. It also adds experimental incremental updates for gRPC synchronization.

Action needed (1)

securityThe vulnerability-updates security update
OpenFeature Core v0.15.2 includes a security update for vulnerability-updates.

OpenFeatureflagd-proxy/v0.9.4CI/CD & App DeliveryApr 9, 2026

ACTION 2View full analysis

This release contains security updates for flagd-proxy/v0.9.4. The available notes do not identify the affected vulnerabilities or describe their scope.

Action needed (2)

securityThe vulnerability-updates entry for issue #1933
The vulnerability-updates entry records a security update for flagd-proxy/v0.9.4, tracked in issue #1933. The notes do not describe the affected vulnerability.
securityThe vulnerability-updates entry for issue #1934
The vulnerability-updates entry records a security update for flagd-proxy/v0.9.4, tracked in issue #1934. The notes do not describe the affected vulnerability.

OpenFeatureflagd/v0.15.2CI/CD & App DeliveryApr 9, 2026

ACTION 2OTHER 1View full analysis

flagd v0.15.2 includes two undisclosed security updates and a new experimental gRPC incremental-update capability. The experimental addition concerns deployments that use gRPC synchronization.

Action needed (2)

securityThe vulnerability-updates security update for issue #1933
flagd v0.15.2 includes the vulnerability-updates security update linked to issue #1933.
securityThe vulnerability-updates security update for issue #1934
flagd v0.15.2 includes the vulnerability-updates security update linked to issue #1934.

Helmv4.1.4Kubernetes CoreApr 9, 2026

ACTION 1CHECK 2OTHER 1View full analysis

A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.

Action needed (1)

securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.

Check if affected (2)

securityhighPlugin verification when .prov is missing
Applies if you use plugins.
securityhighPlugin metadata version path traversal
Applies if you use plugins.

SPIREv1.14.5SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go dependency and toolchain to address multiple disclosed CVEs. It concerns deployments that rely on the release's bundled Go version.

Action needed (1)

securitycriticalThe Go toolchain, updated to 1.26.2
The release updates the Go toolchain to 1.26.2 to address CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281.

SPIREv1.13.5SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go dependency to address multiple disclosed CVEs. It concerns deployments that receive their Go runtime or builds from this release.

Action needed (1)

securitycriticalThe Go dependency, upgraded to 1.25.9
The release upgrades Go to 1.25.9 to address CVE-2026-32282, CVE-2026-32289, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281. The update ships in this release.

Open Policy Agent (OPA)v1.15.2SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go toolchain used to build OPA binaries and images. It also includes multiple security fixes in that Go version.

Action needed (1)

securityThe Go toolchain, updated to 1.26.2
The Go version used to build OPA binaries and images is updated to 1.26.2. This Go version contains multiple security fixes.

Keycloak26.6.0SecurityApr 8, 2026

ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

securityWorkflows admin permission boundaries
Applies if you use Workflows.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
+ 4 more on the release page

Plan ahead (1)

deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.

OpenFeaturecore/v0.15.1CI/CD & App DeliveryApr 7, 2026

ACTION 1OTHER 1View full analysis

Release 0.15.1 fixes a memory leak caused by unbounded metrics cardinality and updates a dependency for an undisclosed security fix. The dependency update ships in the core v0.15.1 release.

Action needed (1)

securityThe github.com/go-jose/go-jose/v4 dependency update
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 for a security fix. This change ships in core v0.15.1.

OpenFeatureflagd-proxy/v0.9.3CI/CD & App DeliveryApr 7, 2026

ACTION 1OTHER 1View full analysis

This release includes a security update to the github.com/go-jose/go-jose/v4 dependency. The release note does not disclose the nature of the vulnerability.

Action needed (1)

securitygithub.com/go-jose/go-jose/v4 updated to v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in flagd-proxy v0.9.3 as a security fix. The note does not disclose the nature of the vulnerability.

OpenFeatureflagd/v0.15.1CI/CD & App DeliveryApr 7, 2026

ACTION 1OTHER 3View full analysis

This release fixes RPC flag defaulting, metrics-server process handling, and unbounded metrics cardinality. It also updates a dependency for an undisclosed security fix, which is the main consideration for users evaluating the release.

Action needed (1)

securityThe github.com/go-jose/go-jose/v4 dependency, updated to v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in flagd/v0.15.1 for an undisclosed security fix.

OpenFGAv1.14.0SecurityApr 3, 2026

ACTION 1CHECK 1PLAN 2OTHER 5View full analysis

This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.

Action needed (1)

securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.

Plan ahead (2)

deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.

Keycloak26.5.7SecurityApr 2, 2026

ACTION 1CHECK 6OTHER 2View full analysis

A security maintenance release fixes seven disclosed vulnerabilities. It also upgrades Quarkus and corrects an error caused by requests without a Host header.

Action needed (1)

securitymediumCVE-2026-1002 static handler component cache
CVE-2026-1002 fixes a flaw in the io.vertx/vertx-core static handler component cache that could deny access to static files.

Check if affected (6)

securityhighCVE-2026-4634 scope processing
Applies if you use Scope Processing.
securityhighCVE-2026-4636 UMA policy resource injection
Applies if you use UMA.
securityhighCVE-2026-3872 OIDC redirect URI validation
Applies if you use OIDC.
+ 3 more on the release page

Daprv1.16.12Orchestration & ManagementMar 30, 2026

ACTION 1CHECK 2OTHER 4View full analysis

A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency and CVE-2026-33186 resolution
The affected google.golang.org/grpc dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.

Check if affected (2)

breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
breakingStructural validation for .jsonschema topics
Applies if you configure .jsonschema.

cert-managerv1.20.1SecurityMar 27, 2026

ACTION 1OTHER 2View full analysis

cert-manager v1.20.1 contains bug corrections and a security-related dependency update. The gRPC vulnerability details are limited to the scanner reports, which state that it does not affect cert-manager.

Action needed (1)

securityThe google.golang.org/grpc dependency update
The google.golang.org/grpc dependency is bumped in cert-manager v1.20.1 to address a vulnerability reported by scanners. The report states that the vulnerability does not affect cert-manager.

Emissary-Ingressv4.0.1Networking & MessagingMar 26, 2026

ACTION 1CHECK 6OTHER 14View full analysis

A release with operator-facing compatibility changes, including feature removals, aligned chart and application versions, GHCR-only chart distribution, and a changed CRD conversion-webhook default. It also updates dependencies and the Python interpreter to resolve CVEs, with additional defect fixes and new service and architecture capabilities.

Action needed (1)

securityDependency and Python interpreter updates for CVE fixes
Many dependencies and the Python interpreter were updated to resolve CVEs.

Check if affected (6)

breakingCustom error responses and header-case mangling, removed
Applies if you use Ambassador Edge Stack's custom error responses or header-case mangling features.
breakingHelm chart and Emissary version alignment
Applies if you use the Helm chart.
breakingGHCR-only Helm chart distribution
Applies if you use Emissary's Helm charts.
+ 3 more on the release page

Daprv1.17.3Orchestration & ManagementMar 26, 2026

ACTION 2OTHER 12View full analysis

Dapr v1.17.3 is a maintenance release with two dependency upgrades that resolve reported CVEs. It also includes correctness fixes for actor and service responses, placement dissemination, reconnect behavior, Scheduler participation, metrics, and Windows sidecar startup.

Action needed (2)

securitycriticalThe google.golang.org/grpc dependency, updated for CVE-2026-33186
The google.golang.org/grpc dependency is upgraded in this release to resolve CVE-2026-33186.
securitymediumThe golang.org/x/image dependency, updated for CVE-2026-33809
This release upgrades golang.org/x/image from v0.25.0 to v0.38.0, resolving CVE-2026-33809.

Daprv1.16.11Orchestration & ManagementMar 26, 2026

ACTION 1OTHER 4View full analysis

This release updates the Go toolchain and corrects Scheduler and container defects. The recorded Scheduler and Windows fixes require only an upgrade, with no operator configuration changes stated.

Action needed (1)

securityThe Go version, updated to 1.25.8
Dapr v1.16.11 updates the Go toolchain from 1.25.7 to 1.25.8.

Argov3.2.8CI/CD & App DeliveryMar 26, 2026

ACTION 1OTHER 2View full analysis

This maintenance release includes a security mitigation for CVE-2026-33186 in grpc-go. It also contains ordinary fixes to application behavior and the user interface.

Action needed (1)

securitycriticalgrpc-go CVE-2026-33186 mitigation
A mitigation for CVE-2026-33186 in grpc-go ships in the release-3.2 line.

Argov3.1.13CI/CD & App DeliveryMar 25, 2026

ACTION 1OTHER 3View full analysis

Argo CD v3.1.13 focuses on release artifact provenance and maintenance, with a security mitigation, a UI correction, and a dependency update. Container images are signed, and qualifying container images and CLI binaries receive SLSA Level 3 provenance.

Action needed (1)

securitycriticalgrpc-go CVE-2026-33186 mitigation
The release includes a mitigation for CVE-2026-33186 in grpc-go for release-3.1.

Chaos Meshv2.8.2ObservabilityMar 25, 2026

ACTION 2CHECK 1PLAN 1OTHER 6View full analysis

A maintenance release deprecates and removes install.sh, updates the Go toolchain and JSON-RPC dependency, and corrects dashboard and webhook issues. It also includes vulnerability fixes in Go and UI packages.

Action needed (2)

securityGo package updates for vulnerability fixes
Go packages are upgraded to fix vulnerabilities.
securityUI package updates for vulnerability fixes
UI packages are upgraded to fix vulnerabilities.

Check if affected (1)

breakingThe install.sh installer, removed
Applies if you use install.sh.

Plan ahead (1)

deprecatedThe install.sh installer, deprecated
Applies if you use install.sh.

NATSv2.12.6Networking & MessagingMar 24, 2026

ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

breakingJWT size limit
JWTs now have a 1MB size limit.

Check if affected (13)

securityhighMQTT security fixes
Applies if you use MQTT.
securityhighLeafnode security fix
Applies if you use leafnodes.
securityhighCommand-line credential security fix
Applies if you provide credentials on the command line.
+ 10 more on the release page

NATSv2.11.15Networking & MessagingMar 24, 2026

ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

breakingThe JWT size limit
JWTs now have a 1MB size limit.

Check if affected (11)

securityhighCVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 fixes for MQTT systems
Applies if you use MQTT.
securityhighCVE-2026-33218 fix for leafnodes
Applies if you use leafnodes.
securityhighCVE-2026-33247 fix for command-line credentials
Applies if you configure credentials on the command line.
+ 8 more on the release page

Contourv1.33.3Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with security-related dependency updates and removal of the hostPort setting from example manifests. It also documents compatibility testing with Kubernetes 1.32 through 1.34.

Action needed (2)

securitycriticalgoogle.golang.org/grpc v1.79.3 update
google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected by this advisory.
securityEnvoy v1.35.9 update
The Envoy dependency is updated to v1.35.9 to address security vulnerabilities.

Check if affected (1)

breakingRemoval of hostPort: 8002 from example manifests
Applies if you use hostPort in example manifests.

Contourv1.32.4Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with updated Envoy and gRPC dependencies, plus a change to the example manifests. It is tested against Kubernetes 1.31 through 1.33.

Action needed (2)

securitycriticalgoogle.golang.org/grpc updated to v1.79.3
google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.
securityEnvoy updated to v1.34.13
Envoy is updated to v1.34.13 to address security vulnerabilities and improve stability.

Check if affected (1)

breakinghostPort: 8002 removed from example manifests
Applies if hostPort: 8002 is configured in example manifests.

Contourv1.31.5Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release contains dependency security updates and an example-manifest cleanup. It also documents testing against Kubernetes 1.30 through 1.32.

Action needed (2)

securitycriticalgoogle.golang.org/grpc updated to v1.79.3 for CVE-2026-33186
The release updates google.golang.org/grpc to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.
securityEnvoy updated to v1.34.13
The release bumps Envoy to v1.34.13.

Check if affected (1)

breakingEnvoy metrics hostPort: 8002 removed from example manifests
Applies if example manifests use hostPort: 8002.

wasmCloudv2.0.0Orchestration & ManagementMar 22, 2026

ACTION 2OTHER 8View full analysis

wasmCloud v2.0.0 adds operator-facing capabilities, changes CRD locations, updates dependencies, and fixes runtime and CLI behavior. The dependency update addresses the disclosed advisory RUSTSEC-2026-0007.

Action needed (2)

securitymediumLock file update for RUSTSEC-2026-0007
wasmCloud v2.0.0 updates the lock file to address RUSTSEC-2026-0007.
breakingCRD location moved from templates/crds to /crds
wasmCloud v2.0.0 moves CRDs from templates/crds to /crds.

Kubeflow26.03AI & MLMar 22, 2026

ACTION 1CHECK 1OTHER 18View full analysis

This release updates supported Kubernetes and pod-security configurations, installation behavior, and bundled component versions. The main operator-facing changes are the Kubernetes 1.34+ requirement and the baseline pod-security enforcement default, alongside fixes and new capabilities.

Action needed (1)

breakingBaseline pod security enforcement
Pod security enforcement changes to the baseline level in this release.

Check if affected (1)

breakingKubernetes 1.34+ requirement
Applies if you use Kubernetes 1.34+.

etcdv3.6.9Kubernetes CoreMar 20, 2026

ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.
securityhighgolang.org/x/net updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.

etcdv3.5.28Kubernetes CoreMar 20, 2026

ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
securityhighThe golang.org/x/net dependency, updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.

etcdv3.4.42Kubernetes CoreMar 20, 2026

ACTION 4OTHER 3View full analysis

A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang.org/x/net and google.golang.org/grpc to address reported issues.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The google.golang.org/grpc dependency is updated to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang.org/x/net updated to v0.51.0
The golang.org/x/net dependency is updated to v0.51.0 to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

Harborv2.15.0Storage & DataMar 20, 2026

ACTION 2CHECK 2OTHER 72View full analysis

A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.

Action needed (2)

securityBearer token validation
Harbor rejects bearer tokens issued before project creation.
breakingPort 9443 removed from the webhook event check
Port 9443 is removed from the Harbor IP used for webhook event checks.

Check if affected (2)

breakingThe pull-through cache is replaced by proxy cache
Applies if you use pull-through cache in Harbor.
breakingGCR replication removal
Applies if you use GCR replication in Harbor.

Daprv1.17.2Orchestration & ManagementMar 19, 2026

ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os.FileInfo root boundaries
os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.

SPIREv1.14.3SecurityMar 18, 2026

ACTION 1CHECK 1OTHER 9View full analysis

A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.

Action needed (1)

securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.

Check if affected (1)

securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.

← NewerApr 14, 2026 – Mar 18, 2026Older →

Browse by month