AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.
Action needed (1)
breakingThe QuiesceFailed indication replaced by QuiesceTimeout
The QuiesceFailed indication was replaced with QuiesceTimeout.
A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.
Action needed (1)
securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.
Check if affected (2)
breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.
An operator release with expanded configuration and LLMInferenceService capabilities, plus chart and dependency updates, behavior changes, removals, and defect corrections. It also includes security fixes for operators to review.
Action needed (13)
securitycriticalh11 malformed-body fix for CVE-2025-43859
h11 malformed-body handling associated with CVE-2025-43859 is addressed in this release.
securityhighstarlette version 0.
starlette is pinned to version 0. to fix CVE-2025-62727 in this release.
securityhighlightgbm version 4.
lightgbm is updated to version 4. for CVE-2024-43598 in this release.
securityhighCVE-2025-66418 decompression-chain fix
The unbounded number of links in the decompression chain associated with CVE-2025-66418 is addressed in this release.
securityhighexpr-lang/expr version v1.
expr-lang/expr is updated to v1. to fix CVE-2025-68156 in this release.
securityhighcryptography fix for CVE-2026-26007
The cryptography issue associated with CVE-2026-26007 is addressed in this release.
securityhighpython-multipart fix for CVE-2026-24486
The arbitrary file write issue in python-multipart associated with CVE-2026-24486 is addressed in this release.
securitymediumFixes for CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181
This release addresses CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181.
securityhttps. path traversal prevention
The path traversal issue in https. is prevented in this release.
securitySeveral CVE fixes
This release addresses several CVEs.
securityAIOHTTP HTTP Parser auto_decompress fix
The AIOHTTP HTTP Parser auto_decompress feature issue involving zip bombs is addressed in this release.
securityextractTarFiles path traversal fix
The path traversal vulnerability in extractTarFiles is addressed in this release.
breakingminio replacement with seaweedfs
minio is replaced with seaweedfs in this release.
Check if affected (6)
breakinginferenceservice CRD cert-manager annotation removal
Applies if you use the inferenceservice CRD.
breakingPython 3.9 support removal
Applies if you run Python 3.9.
breakingDeprecated --disable-log-requests flag removal
Applies if you configure --disable-log-requests.
A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.
Action needed (2)
securityhighGo toolchain version 1.
The Go toolchain is updated to version 1. to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.
Check if affected (1)
breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.
A maintenance release that narrows Kubernetes support to version 1.25 and newer and marks several older Kafka and extension components for removal. It adds Kafka 3.9.2 support and includes dependency updates addressing multiple CVEs and a GHSA advisory.
Action needed (8)
securityhighGRPC Netty Shaded update for CVE-2025-55163
GRPC Netty Shaded was upgraded to remediate CVE-2025-55163.
securitymediumZookeeper update for CVE-2024-47554
The Zookeeper dependency was upgraded to remediate CVE-2024-47554.
securitymediumNimbus Jose JWT 10.0.2 update for CVE-2025-53864
Nimbus Jose JWT was upgraded to version 10. to remediate CVE-2025-53864.
securitymediumNetty 4.1.130.Final update for CVE-2025-67735
Netty was updated to version 4. to resolve CVE-2025-67735.
securitymediumApache Log4J 2.25.3 update for CVE-2025-68161
Apache Log4J was updated to version 2. to remediate CVE-2025-68161.
securitymediumVertx 4.5.24 update for CVE-2026-1002
Vertx was updated to version 4. to remediate CVE-2026-1002.
securitymediumJackson update for GHSA-72hv-8253-57qq
Jackson was updated to address GHSA-72hv-8253-57qq.
securityVert. and Netty dependency updates
The Vert. and Netty dependencies were bumped on the 0. branch to fix CVEs.
Check if affected (1)
breakingKubernetes support narrowed to 1.25 and newer
Applies if you use Kubernetes 1. or Kubernetes 1..
Plan ahead (3)
breakingStrimzi MirrorMaker 2 Extensions deprecationdeprecated since 0.28.0 · removal planned in 0.46
Applies if you use the Strimzi MirrorMaker 2 Extensions.
breakingStrimzi EnvVar Configuration Provider inclusiondeprecated since 0.38.0 · removal planned in 0.46
Applies if you use the Strimzi EnvVar Configuration Provider.
deprecatedZooKeeper-based Kafka and MirrorMaker 1 supportremoval planned in 0.46
Applies if you use ZooKeeper-based Apache Kafka clusters or MirrorMaker 1 deployments.
Flux v2.8.2 includes correctness fixes and dependency updates. It also fixes a disclosed TLS-handshake denial-of-service issue in the controller builds.
Action needed (1)
securitymediumCVE-2026-27138 TLS-handshake DoS fix
The TLS-handshake denial-of-service issue identified as CVE-2026-27138 is fixed by building all controllers with Go 1..
Helm v4. is primarily a maintenance release with defect corrections, dependency updates, and a change that aligns defaults. The explicitly identified security-related change updates the OpenTelemetry SDK for GO-2026-4394.
Action needed (1)
securityhighThe go. dependency update for GO-2026-4394
The go. dependency was updated to v1. for GO-2026-4394 in Helm v4..
A security-focused maintenance release fixes undisclosed issues in two Backstage backend plugins. The affected plugins are @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.
Action needed (1)
securitySecurity fixes in two Backstage backend plugins
Security fixes ship in @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.
A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.
Action needed (3)
securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()
The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix
The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset
HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.
Check if affected (2)
securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5: multivalue header bypass fix in RBAC
Applies if you use the rbac subsystem.
securitymediumCVE-2026-26330 and GHSA-c23c-rp3m-vpg3: ratelimit response-phase limit crash fix
Applies if you use the ratelimit subsystem.
A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.
Action needed (3)
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 json null terminator write fix
Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 HTTP decoder reset handling
Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.
Check if affected (2)
securityhighCVE-2026-26308 rbac multivalue header bypass fix
Applies if you use rbac.
securitymediumCVE-2026-26330 ratelimit response phase limit crash fix
Applies if you use ratelimit.
Envoy v1.35.9 is a maintenance release with security fixes in RBAC, network address handling, JSON processing, and HTTP downstream reset handling. It also includes an ordinary defect correction and an updated Docker base-image dependency.
Action needed (4)
securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5, multivalue header bypass in RBAC
Envoy v1.35.9 fixes CVE-2026-26308 and GHSA-ghc4-35x6-crw5, addressing a multivalue header bypass in RBAC.
securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p, scoped IPv6 address crash
Envoy v1.35.9 fixes CVE-2026-26310 and GHSA-3cw6-2j68-868p, preventing a crash in getAddressWithPort() when it receives a scoped IPv6 address.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943, JSON null-terminator write
Envoy v1.35.9 fixes CVE-2026-26309 and GHSA-56cj-wgg3-x943, correcting an off-by-one write that could corrupt the string null terminator in JSON handling.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px, HTTP decode methods after downstream reset
Envoy v1.35.9 fixes CVE-2026-26311 and GHSA-84xm-r438-86px, ensuring that decode* methods are blocked after a downstream reset in HTTP handling.
A maintenance release with defect corrections, behavior changes, and a fix for credential leakage in pod events. It also updates the Go toolchain and adds a warning for concurrent container creation.
Action needed (1)
securityCredential leakage prevention in pod events
Credential leakage is prevented in pod events in this containerd release.
A release with disclosed security fixes in RBAC, network handling, JSON processing, and HTTP decoding, plus an OAuth2 correctness fix and updated Docker base images. Upgrading addresses the security vulnerabilities, while the other fixes require no operator action.
Action needed (4)
securityhighCVE-2026-26308 multivalue header bypass in rbac
CVE-2026-26308 (GHSA-ghc4-35x6-crw5) fixes a multivalue header bypass in rbac. The fix ships in this Envoy release.
securitymediumCVE-2026-26310 crash in getAddressWithPort()
CVE-2026-26310 (GHSA-3cw6-2j68-868p) fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The fix ships in the Envoy network code.
securitymediumCVE-2026-26309 off-by-one write in json processing
CVE-2026-26309 (GHSA-56cj-wgg3-x943) fixes an off-by-one write that could corrupt the string null terminator. The fix ships in the Envoy json code.
securitymediumCVE-2026-26311 blocking of decode* methods after downstream reset
CVE-2026-26311 (GHSA-84xm-r438-86px) ensures that decode* methods are blocked after a downstream reset. The fix ships in the Envoy http code.
A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.
Action needed (1)
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes an off-by-one write in JSON handling.
Check if affected (10)
securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
Applies if you use JWKS Resolver.
securitymediumCVE-2026-26311 HTTP decode method restriction
Applies if you use HTTP.
A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.
Action needed (7)
securityhighCVE-2026-26308 multivalue header bypass fix in RBAC
CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.
securitymediumCVE-2026-26311 HTTP decode method fix
CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write in Istio.
securitymediumCVE-2026-26330 ratelimit response phase crash fix
CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix
CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.
Check if affected (3)
securityAuthentication for XDS debug endpoints on port 15010
Applies if you expose XDS debug endpoints.
securityBearer token realm URL validation for WasmPlugin image fetching
Applies if you use WasmPlugin image fetching.
securityNamespace-based authorization for HTTP debug endpoints on port 15014
Applies if you expose HTTP debug endpoints.
A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.
Action needed (3)
securitymediumCVE-2026-26311 HTTP decode method correction
CVE-2026-26311 blocks HTTP decode methods after a downstream reset.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write.
Check if affected (6)
securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS Resolver authentication fix
Applies if you use JWKS Resolver.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint access fix
Applies if you use Debug Endpoints.
This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.
Action needed (2)
securityhighGo v1. update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1. to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.
Check if affected (4)
securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
Bearer tokens issued before project creation are rejected. The release also updates dependencies and components and removes payload data from the configuration audit log.
Action needed (1)
securityRejection of bearer tokens issued before project creation
The security enforcement rejects bearer tokens issued before project creation.
This release updates base images, dependencies, and Trivy components, and changes the audit-log payload. It also rejects bearer tokens issued before project creation.
Action needed (1)
securityBearer tokens issued before project creation rejected
The security fix rejects bearer tokens issued before project creation.
This release focuses on dependency maintenance, including a security-related Go update, along with a grace-period behavior change. No operator setup changes are explicitly required beyond upgrading to obtain the security fix.
Action needed (1)
securityGo dependency updates for CVE remediation
The release updates go and its dependencies to address CVEs. The change ships in operator-framework v1.42.1.
OPA v1.14.1 is a patch release focused on bug fixes and dependency updates. It includes dependency work related to the Go standard library and common package vulnerabilities.
Action needed (1)
securityGolang standard library dependency updates
This patch release collects two bug fixes and dependency updates for the Golang standard library and common package vulnerabilities. The change ships in OPA v1.14.1.
A feature and maintenance release that expands configuration and scheduler capabilities while changing configuration controls and the priorities type. Dependency versions are updated, and no security advisories or explicitly described vulnerabilities are mentioned.
Action needed (1)
breakingThe priorities type, changed to int32
The priorities type changed from string to int32 in v2.4.2.
Check if affected (1)
breakingThe Enable flag, removed from seedPeer
Applies if you configure Enable.
A release with breaking configuration and API changes, a Go 1.25.7 requirement, new capabilities, and bug and performance fixes. No security advisories or security-specific fixes are identified.
Action needed (1)
breakingGo 1.25.7 requirement
The codebase now requires Go 1.25.7, with Go version consistency enforced across the codebase.
Check if affected (2)
breakingLegacy response format of the remote sampling endpoint, removed
Applies if you use the remote sampling endpoint.
breakingtraces. renamed to traces.
Applies if you configure traces..
This release corrects Avro publishing and WASM component registration defects, improves Avro publishing performance, and updates the Go and OpenTelemetry SDK dependencies. The Go update includes security fixes, while the OpenTelemetry update is presented without a disclosed security issue.
Action needed (1)
securityThe Go 1. update
Go 1. ships security fixes for the go command and crypto/tls package, plus compiler and crypto/x509 bug fixes.
A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.
Action needed (1)
securityhighThe Go 1. build dependency and cited security fixes
The build uses Go 1., which includes security fixes for CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.
Check if affected (2)
securityhighThe rewrite and acl ordering, CVE-2026-26017
Applies if you use both rewrite and acl.
securityhighplugin/loop query name generation, CVE-2026-26018
Applies if plugin/loop runs.
A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.
Action needed (2)
securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.
breakingThe ServerSideApplyPhase1 feature gate default
The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.
Check if affected (2)
breakingKubernetes version support
Applies if you use Kubernetes 1.27, 1.28, or 1.29.
breakingKafka 4.0.0 and 4.0.1 support
Applies if you use Kafka 4.0.0 or 4.0.1.
Plan ahead (1)
deprecatedThe ingress listener type deprecation
Applies if you configure the ingress listener type.
A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.
Action needed (9)
securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang. dependency, updated
The golang. dependency is bumped.
securityThe github. dependency, updated
The github. dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github. dependency, updated
The github. dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.
Check if affected (3)
securityPlacement authorization for Dapr actor types
Applies if you use Placement.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.
Plan ahead (2)
deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1., BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.
This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.
Action needed (1)
securityhighThe go. dependencies, updated for GHSA-9h8m-3fm2-qjrq
The go. dependencies include the fix for GHSA-9h8m-3fm2-qjrq.
Check if affected (1)
breakingThe --h2c flag with Unix domain socket support
Applies if you use --h2c with unix domain socket (UDS).
cert-manager v1. is a patch release focused on fixing reported vulnerabilities, including CVE-2025-68121, through a Go toolchain bump. CVE-2026-24051 is explicitly stated not to affect cert-manager.
Action needed (2)
securitycriticalCVE-2025-68121 vulnerability fix
The v1. patch release fixes reported vulnerabilities, most notably CVE-2025-68121, in cert-manager.
securitycriticalGo toolchain bump for CVE-2025-68121
The Go toolchain is bumped in cert-manager v1. to address CVE-2025-68121.
cert-manager v1.19.4 is a patch release focused on reported vulnerabilities and dependency updates. It includes fixes for CVE-2026-24051, CVE-2025-68121, and GO-2026-4394.
Action needed (3)
securitycriticalThe go dependency update
The go dependency is bumped in cert-manager v1.19.4 to address CVE-2025-68121.
securityhighcert-manager v1.19.4 vulnerability fixes
cert-manager v1.19.4 is a patch release addressing reported vulnerabilities, including CVE-2026-24051 and CVE-2025-68121.
securityhighThe otel SDK dependency update
The otel SDK dependency is bumped in cert-manager v1.19.4 to address GO-2026-4394.
This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.
Action needed (1)
securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121
The grpc-health-probe dependency is updated to v0. to address CVE-2025-68121.
Check if affected (1)
breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use --read-only.
This release fixes the client-side apply migration issue reported in versions 3. and 3.. No security advisories are disclosed.
Action needed (1)
breakingClient-side apply migration failure
The failed to perform client-side apply migration issue present in versions 3. and 3. is fixed in this release.
v0.18.1 is a dependency update release. It includes an update to coredns-plugin for the latest security fixes, alongside other dependency version changes.
Action needed (1)
securityThe coredns-plugin dependency, updated for security fixes
The coredns-plugin dependency is updated to include the latest security fixes in v0.18.1.
A maintenance release with five disclosed security fixes, one new capability, and ten corrected bugs. It contains no operator prerequisites or dependency-manifest entries.
Action needed (2)
securitymediumCVE-2026-0707, authorization header parsing
This release corrects authorization header parsing that could bypass security controls.
securitylowCVE-2025-5416, keycloak-core environment information disclosure
This release fixes environment information disclosure in keycloak-core.
Check if affected (4)
securitymediumCVE-2026-2575, excessive SAMLRequest decompression
Applies if you use SAML.
securitylowCVE-2026-1190, SAML brokering response delay
Applies if you use SAML brokering.
securitylowCVE-2026-2733, disabled client check for Docker Registry Protocol
Applies if you use the Docker Registry Protocol.
This release includes a security fix for CVE-2025-68121, along with defect corrections and dependency updates. It also changes operator-facing defaults and configuration documentation, including a default that now uses a duration string.
Action needed (1)
securitycriticalCVE-2025-68121 security fix
CVE-2025-68121 is fixed in this release.
Check if affected (1)
breakingDefault value and Helm values documentation format change
Applicability is not stated in the release notes.
A maintenance release with two security fixes and a deprecated KafkaUser API field that requires migration. It also includes API conversion fixes, broker certificate output changes, and dependency and container image updates.
Action needed (1)
securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
The release includes security fixes for CVE-2026-27133 and CVE-2026-27134.
Plan ahead (1)
deprecatedThe . field is deprecated
Applies if you configure ..
OPA v1.13.2 updates the Go version used to build its binaries and images. The release includes the Go standard library fix for GO-2026-4337.
Action needed (1)
securitycriticalGo 1.25.7 build dependency
OPA binaries and images are now built with Go 1.25.7. The Go standard library in that version contains a fix for GO-2026-4337.
A release with breaking changes to package installation and package-cache side-loading, alongside new operator capabilities and ordinary defect corrections. It also includes security-tagged dependency updates, but no advisory identifiers or vulnerability details are provided.
Action needed (7)
securitySecurity update for golang.
The golang. module was updated to v0. as a security update.
securitySecurity update for github.
The github. module was updated to v5. as a security update.
securitySecurity update for github.
The github. module was updated to v3. as a security update.
securitySecurity update for github.
The github. module was updated to v2. as a security update.
securitySecurity update for github.
The github. module was updated to v1. as a security update.
securitySecurity update for github.
The github. module was updated to v1. as a security update.
securitySecurity update for github.
The github. module was updated to v0. as a security update.
Check if affected (2)
breakingInput CRD installation from Function packages
Applies if you use Function packages and Input CRDs.
breakingPackage cache structure
Applicability is not stated in the release notes.
A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.
Action needed (1)
securityhighCVE-2025-61732 cgo comment parsing flaw
This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.
Check if affected (4)
securitycriticalCVE-2025-68121 TLS session resumption validation
Applies if you use Config. with mutations or Config..
securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
securityResource annotation validation against container injection
Applies if you configure resource annotations.
A security release addressing two vulnerabilities in cgo comment parsing and crypto/tls session resumption. The fixes are relevant to deployments using the affected Go functionality.
Action needed (2)
securitycriticalCVE-2025-68121 session resumption vulnerability correction
CVE-2025-68121 corrects a crypto/tls session resumption flaw that could let resumed handshakes succeed after ClientCAs or RootCAs changed between the initial and resumed handshake.
securityhighCVE-2025-61732 code-smuggling vulnerability correction
CVE-2025-61732 addresses a discrepancy in Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.
