RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
hamiv2.10.0AI & MLYesterdayAug 21, 2026
ACTION 3CHECK 7OTHER 195View full analysis

A substantial operator-focused maintenance release with broad bug and behavior fixes, alongside new scheduling, device, configuration, and observability capabilities. It also updates security-relevant dependencies and the runtime/toolchain while removing obsolete functionality that may affect compatibility and configuration.

Action needed (3)

  • securitytensorflow/tensorflow upgraded to 2.21.0rc0-gpu

    The tensorflow/tensorflow dependency is upgraded from 2.20.0rc0-gpu to 2.21.0rc0-gpu.

  • securitytensorflow/tensorflow upgraded to 2.21.0rc1-gpu

    The tensorflow/tensorflow dependency is upgraded from 2.21.0rc0-gpu to 2.21.0rc1-gpu.

  • securitygolang security upgrade

    The golang runtime is upgraded to address a security issue.

Check if affected (7)

  • breakingDRA components removed from the HAMi main chart

    Applies if you use DRA components in the HAMi main chart.

  • breakingWebhook denial of privileged containers

    Applies if you use the webhook.

  • breakingDeprecated scheduler policy configmap removed

    Applies if you configure the deprecated scheduler policy configmap.

  • + 4 more on the release page
Source ↗
KServev0.20.0AI & MLAug 6, 2026
ACTION 2CHECK 7OTHER 48View full analysis

This release adds new inference-service, storage, runtime, routing, and deployment capabilities, alongside correctness fixes and dependency updates. Operators should review the Starlette security update, changed defaults, and narrower readiness behavior.

Action needed (2)

  • securitymediumstarlette dependency update for CVE-2026-48710

    The starlette dependency is bumped to >=1.0.1 for CVE-2026-48710.

  • breakingStandard default alignment with the llm-d optimized baseline

    The standard default is aligned with the llm-d optimized baseline.

Check if affected (7)

  • breakinglora-affinity-scorer default for LoRA adapters

    Applies if you use LoRA adapters.

  • breakingLLMInferenceServiceConfig deletion-prevention finalizer

    Applies if you use LLMInferenceServiceConfig.

  • breakingendpointPickerRef default EPP port

    Applies if you configure endpointPickerRef and do not configure port.

  • + 4 more on the release page
Source ↗
Kubeflow26.03.1AI & MLJun 15, 2026
ACTION 2CHECK 1OTHER 25View full analysis

A calendar-versioned release with a breaking dashboard upgrade requirement, updated components and dependencies, new defaults, and fixes for deployment and configuration defects. Security hardening is included, but no specific vulnerability or advisory is disclosed.

Action needed (2)

  • breakingmodel-registry UI enabled by default

    The model-registry UI is enabled by default in this release.

  • breakingTwo dex replicas without a sticky service

    dex runs two replicas without a sticky service by default in this release.

Check if affected (1)

  • breakingBreaking dashboard upgrade requirement

    Applies if you use the dashboard.

Source ↗
KServev0.19.0AI & MLJun 14, 2026
ACTION 1CHECK 3OTHER 44View full analysis

A release with operator-facing additions and fixes, including new LLMInferenceService capabilities and status observability. It also updates dependencies and images and includes security-related fixes.

Action needed (1)

  • securityhighazure-core pinned for CVE-2026-21226

    The azure-core dependency is pinned to >=1.38.0 to address CVE-2026-21226.

Check if affected (3)

  • securityvllm setup and pillow dependency fixes

    Applies if you depend on vllm or pillow.

  • breakingIncorrect CRDs removed from llmisvc-crd

    Applies if you use llmisvc-crd.

  • breakingHelm imagePullPolicy defaults

    Applies if you use Helm.

Source ↗
hamiv2.9.0AI & MLMay 19, 2026
ACTION 3CHECK 3OTHER 59View full analysis

A feature and maintenance release that adds HAMi-core, Ascend and vNPU virtualization, DRA, CDI, monitoring, metrics, deployment, and debugging capabilities. It also includes scheduling, allocation, device, chart, and compatibility fixes, security updates, dependency upgrades, and removal of a deprecated scheduler policy ConfigMap.

Action needed (3)

  • securityThe tensorflow/tensorflow dependency, upgraded

    The tensorflow/tensorflow dependency was upgraded from 2.20.0rc0-gpu to 2.21.0rc0-gpu in this release.

  • securityThe tensorflow/tensorflow dependency, upgraded again

    The tensorflow/tensorflow dependency was upgraded from 2.21.0rc0-gpu to 2.21.0rc1-gpu in this release.

  • securityThe golang dependency, upgraded

    The golang dependency was upgraded for a security issue in this release.

Check if affected (3)

  • breakingThe deprecated scheduler policy configmap, removed

    Applies if you configure scheduler policy configmap.

  • breakingThe Helm nvidia.overwriteEnv default

    Applies if you use Helm.

  • breakingHost networking for the device plugin, disabled

    Applies if the device plugin runs.

Source ↗
KServev0.18.0AI & MLApr 29, 2026
ACTION 3CHECK 2OTHER 61View full analysis

A release with operator-facing fixes, new capabilities, API and configuration changes, and dependency updates. It also includes fixes for CVE-2026-32597 in PyJWT and CVE-2026-30922 in pyasn1.

Action needed (3)

  • securityhighCVE-2026-32597 PyJWT validation fix

    PyJWT crit header validation was fixed for CVE-2026-32597.

  • securityhighCVE-2026-30922 pyasn1 fix

    The pyasn1 dependency was updated to address CVE-2026-30922 and its denial-of-service vulnerability.

  • breakingRequired MaxReplicas field

    MaxReplicas is now required and must use the int32 type.

Check if affected (2)

  • breakingRemoval of the scheduler cert-hash restart annotation

    Applies if you configure cert-hash.

  • breakingPYTHONPATH blocked by ISVC and ServingRuntime webhooks

    Applies if you configure PYTHONPATH.

Source ↗
Kubeflow26.03AI & MLMar 22, 2026
ACTION 1CHECK 1OTHER 18View full analysis

This release updates supported Kubernetes and pod-security configurations, installation behavior, and bundled component versions. The main operator-facing changes are the Kubernetes 1.34+ requirement and the baseline pod-security enforcement default, alongside fixes and new capabilities.

Action needed (1)

  • breakingBaseline pod security enforcement

    Pod security enforcement changes to the baseline level in this release.

Check if affected (1)

  • breakingKubernetes 1.34+ requirement

    Applies if you use Kubernetes 1.34+.

Source ↗
KServev0.17.0AI & MLMar 13, 2026
ACTION 13CHECK 6OTHER 91View full analysis

An operator release with expanded configuration and LLMInferenceService capabilities, plus chart and dependency updates, behavior changes, removals, and defect corrections. It also includes security fixes for operators to review.

Action needed (13)

  • securitycriticalh11 malformed-body fix for CVE-2025-43859

    h11 malformed-body handling associated with CVE-2025-43859 is addressed in this release.

  • securityhighstarlette version 0.49.1

    starlette is pinned to version 0.49.1 to fix CVE-2025-62727 in this release.

  • securityhighlightgbm version 4.6.0

    lightgbm is updated to version 4.6.0 for CVE-2024-43598 in this release.

  • securityhighCVE-2025-66418 decompression-chain fix

    The unbounded number of links in the decompression chain associated with CVE-2025-66418 is addressed in this release.

  • securityhighexpr-lang/expr version v1.17.7

    expr-lang/expr is updated to v1.17.7 to fix CVE-2025-68156 in this release.

  • securityhighcryptography fix for CVE-2026-26007

    The cryptography issue associated with CVE-2026-26007 is addressed in this release.

  • securityhighpython-multipart fix for CVE-2026-24486

    The arbitrary file write issue in python-multipart associated with CVE-2026-24486 is addressed in this release.

  • securitymediumFixes for CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181

    This release addresses CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181.

  • securityhttps.go path traversal prevention

    The path traversal issue in https.go is prevented in this release.

  • securitySeveral CVE fixes

    This release addresses several CVEs.

  • securityAIOHTTP HTTP Parser auto_decompress fix

    The AIOHTTP HTTP Parser auto_decompress feature issue involving zip bombs is addressed in this release.

  • securityextractTarFiles path traversal fix

    The path traversal vulnerability in extractTarFiles is addressed in this release.

  • breakingminio replacement with seaweedfs

    minio is replaced with seaweedfs in this release.

Check if affected (6)

  • breakinginferenceservice CRD cert-manager annotation removal

    Applies if you use the inferenceservice CRD.

  • breakingPython 3.9 support removal

    Applies if you run Python 3.9.

  • breakingDeprecated --disable-log-requests flag removal

    Applies if you configure --disable-log-requests.

  • + 3 more on the release page
Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023