Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Aug 2026Clear ×

Backstagev1.54.0CI/CD & App DeliveryAug 18, 2026

ACTION 2CHECK 16PLAN 3OTHER 238View full analysis

A broad release with dependency updates, breaking changes to commands, authentication patterns, and connection APIs, plus new AWS connection support and updates across the catalog, scaffolder, search, and UI. It also includes Kubernetes plugin security fixes and an undisclosed security announcement.

Action needed (2)

breakingStrict TypeScript configuration schema validation
Package preparation now validates TypeScript configuration schemas strictly before publishing.
breakingPortable configuration schemas for root connection types
Connection types now use portable configuration schemas as the source of root connection types.

Check if affected (16)

securityKubernetes plugin security fixes
Applies if you use the Kubernetes plugin.
breakingBackend connection APIs, removed from package exports
Applies if you use connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, or AnyRootConnection.
breakingNode.js snapshots in generated backend Dockerfiles
Applies if you configure generated backend Dockerfiles.
+ 13 more on the release page

Plan ahead (3)

deprecatedThe plugin-web-library template, updated to toastApiRef
Applies if you use the plugin-web-library template.
deprecatedZod v3 schemas, deprecated
Applies if you depend on Zod v3 schemas.
deprecatedThe catalog.providers.backstageOpenapi.plugins option, deprecated
Applies if you configure catalog.providers.backstageOpenapi.plugins.

Source ↗

Argov3.3.14CI/CD & App DeliveryAug 12, 2026

ACTION 2CHECK 2OTHER 2View full analysis

A maintenance release with fixes for secret masking and pprof endpoint configuration, alongside dependency updates for two listed CVEs. The secret-handling fixes and dependency updates are addressed by upgrading, while the remaining defect fixes require no operator action.

Action needed (2)

securityhighThe /ui brace-expansion dependency update for CVE-2026-69152
The /ui dependency brace-expansion is updated to 2.1.4 and 1.1.18 for CVE-2026-69152.
securitymediumThe DOMPurify dependency update for CVE-2026-49978
The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.

Check if affected (2)

securitySSD CLI secret mask spoofing prevention
Applies if you use SSD CLI.
securitySecret hiding in the last-applied-configuration annotation
Applies if you configure last-applied-configuration.

Source ↗

Fluxv2.9.4CI/CD & App DeliveryAug 7, 2026

CHECK 3OTHER 8View full analysis

A maintenance release with correctness fixes that narrow some existing configuration constraints. It also adds CLI repository migration support and updates dependencies; no explicit security advisory or vulnerability is disclosed.

Check if affected (3)

breakingThe image-automation-controller refspec constraint
Applies if you configure refspecs.
breakingGCS static authentication limited to service account keys
Applies if you configure GCS static authentication.
breakingThe allow-webhooks network policy restriction
Applies if you configure allow-webhooks.

Source ↗

Argov3.5.0CI/CD & App DeliveryAug 4, 2026

ACTION 3CHECK 1OTHER 286View full analysis

A maintenance release focused on operator-facing bug fixes, with additional feature and configuration work. It also includes dependency updates, including a UI dependency update for CVE-2026-41240.

Action needed (3)

securitymediumThe redoc/dompurify dependency update for CVE-2026-41240
The UI dependency redoc/dompurify is bumped to v3.4.0 to fix CVE-2026-41240.
securityThe formidable dependency update
The formidable dependency is updated to v2.1.3.
breakingThe auto-sync toggle removal from the app top bar
The auto-sync toggle is removed from the app top bar.

Check if affected (1)

breakingThe theme default changed to auto
Applies if theme is not configured.

Source ↗

Browse by month