RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
CoreDNSv1.14.7Kubernetes CoreAug 19, 2026
ACTION 1CHECK 3OTHER 42View full analysis

A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.

Action needed (1)

Check if affected (3)

  • securityplugin/acl autopath ACL checks

    Applies if you use plugin/acl and autopath.

  • breakingplugin/forward default connection attempts

    Applies if you use plugin/forward.

  • breakingplugin/hosts unsupported-type fallthrough

    Applies if you use plugin/hosts.

Source ↗
containerdv2.2.7Kubernetes CoreAug 12, 2026
CHECK 3PLAN 1OTHER 5View full analysis

A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.

Check if affected (3)

  • breakingThe enable_experimental_restore_via_create default

    Applies if you use CreateContainer.

  • breakingThe ScrubLogs default on Windows

    Applies if you run on Windows.

  • breakingCheckpoint restore without CRIU

    Applies if you do not have CRIU installed.

Plan ahead (1)

  • deprecatedRestore in CreateContainer, deprecated

    Applies if you use CreateContainer.

Source ↗
containerdv2.3.4Kubernetes CoreAug 12, 2026
CHECK 3PLAN 1OTHER 11View full analysis

A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.

Check if affected (3)

  • breakingCheckpoint restore in CreateContainer disabled by default

    Applies if you set enable_experimental_restore_via_create.

  • breakingruntimeFeatures.UserNamespacesHostNetwork enabled by default

    Applies if you run CRI.

  • breakingLog scrubbing enabled by default on Windows

    Applies if you run Windows.

Plan ahead (1)

  • deprecatedCheckpoint restore in CreateContainer deprecated

    Applies if you use CreateContainer.

Source ↗
etcdv3.7.1Kubernetes CoreJul 23, 2026
ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

  • securityhighThe google.golang.org/grpc dependency update

    The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.

  • breakingThe snapshotLimitByte default

    The release sets a reasonable default value for snapshotLimitByte.

  • breakingThe client HTTP server ReadHeaderTimeout

    The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

  • securityhighWatch responses restricted to authorized keys

    Applicability is not stated in the release notes.

Source ↗
Limav2.2.0Kubernetes CoreJul 21, 2026
CHECK 3OTHER 18View full analysis

An experimental feature release adds guest, CLI, template, VM-driver, and device capabilities. It also changes the Windows default driver and socket_vmnet access constraint, removes a host dependency, and updates nerdctl.

Check if affected (3)

  • breakingThe default VM driver, from wsl2 to qemu

    Applies if you do not configure the VM driver.

  • breakingThe socket_vmnet access constraint

    Applies if you use socket_vmnet.

  • breakingThe almalinux-kitten template, moved to experimental/

    Applies if you use almalinux-kitten.

Source ↗
CoreDNSv1.14.5Kubernetes CoreJul 10, 2026
ACTION 1CHECK 1OTHER 30View full analysis

A release with operator-visible behavior corrections, new capabilities, configuration changes, and updated defaults. The changes span CoreDNS core behavior and multiple plugins, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

  • breakingGo TLS defaults in core

    The core component uses Go TLS defaults in this release.

Check if affected (1)

  • breakingDefault truncate amount for bare truncate

    Applies if you configure truncate.

Source ↗
containerdv2.3.3Kubernetes CoreJul 10, 2026
CHECK 2OTHER 7View full analysis

A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.

Check if affected (2)

  • breakingThe CreateContainer constraint for stopped sandboxes

    Applies if you use CreateContainer when the sandbox is not running.

  • breakingThe erofs default mkfs block size

    Applies if you use erofs across platforms.

Source ↗
etcdv3.7.0Kubernetes CoreJul 8, 2026
ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if you configure --listen-client-http-urls.

Source ↗
k8gbv0.20.0Kubernetes CoreJul 3, 2026
CHECK 4OTHER 49View full analysis

k8gb v0.20.0 centers on ZoneDelegation-based DNS management, with TLSRoute and annotation support alongside changes to defaults and naming. The release also includes defect fixes and dependency updates, and no security advisories or vulnerabilities are identified.

Check if affected (4)

  • breakingThe Bootstrap service, removed

    Applies if your configuration uses the Bootstrap service.

  • breakingThe dynamicZones setting, removed

    Applies if your configuration uses dynamicZones.

  • breakingThe doFinalize default, set to false

    Applies if you use doFinalize in ZoneDelegation finalization.

  • + 1 more on the release page
Source ↗
etcdv3.6.13Kubernetes CoreJul 1, 2026
ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

  • securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0

    The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

  • securityhighgolang.org/x/crypto, updated to v0.52.0

    The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if --listen-client-http-urls is configured.

Source ↗
etcdv3.5.32Kubernetes CoreJul 1, 2026
ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

  • securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883

    go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

  • securityCRL enforcement with --listen-client-http-urls

    Applies if --listen-client-http-urls is configured.

Source ↗
Limav2.1.3Kubernetes CoreJun 19, 2026
CHECK 5OTHER 2View full analysis

A maintenance release that changes several defaults, updates dependencies, and fixes multiple security vulnerabilities. It also includes a fallback to scp for remote sources and destinations in auto mode.

Check if affected (5)

  • securitycriticalcontainerd v2.3.2 security fixes

    Applies if you use containerd.

  • securityhighCVE-2026-53657 and GHSA-2j9v-p4xj-cjw2 guest agent socket fix

    Applies if you run a QEMU VM that uses the guest agent socket.

  • breakingcontainerd.user default on non-Linux guests

    Applies if you run non-Linux guests.

  • + 2 more on the release page
Source ↗
CoreDNSv1.14.4Kubernetes CoreJun 9, 2026
CHECK 1OTHER 20View full analysis

A release with new plugin capabilities, stricter validation, DNS and cache behavior changes, expanded platform support, and malformed-input handling fixes. The HTTP/3 request header limit is narrowed for DoH3.

Check if affected (1)

  • breakingBound DoH3 HTTP/3 request header size

    Applies if you use DoH3.

Source ↗
Limav2.1.2Kubernetes CoreJun 1, 2026
CHECK 1PLAN 1OTHER 34View full analysis

A feature and maintenance release with CLI and template changes, QEMU behavior updates, and fixes across drivers, hostagent, shell, and guest support. It also includes a deprecation, while no security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

  • breakingQEMU 2MB OVMF images dropped by openSUSE

    Applicability is not stated in the release notes.

Plan ahead (1)

  • deprecatedThe _LIMA_QEMU_UEFI_IN_BIOS flag, deprecated

    Applies if you configure _LIMA_QEMU_UEFI_IN_BIOS.

Source ↗
containerdv2.0.9Kubernetes CoreMay 20, 2026
ACTION 1CHECK 1OTHER 7View full analysis

A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.

Action needed (1)

Check if affected (1)

  • breakingThe default seccomp socket policy

    Applies if you use seccomp.

Source ↗
containerdv2.3.1Kubernetes CoreMay 20, 2026
ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

  • securityhighCVE-2026-46680 correction

    The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

  • breakingThe overlayfs "rebase" capability, disabled in user namespaces

    Applies if you use overlayfs and run in a user namespace.

Plan ahead (1)

  • deprecatedTask fields in Runc options, deprecated

    Applies if you configure task fields in Runc options.

Source ↗
Helmv4.2.0Kubernetes CoreMay 14, 2026
ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

  • securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394

    Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

  • securityPlugin version path traversal fix

    Applies if you use the Plugin extension.

Plan ahead (1)

  • deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated

    Applies if you use --hide-notes or --render-subchart-notes.

Source ↗
etcdv3.6.11Kubernetes CoreMay 1, 2026
ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a correctness fix, an RBAC authorization bypass fix, and a security-related dependency update for GO-2026-4962. It also records Go 1.25.9 as the toolchain used to build the binaries.

Action needed (1)

  • securitymediumgolang.org/x/image update for GO-2026-4962

    The release updates golang.org/x/image to v0.39.0 to resolve GO-2026-4962.

Check if affected (1)

  • securityRBAC authorization bypass in nested Put requests

    Applies if you use RBAC.

Source ↗
etcdv3.4.44Kubernetes CoreMay 1, 2026
CHECK 1OTHER 1View full analysis

A security maintenance release fixes an RBAC authorization bypass. It also updates the Go toolchain used to compile binaries to go 1.25.9.

Check if affected (1)

  • securityRBAC authorization bypass fix

    Applies if you use RBAC.

Source ↗
containerdapi/v1.11.0Kubernetes CoreApr 30, 2026
CHECK 1OTHER 6View full analysis

This release adds and changes API and runtime capabilities, removes a sandbox metadata field, and updates a dependency. No security advisories or vulnerabilities are disclosed.

Check if affected (1)

  • breakingThe Container sandbox metadata field, removed

    Applies if you use Container in API specs.

Source ↗
Kubernetesv1.36.0Kubernetes CoreApr 22, 2026
ACTION 11CHECK 25PLAN 6OTHER 293View full analysis

A broad operator-significant release with API, configuration, CLI default, scheduling, runtime, feature-gate, metric, and dependency changes. Upgrade review and testing matter for users of removed or deprecated interfaces, changed defaults, custom scheduler integrations, CRDs, audit logging, and affected metrics.

Action needed (11)

  • breakingStrictIPCIDRValidation enabled by default

    The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.

  • breakingThe default debug profile, changed to general

    The default debug profile changes from legacy to general.

  • breakingWatchCacheInitializationPostStartHook enabled by default

    The WatchCacheInitializationPostStartHook feature gate is enabled by default.

  • breakingKubeletPSI graduation to GA

    The KubeletPSI feature graduated to GA and is enabled by default.

  • breakingRelaxedServiceNameValidation at beta, enabled by default

    The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.

  • breakingRestartAllContainersOnContainerExits at beta, enabled by default

    The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.

  • breakingSuspended-job feature gates enabled by default

    The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.

  • breakingAtomicFIFO informer store updates

    Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.

  • breakingUnlockWhileProcessing informer behavior

    Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.

  • breakingClientsAllowCARotation functionality enabled by default

    This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.

  • breakingClientsAllowTLSCacheGC functionality enabled by default

    This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.

Check if affected (25)

  • breakingThe volume_operation_total_errors metric, renamed

    Applies if you use volume_operation_total_errors.

  • breakingThe git-repo volume plugin, disabled

    Applies if you use the git-repo volume plugin.

  • breakingAllowlistEntry.Name, renamed to AllowlistEntry.Command

    Applies if you configure AllowlistEntry.Name.

  • + 22 more on the release page

Plan ahead (6)

  • deprecatedService .spec.externalIPs deprecation

    Applies if you configure Service .spec.externalIPs.

  • deprecatedDirect access to metav1.FieldsV1.Raw, deprecated

    Applies if you use metav1.FieldsV1.Raw.

  • deprecatedMinNodeScore and MaxNodeScore, deprecated

    Applies if you use MinNodeScore or MaxNodeScore.

  • + 3 more on the release page
Source ↗
CoreDNSv1.14.3Kubernetes CoreApr 22, 2026
ACTION 1CHECK 1OTHER 34View full analysis

A maintenance release that adds operator-facing options and transport, plugin, and protocol support while correcting defects. It is built with Go 1.26.2, which contains fixes for disclosed CVEs; other changes concern operators using the affected features or behaviors.

Action needed (1)

Check if affected (1)

  • breakingOversized DoH GET query parameter rejection

    Applies if you use DoH.

Source ↗
Kubernetesv1.35.4Kubernetes CoreApr 15, 2026
CHECK 1OTHER 4View full analysis

A maintenance release with the Go 1.25.9 toolchain and several correctness fixes. It changes the default for StatefulSet parallel pod management and includes fixes for kubelet restarts, apiserver audit-log latency annotations, and kube-proxy nftables support.

Check if affected (1)

  • breakingDefault for MaxUnavailableStatefulSet

    Applies if you do not enable MaxUnavailableStatefulSet.

Source ↗
containerdv2.0.8Kubernetes CoreApr 14, 2026
ACTION 1CHECK 1OTHER 4View full analysis

containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.

Action needed (1)

  • securityhighThe spdystream update for CVE-2026-35469

    The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.

Check if affected (1)

  • securityCredential sanitization before gRPC returns

    Applies if you use pod events through the Container Runtime Interface (CRI).

Source ↗
containerdv2.1.7Kubernetes CoreApr 14, 2026
ACTION 2CHECK 1OTHER 14View full analysis

A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.

Action needed (2)

  • securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2

    The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.

  • securityhighgithub.com/moby/spdystream v0.5.1 update

    The release updates github.com/moby/spdystream to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

  • securityCredential sanitization before gRPC returns

    Applies if pod events are used.

Source ↗
containerdv1.7.31Kubernetes CoreApr 14, 2026
ACTION 1CHECK 1OTHER 9View full analysis

containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.

Action needed (1)

Check if affected (1)

  • securitySanitized gRPC errors in pod events

    Applies if you use pod events.

Source ↗
Helmv3.20.2Kubernetes CoreApr 9, 2026
CHECK 1View full analysis

A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.

Check if affected (1)

  • securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse

    Applies if you use Helm Chart extraction.

Source ↗
Helmv4.1.4Kubernetes CoreApr 9, 2026
ACTION 1CHECK 2OTHER 1View full analysis

A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.

Action needed (1)

  • securitymediumGHSA-hr2v-4r36-88hr security fix

    GHSA-hr2v-4r36-88hr is addressed in this release.

Check if affected (2)

  • securityhighPlugin verification when .prov is missing

    Applies if you use plugins.

  • securityhighPlugin metadata version path traversal

    Applies if you use plugins.

Source ↗
Limav2.1.1Kubernetes CoreApr 3, 2026
CHECK 1OTHER 4View full analysis

A release with Windows artifacts, broader guest and template configuration support, and changed vz audio handling. It also updates the bundled nerdctl distribution and dependencies, including security updates in BuildKit and CNI plugins that are obtained by upgrading.

Check if affected (1)

  • securityBuildKit and CNI plugins security updates

    Applies if you use BuildKit or CNI plugins.

Source ↗
k8gbv0.19.0Kubernetes CoreMar 22, 2026
CHECK 2OTHER 16View full analysis

A feature and maintenance release that introduces a vendor-neutral API with a user-controlled migration workflow, alongside preview Dynamic Zones support. It also changes Helm and runtime image distribution locations and updates dependencies.

Check if affected (2)

  • breakingThe helm repository, switched to OCI

    Applies if you use Helm.

  • breakingThe API group, renamed to k8gb.io/v1beta1

    Applies if you use k8gb.absa.oss/v1beta1.

Source ↗
etcdv3.6.9Kubernetes CoreMar 20, 2026
ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

  • securitycriticalgoogle.golang.org/grpc updated to 1.79.3

    The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.

  • securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413

    The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.

  • securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0

    The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.

  • securityhighgolang.org/x/net updated to v0.51.0

    The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

  • securitylowRBAC checks for nested etcd transactions, CVE-2026-33343

    Applies if you use nested etcd transactions and RBAC.

Source ↗
etcdv3.5.28Kubernetes CoreMar 20, 2026
ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

  • securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3

    The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.

  • securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0

    The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.

  • securityhighThe golang.org/x/net dependency, updated to v0.51.0

    The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

  • securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)

    Applies if you use unauthenticated endpoints.

  • securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)

    Applies if you use nested txn ops.

Source ↗
Limav2.1.0Kubernetes CoreMar 17, 2026
CHECK 1OTHER 13View full analysis

A feature release that adds guest OS support, CLI capabilities, virtualization and synchronization features, template support, and a default hypervisor change for non-native architectures. The guest home directory moves from /home/${USER}.linux to /home/${USER}.guest with a compatibility symlink, and no security changes are disclosed.

Check if affected (1)

  • breakingQEMU as the default hypervisor for non-native architectures

    Applies if QEMU runs on non-native architectures.

Source ↗
CoreDNSv1.14.2Kubernetes CoreMar 6, 2026
ACTION 1CHECK 2OTHER 7View full analysis

A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.

Action needed (1)

Check if affected (2)

  • securityhighThe rewrite and acl ordering, CVE-2026-26017

    Applies if you use both rewrite and acl.

  • securityhighplugin/loop query name generation, CVE-2026-26018

    Applies if plugin/loop runs.

Source ↗
Kubernetesv1.35.1Kubernetes CoreFeb 10, 2026
CHECK 1OTHER 17View full analysis

A maintenance release with numerous correctness fixes and an enforced feature-gate default change. It also updates the Go toolchain and hnslib dependency, with no disclosed security advisories.

Check if affected (1)

  • breakingThe SchedulerAsyncAPICalls feature gate, disabled by default

    Applies if you use the SchedulerAsyncAPICalls feature gate.

Source ↗
CoreDNSv1.14.1Kubernetes CoreJan 16, 2026
ACTION 1CHECK 1OTHER 2View full analysis

A security-focused maintenance release addresses disclosed Go vulnerabilities and improves proxy connection-pool performance. It also adds the forward plugin's max_idle_conns parameter, which defaults to 0 for an unbounded pool.

Action needed (1)

  • securityhighCVE-2025-68119 fix

    The release also addresses CVE-2025-68119, which affects the stated Go versions.

Check if affected (1)

  • securitycriticalGo security vulnerability fixes

    Applicability is not stated in the release notes.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023