Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

CoreDNSv1.14.7Kubernetes CoreAug 19, 2026

ACTION 1CHECK 3OTHER 42View full analysis

A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.

Action needed (1)

securityhighGo 1.26.6 security fixes
The release is built with Go 1.26.6, including fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.

Check if affected (3)

securityplugin/acl autopath ACL checks
Applies if you use plugin/acl and autopath.
breakingplugin/forward default connection attempts
Applies if you use plugin/forward.
breakingplugin/hosts unsupported-type fallthrough
Applies if you use plugin/hosts.

Source ↗

containerdv2.2.7Kubernetes CoreAug 12, 2026

CHECK 3PLAN 1OTHER 5View full analysis

A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.

Check if affected (3)

breakingThe enable_experimental_restore_via_create default
Applies if you use CreateContainer.
breakingThe ScrubLogs default on Windows
Applies if you run on Windows.
breakingCheckpoint restore without CRIU
Applies if you do not have CRIU installed.

Plan ahead (1)

deprecatedRestore in CreateContainer, deprecated
Applies if you use CreateContainer.

Source ↗

containerdv2.3.4Kubernetes CoreAug 12, 2026

CHECK 3PLAN 1OTHER 11View full analysis

A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.

Check if affected (3)

breakingCheckpoint restore in CreateContainer disabled by default
Applies if you set enable_experimental_restore_via_create.
breakingruntimeFeatures.UserNamespacesHostNetwork enabled by default
Applies if you run CRI.
breakingLog scrubbing enabled by default on Windows
Applies if you run Windows.

Plan ahead (1)

deprecatedCheckpoint restore in CreateContainer deprecated
Applies if you use CreateContainer.

Source ↗

Limav2.2.0Kubernetes CoreJul 21, 2026

CHECK 3OTHER 18View full analysis

An experimental feature release adds guest, CLI, template, VM-driver, and device capabilities. It also changes the Windows default driver and socket_vmnet access constraint, removes a host dependency, and updates nerdctl.

Check if affected (3)

breakingThe default VM driver, from wsl2 to qemu
Applies if you do not configure the VM driver.
breakingThe socket_vmnet access constraint
Applies if you use socket_vmnet.
breakingThe almalinux-kitten template, moved to experimental/
Applies if you use almalinux-kitten.

Source ↗

CoreDNSv1.14.5Kubernetes CoreJul 10, 2026

ACTION 1CHECK 1OTHER 30View full analysis

A release with operator-visible behavior corrections, new capabilities, configuration changes, and updated defaults. The changes span CoreDNS core behavior and multiple plugins, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

breakingGo TLS defaults in core
The core component uses Go TLS defaults in this release.

Check if affected (1)

breakingDefault truncate amount for bare truncate
Applies if you configure truncate.

Source ↗

containerdv2.3.3Kubernetes CoreJul 10, 2026

CHECK 2OTHER 7View full analysis

A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.

Check if affected (2)

breakingThe CreateContainer constraint for stopped sandboxes
Applies if you use CreateContainer when the sandbox is not running.
breakingThe erofs default mkfs block size
Applies if you use erofs across platforms.

Source ↗

k8gbv0.20.0Kubernetes CoreJul 3, 2026

CHECK 4OTHER 49View full analysis

k8gb v0.20.0 centers on ZoneDelegation-based DNS management, with TLSRoute and annotation support alongside changes to defaults and naming. The release also includes defect fixes and dependency updates, and no security advisories or vulnerabilities are identified.

Check if affected (4)

breakingThe Bootstrap service, removed
Applies if your configuration uses the Bootstrap service.
breakingThe dynamicZones setting, removed
Applies if your configuration uses dynamicZones.
breakingThe doFinalize default, set to false
Applies if you use doFinalize in ZoneDelegation finalization.
+ 1 more on the release page

Source ↗

Limav2.1.3Kubernetes CoreJun 19, 2026

CHECK 5OTHER 2View full analysis

A maintenance release that changes several defaults, updates dependencies, and fixes multiple security vulnerabilities. It also includes a fallback to scp for remote sources and destinations in auto mode.

Check if affected (5)

securitycriticalcontainerd v2.3.2 security fixes
Applies if you use containerd.
securityhighCVE-2026-53657 and GHSA-2j9v-p4xj-cjw2 guest agent socket fix
Applies if you run a QEMU VM that uses the guest agent socket.
breakingcontainerd.user default on non-Linux guests
Applies if you run non-Linux guests.
+ 2 more on the release page

Source ↗

CoreDNSv1.14.4Kubernetes CoreJun 9, 2026

CHECK 1OTHER 20View full analysis

A release with new plugin capabilities, stricter validation, DNS and cache behavior changes, expanded platform support, and malformed-input handling fixes. The HTTP/3 request header limit is narrowed for DoH3.

Check if affected (1)

breakingBound DoH3 HTTP/3 request header size
Applies if you use DoH3.

Source ↗

Limav2.1.2Kubernetes CoreJun 1, 2026

CHECK 1PLAN 1OTHER 34View full analysis

A feature and maintenance release with CLI and template changes, QEMU behavior updates, and fixes across drivers, hostagent, shell, and guest support. It also includes a deprecation, while no security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingQEMU 2MB OVMF images dropped by openSUSE
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedThe _LIMA_QEMU_UEFI_IN_BIOS flag, deprecated
Applies if you configure _LIMA_QEMU_UEFI_IN_BIOS.

Source ↗

containerdv2.0.9Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1OTHER 7View full analysis

A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.

Action needed (1)

securityhighThe CVE-2026-46680 security fix
A security fix for CVE-2026-46680, also identified as GHSA-fqw6-gf59-qr4w, ships in this release.

Check if affected (1)

breakingThe default seccomp socket policy
Applies if you use seccomp.

Source ↗

containerdv2.3.1Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

securityhighCVE-2026-46680 correction
The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

breakingThe overlayfs "rebase" capability, disabled in user namespaces
Applies if you use overlayfs and run in a user namespace.

Plan ahead (1)

deprecatedTask fields in Runc options, deprecated
Applies if you configure task fields in Runc options.

Source ↗

containerdapi/v1.11.0Kubernetes CoreApr 30, 2026

CHECK 1OTHER 6View full analysis

This release adds and changes API and runtime capabilities, removes a sandbox metadata field, and updates a dependency. No security advisories or vulnerabilities are disclosed.

Check if affected (1)

breakingThe Container sandbox metadata field, removed
Applies if you use Container in API specs.

Source ↗

Kubernetesv1.36.0Kubernetes CoreApr 22, 2026

ACTION 11CHECK 25PLAN 6OTHER 293View full analysis

A broad operator-significant release with API, configuration, CLI default, scheduling, runtime, feature-gate, metric, and dependency changes. Upgrade review and testing matter for users of removed or deprecated interfaces, changed defaults, custom scheduler integrations, CRDs, audit logging, and affected metrics.

Action needed (11)

breakingStrictIPCIDRValidation enabled by default
The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.
breakingThe default debug profile, changed to general
The default debug profile changes from legacy to general.
breakingWatchCacheInitializationPostStartHook enabled by default
The WatchCacheInitializationPostStartHook feature gate is enabled by default.
breakingKubeletPSI graduation to GA
The KubeletPSI feature graduated to GA and is enabled by default.
breakingRelaxedServiceNameValidation at beta, enabled by default
The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.
breakingRestartAllContainersOnContainerExits at beta, enabled by default
The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.
breakingSuspended-job feature gates enabled by default
The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.
breakingAtomicFIFO informer store updates
Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.
breakingUnlockWhileProcessing informer behavior
Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.
breakingClientsAllowCARotation functionality enabled by default
This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.
breakingClientsAllowTLSCacheGC functionality enabled by default
This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.

Check if affected (25)

breakingThe volume_operation_total_errors metric, renamed
Applies if you use volume_operation_total_errors.
breakingThe git-repo volume plugin, disabled
Applies if you use the git-repo volume plugin.
breakingAllowlistEntry.Name, renamed to AllowlistEntry.Command
Applies if you configure AllowlistEntry.Name.
+ 22 more on the release page

Plan ahead (6)

deprecatedService .spec.externalIPs deprecation
Applies if you configure Service .spec.externalIPs.
deprecatedDirect access to metav1.FieldsV1.Raw, deprecated
Applies if you use metav1.FieldsV1.Raw.
deprecatedMinNodeScore and MaxNodeScore, deprecated
Applies if you use MinNodeScore or MaxNodeScore.
+ 3 more on the release page

Source ↗

CoreDNSv1.14.3Kubernetes CoreApr 22, 2026

ACTION 1CHECK 1OTHER 34View full analysis

A maintenance release that adds operator-facing options and transport, plugin, and protocol support while correcting defects. It is built with Go 1.26.2, which contains fixes for disclosed CVEs; other changes concern operators using the affected features or behaviors.

Action needed (1)

securitycriticalGo 1.26.2 build with security fixes
The release is built with Go 1.26.2, which includes security fixes for CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

Check if affected (1)

breakingOversized DoH GET query parameter rejection
Applies if you use DoH.

Source ↗

Kubernetesv1.35.4Kubernetes CoreApr 15, 2026

CHECK 1OTHER 4View full analysis

A maintenance release with the Go 1.25.9 toolchain and several correctness fixes. It changes the default for StatefulSet parallel pod management and includes fixes for kubelet restarts, apiserver audit-log latency annotations, and kube-proxy nftables support.

Check if affected (1)

breakingDefault for MaxUnavailableStatefulSet
Applies if you do not enable MaxUnavailableStatefulSet.

Source ↗

k8gbv0.19.0Kubernetes CoreMar 22, 2026

CHECK 2OTHER 16View full analysis

A feature and maintenance release that introduces a vendor-neutral API with a user-controlled migration workflow, alongside preview Dynamic Zones support. It also changes Helm and runtime image distribution locations and updates dependencies.

Check if affected (2)

breakingThe helm repository, switched to OCI
Applies if you use Helm.
breakingThe API group, renamed to k8gb.io/v1beta1
Applies if you use k8gb.absa.oss/v1beta1.

Source ↗

Limav2.1.0Kubernetes CoreMar 17, 2026

CHECK 1OTHER 13View full analysis

A feature release that adds guest OS support, CLI capabilities, virtualization and synchronization features, template support, and a default hypervisor change for non-native architectures. The guest home directory moves from /home/${USER}.linux to /home/${USER}.guest with a compatibility symlink, and no security changes are disclosed.

Check if affected (1)

breakingQEMU as the default hypervisor for non-native architectures
Applies if QEMU runs on non-native architectures.

Source ↗

Kubernetesv1.35.1Kubernetes CoreFeb 10, 2026

CHECK 1OTHER 17View full analysis

A maintenance release with numerous correctness fixes and an enforced feature-gate default change. It also updates the Go toolchain and hnslib dependency, with no disclosed security advisories.

Check if affected (1)

breakingThe SchedulerAsyncAPICalls feature gate, disabled by default
Applies if you use the SchedulerAsyncAPICalls feature gate.

Source ↗

Browse by month