AI-analyzed release notes for CNCF graduated and incubating projects.
A feature and maintenance release that introduces a vendor-neutral API with a user-controlled migration workflow, alongside preview Dynamic Zones support. It also changes Helm and runtime image distribution locations and updates dependencies.
Check if affected (2)
breakingThe helm repository, switched to OCI
Applies if you use Helm.
breakingThe API group, renamed to k8gb.
Applies if you use k8gb..
A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.
Action needed (4)
securitycriticalgoogle. updated to 1.
The release updates google. to 1. to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo. updated to v1.
The release updates go. to v1.. The update addresses GO-2026-4394.
securityhighgolang. updated to v0.
The release updates golang. to v0. to resolve GO-2026-4559.
Check if affected (1)
securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.
A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.
Action needed (3)
securitycriticalThe google. dependency, updated to 1.
The release updates google. to 1. to resolve CVE-2026-33186.
securityhighThe go. dependency, updated to v1.
The release updates go. to v1. to resolve GO-2026-4394.
securityhighThe golang. dependency, updated to v0.
The release updates golang. to v0. to resolve GO-2026-4559.
Check if affected (2)
securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.
A feature release that adds guest OS support, CLI capabilities, virtualization and synchronization features, template support, and a default hypervisor change for non-native architectures. The guest home directory moves from /home/${USER}. to /home/${USER}. with a compatibility symlink, and no security changes are disclosed.
Check if affected (1)
breakingQEMU as the default hypervisor for non-native architectures
Applies if QEMU runs on non-native architectures.
A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.
Action needed (1)
securityhighThe Go 1. build dependency and cited security fixes
The build uses Go 1., which includes security fixes for CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.
Check if affected (2)
securityhighThe rewrite and acl ordering, CVE-2026-26017
Applies if you use both rewrite and acl.
securityhighplugin/loop query name generation, CVE-2026-26018
Applies if plugin/loop runs.
