AI-analyzed release notes for CNCF graduated and incubating projects.
This release adds and changes API and runtime capabilities, removes a sandbox metadata field, and updates a dependency. No security advisories or vulnerabilities are disclosed.
Check if affected (1)
breakingThe Container sandbox metadata field, removed
Applies if you use Container in API specs.
A broad operator-significant release with API, configuration, CLI default, scheduling, runtime, feature-gate, metric, and dependency changes. Upgrade review and testing matter for users of removed or deprecated interfaces, changed defaults, custom scheduler integrations, CRDs, audit logging, and affected metrics.
Action needed (11)
breakingStrictIPCIDRValidation enabled by default
The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.
breakingThe default debug profile, changed to general
The default debug profile changes from legacy to general.
breakingWatchCacheInitializationPostStartHook enabled by default
The WatchCacheInitializationPostStartHook feature gate is enabled by default.
breakingKubeletPSI graduation to GA
The KubeletPSI feature graduated to GA and is enabled by default.
breakingRelaxedServiceNameValidation at beta, enabled by default
The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.
breakingRestartAllContainersOnContainerExits at beta, enabled by default
The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.
breakingSuspended-job feature gates enabled by default
The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.
breakingAtomicFIFO informer store updates
Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.
breakingUnlockWhileProcessing informer behavior
Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.
breakingClientsAllowCARotation functionality enabled by default
This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.
breakingClientsAllowTLSCacheGC functionality enabled by default
This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.
Check if affected (25)
breakingThe volume_operation_total_errors metric, renamed
Applies if you use volume_operation_total_errors.
breakingThe git-repo volume plugin, disabled
Applies if you use the git-repo volume plugin.
breakingAllowlistEntry., renamed to AllowlistEntry.
Applies if you configure AllowlistEntry..
Plan ahead (6)
deprecatedService . deprecation
Applies if you configure Service ..
deprecatedDirect access to metav1., deprecated
Applies if you use metav1..
deprecatedMinNodeScore and MaxNodeScore, deprecated
Applies if you use MinNodeScore or MaxNodeScore.
A maintenance release that adds operator-facing options and transport, plugin, and protocol support while correcting defects. It is built with Go 1., which contains fixes for disclosed CVEs; other changes concern operators using the affected features or behaviors.
Action needed (1)
securitycriticalGo 1. build with security fixes
The release is built with Go 1., which includes security fixes for CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.
Check if affected (1)
breakingOversized DoH GET query parameter rejection
Applies if you use DoH.
A maintenance release with the Go 1.25.9 toolchain and several correctness fixes. It changes the default for StatefulSet parallel pod management and includes fixes for kubelet restarts, apiserver audit-log latency annotations, and kube-proxy nftables support.
Check if affected (1)
breakingDefault for MaxUnavailableStatefulSet
Applies if you do not enable MaxUnavailableStatefulSet.
containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.
Action needed (1)
securityhighThe spdystream update for CVE-2026-35469
The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.
Check if affected (1)
securityCredential sanitization before gRPC returns
Applies if you use pod events through the Container Runtime Interface (CRI).
A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.
Action needed (2)
securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2
The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.
securityhighgithub. v0.5.1 update
The release updates github. to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Check if affected (1)
securityCredential sanitization before gRPC returns
Applies if pod events are used.
containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.
Action needed (1)
securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Check if affected (1)
securitySanitized gRPC errors in pod events
Applies if you use pod events.
A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.
Check if affected (1)
securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.
A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.
Action needed (1)
securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.
Check if affected (2)
securityhighPlugin verification when . is missing
Applies if you use plugins.
securityhighPlugin metadata version path traversal
Applies if you use plugins.
A release with Windows artifacts, broader guest and template configuration support, and changed vz audio handling. It also updates the bundled nerdctl distribution and dependencies, including security updates in BuildKit and CNI plugins that are obtained by upgrading.
Check if affected (1)
securityBuildKit and CNI plugins security updates
Applies if you use BuildKit or CNI plugins.
