Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Apr 2026Clear ×

OpenTelemetryv0.151.0ObservabilityApr 28, 2026

CHECK 2PLAN 1OTHER 23View full analysis

A release with API and configuration contract changes, new capabilities, deprecations, and bug fixes. It includes transport, telemetry, generated configuration, and data-handling updates, with no disclosed security advisories or security-specific fixes.

Check if affected (2)

breakingRelative replace paths in generated Collector source
Applies if you use the generated Collector source.
breakingNamed Config.Protocols field
Applies if you use Config.Protocols.

Plan ahead (1)

deprecatedDefaultMetricsBuilderConfig deprecation
Applies if you use DefaultMetricsBuilderConfig.

Source ↗

OpenCostv1.120.1ObservabilityApr 28, 2026

CHECK 1OTHER 4View full analysis

A maintenance release with a dependency update, correctness fixes, and new operator-facing capabilities. The MCP server now requires explicit opt-in when MCP_SERVER_ENABLED is not configured.

Check if affected (1)

breakingThe MCP_SERVER_ENABLED default, changed to false
Applies if MCP_SERVER_ENABLED is not configured.

Source ↗

Prometheusv3.11.3ObservabilityApr 27, 2026

CHECK 3View full analysis

A security maintenance release with corrections for credential exposure, request decoding validation, and stored cross-site scripting. Advisory identifiers are provided for the addressed defects, and the fixes ship in this release.

Check if affected (3)

securityhighAzureAD remote write OAuth client_secret exposure fix
Applies if you use AzureAD remote write.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
securitymediumOld UI heatmap chart le label escaping
Applies if you use the old UI heatmap chart.

Source ↗

Prometheusv3.5.3ObservabilityApr 27, 2026

CHECK 4View full analysis

A security-focused release with fixes for exposed OAuth secrets and stored XSS. Remote read and write request validation now rejects snappy-compressed payloads whose declared decoded length exceeds the decode limit.

Check if affected (4)

securityhighAzureAD remote write client_secret exposure fixed
Applies if you use AzureAD remote write.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
securitymediumOld UI heatmap chart le label escaping
Applies if you use UI.
+ 1 more on the release page

Source ↗

Cortexv1.21.0ObservabilityApr 27, 2026

ACTION 1CHECK 1PLAN 3OTHER 81View full analysis

A feature and maintenance release that adds Store Gateway, federation, overrides, caching, metric, and query capabilities while graduating several experimental features. It also changes defaults and configuration names, updates dependencies, and fixes correctness, memory, panic, and data-corruption defects.

Action needed (1)

breakingThe blocks storage bucket index default
Blocks storage now enables the bucket index by default through -blocks-storage.bucket-store.bucket-index.enabled. Disabling it with -blocks-storage.bucket-store.bucket-index.enabled=false is not recommended for production.

Check if affected (1)

breakingThe Distributor type and unit label flag
Applies if you configure either -distributor.enable-type-and-unit-labels or -distributor.otlp.enable-type-and-unit-labels for remote write v2 and OTLP requests.

Plan ahead (3)

breakingThe Ruler API flag rename
Applies if you configure -experimental.ruler.enable-api.
breakingThe Alertmanager API flag rename
Applies if you configure -experimental.alertmanager.enable-api.
breakingThe Users Scanner user index update configuration
Applies if you configure either -*.users-scanner.user-index.cleanup-interval or clean_up_interval.

Source ↗

Prometheusv3.11.2ObservabilityApr 13, 2026

CHECK 1OTHER 2View full analysis

Release v3.11.2 fixes stored XSS in the Prometheus web UI and changes Consul service-discovery filtering. The Consul updates add health_filter support and correct how filter parameters are applied to the Health API.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI, CVE-2026-40179
Applies if you use the Prometheus web UI.

Source ↗

Prometheusv3.5.2ObservabilityApr 13, 2026

CHECK 1OTHER 1View full analysis

Prometheus v3.5.2 fixes a stored XSS vulnerability in the Prometheus web UI. The release also includes a regex performance improvement.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI
Applies if crafted metric names or label values can reach the Prometheus web UI.

Source ↗

Prometheusv3.11.0ObservabilityApr 2, 2026

CHECK 1PLAN 2OTHER 42View full analysis

A broad release with new service discovery, PromQL, TSDB, and UI capabilities, alongside performance, dependency, output, and correctness changes. It also deprecates legacy Hetzner discovery labels and corrects TSDB retention-time handling.

Check if affected (1)

breakingThe storage.tsdb.retention.time unit handling
Applies if you configure storage.tsdb.retention.time.

Plan ahead (2)

deprecatedThe __meta_hetzner_datacenter label, deprecatedremoval date not announced
Applies if you use __meta_hetzner_datacenter.
deprecatedThe Hetzner Cloud datacenter location labels, deprecated
Applies if you use __meta_hetzner_hcloud_datacenter_location or __meta_hetzner_hcloud_datacenter_location_network_zone.

Source ↗

Browse by month