Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Feb 2026Clear ×

Karmadav1.17.0Orchestration & ManagementFeb 28, 2026

CHECK 4PLAN 3OTHER 34View full analysis

A feature and maintenance release adds workload affinity and anti-affinity scheduling, operator and API capabilities, and Helm encryption at rest. It also includes controller and scheduler fixes, dependency and image updates, and deprecations and removals.

Check if affected (4)

breakingnamespace validation for spec.resourceSelectors
Applies if you use PropagationPolicy or OverridePolicy.
breakingStricter GroupByLabelKey validation in WorkloadAffinity
Applies if you configure GroupByLabelKey in WorkloadAffinity.
breakingUpdated default Kubernetes and ETCD images
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (3)

deprecatedThe --cluster-lease-duration flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-duration.
deprecatedThe --cluster-lease-renew-interval-fraction flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-renew-interval-fraction.
deprecatedEtcd.Local.InitImage in Karmada Init Configuration, deprecatedremoval date not announced
Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.

Source ↗

Daprv1.17.0Orchestration & ManagementFeb 27, 2026

ACTION 9CHECK 3PLAN 2OTHER 151View full analysis

A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.

Action needed (9)

securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto dependency is bumped.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github.com/coreos/go-oidc/v3 dependency, updated
The github.com/coreos/go-oidc/v3 dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.

Check if affected (3)

securityPlacement authorization for Dapr actor types
Applies if you use Placement.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.

Plan ahead (2)

deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.

Source ↗

Crossplanev2.2.0Orchestration & ManagementFeb 17, 2026

ACTION 7CHECK 2OTHER 41View full analysis

A release with breaking changes to package installation and package-cache side-loading, alongside new operator capabilities and ordinary defect corrections. It also includes security-tagged dependency updates, but no advisory identifiers or vulnerability details are provided.

Action needed (7)

securitySecurity update for golang.org/x/crypto
The golang.org/x/crypto module was updated to v0.45.0 as a security update.
securitySecurity update for github.com/go-chi/chi/v5
The github.com/go-chi/chi/v5 module was updated to v5.2.4 as a security update.
securitySecurity update for github.com/sigstore/cosign/v3
The github.com/sigstore/cosign/v3 module was updated to v3.0.4 as a security update.
securitySecurity update for github.com/theupdateframework/go-tuf/v2
The github.com/theupdateframework/go-tuf/v2 module was updated to v2.4.1 as a security update.
securitySecurity update for github.com/sigstore/rekor
The github.com/sigstore/rekor module was updated to v1.5.0 as a security update.
securitySecurity update for github.com/sigstore/sigstore
The github.com/sigstore/sigstore module was updated to v1.10.4 as a security update.
securitySecurity update for github.com/quic-go/quic-go
The github.com/quic-go/quic-go module was updated to v0.57.0 as a security update.

Check if affected (2)

breakingInput CRD installation from Function packages
Applies if you use Function packages and Input CRDs.
breakingPackage cache structure
Applicability is not stated in the release notes.

Source ↗

KEDAv2.19.0Orchestration & ManagementFeb 2, 2026

CHECK 1OTHER 18View full analysis

A feature and maintenance release that adds scaler and authentication capabilities, updates scaler behavior and status reporting, and corrects several defects. It also replaces a deprecated dependency and removes the NATS Streaming scaler.

Check if affected (1)

breakingThe NATS Streaming scaler, removed
Applies if you use the NATS Streaming scaler.

Source ↗

Browse by month