Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×

Daprv1.16.12Orchestration & ManagementMar 30, 2026

ACTION 1CHECK 2OTHER 4View full analysis

A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency and CVE-2026-33186 resolution
The affected google.golang.org/grpc dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.

Check if affected (2)

breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
breakingStructural validation for .jsonschema topics
Applies if you configure .jsonschema.

Source ↗

KubeVirtv1.8.0Orchestration & ManagementMar 24, 2026

CHECK 7PLAN 4OTHER 98View full analysis

A broad operator-facing feature and maintenance release with API and behavior changes, dependency updates, deprecations, and removals. Monitoring and configuration changes include recording-rule and feature-gate updates, alongside scheduling and security-related behavior changes; no security advisories are reported.

Check if affected (7)

breakingNetwork attachment definition get permissions in the virt-controller ClusterRole, removed
Applicability is not stated in the release notes.
breakingStop requests for paused VMIs, rejected
Applies if you run paused VMIs.
breakingThe EnableVirtioFsConfigVolumes feature, graduated to GA
Applies if you use the EnableVirtioFsConfigVolumes feature gate.
+ 4 more on the release page

Plan ahead (4)

deprecatedThe DisableMDEVConfiguration feature gate, deprecatedremoval date not announced
Applies if you use the DisableMDEVConfiguration feature gate.
deprecatedThe kubevirt_vmi_migration_data_total_bytes metric, deprecated
Applies if you use the kubevirt_vmi_migration_data_total_bytes metric.
deprecatedThe MultiArchitecture feature gate, deprecated
Applies if you use the MultiArchitecture feature gate.
+ 1 more on the release page

Source ↗

Daprv1.17.2Orchestration & ManagementMar 19, 2026

ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os.FileInfo root boundaries
os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.

Source ↗

KubeVirtv1.6.4Orchestration & ManagementMar 16, 2026

ACTION 1CHECK 2OTHER 16View full analysis

A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.

Action needed (1)

securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.

Check if affected (2)

breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.

Source ↗

Browse by month