AI-analyzed release notes for CNCF graduated and incubating projects.
A feature and behavior release that adds Windows and device-management capabilities, changes edge database and node-querying behavior, and updates the Kubernetes dependency. Device status retrieval now uses the new DeviceStatus CRD.
Check if affected (1)
breakingThe DeviceStatus CRD for device status retrieval
Applies if you use the DeviceStatus CRD.
This release combines correctness fixes with changes to node-job behavior, operator capabilities, and command workflows. It introduces configuration updates for edge nodes, which are disabled by default and require an EdgeCore restart; no security advisories are identified.
Check if affected (6)
breakingThe v1alpha2 NodeUpgradeJob and ImagePrePullJob defaults
Applies if you use NodeUpgradeJob or ImagePrePullJob.
breakingNode-job switching constraint
Applies if you use NodeUpgradeJob or ImagePrePullJob.
breakingThe taskManager node-job module, disabled by default
Applies if EdgeCore is running.
Plan ahead (1)
deprecatedThe v1alpha1 NodeUpgradeJob and ImagePrePullJob jobs, deprecated
Applies if you use NodeUpgradeJob or ImagePrePullJob.
This release removes the iRMC driver and legacy vbmctl entrypoint, deprecates BMH., and changes defaults and constraints. It also adds HostClaim and vbmctl capabilities, corrects bugs, and updates dependencies.
Action needed (1)
breakingManager TLS default set to unset
The manager TLS default is set back to unset in this release.
Check if affected (3)
breakingThe iRMC driver, removed
Applies if you use the iRMC driver.
breakingPreprovisioningImage required for deprovisioning
Applies if cleaning is enabled.
breakingThe legacy vbmctl entrypoint, removed
Applies if you use the legacy vbmctl entrypoint.
Plan ahead (1)
deprecatedThe BMH. field, deprecated
Applies if you configure BMH..
A feature and maintenance release adds OTA image preheating, K8s-on-K8s deployment, declarative YurtHub conversion, and new hub and YurtHub capabilities. It also removes or deprecates legacy components and fixes multiple defects, with no security advisories identified.
Check if affected (4)
breakingThe YurtAppOverrider removal
Applies if you use YurtAppOverrider.
breakingThe yurt-coordinator removal from Helm charts
Applies if you use both yurt-coordinator and Helm charts.
breakingThe yurt-coordinator-cert controller removal from yurt-manager
Applies if you use both yurt-coordinator-cert controller and yurt-manager.
Plan ahead (2)
deprecatedThe yurtmanager delegate lease controller, deprecated
Applies if you use yurtmanager delegate lease controller.
deprecatedThe YurtAppDaemon controller and YurtAppDaemon webhook, deprecated
Applies if you use YurtAppDaemon controller or YurtAppDaemon webhook.
A security- and maintenance-focused release with updates to Linux and bundled components, along with dependency updates. It also corrects minimal-initrd regressions and changes service startup, SSH defaults, kernel-module availability, and other operator-visible behavior and layout.
Action needed (18)
securitycriticalLinux security updates
Linux was updated with security fixes associated with advisories including CVE-2024-56757, CVE-2025-71239, and CVE-2026-31788.
securityhighcurl security updates
curl was updated with fixes for CVE-2025-10148 and CVE-2025-9086.
securityhighexpat security update
expat was updated with a fix for CVE-2025-59375.
securityhighgnupg security updates
gnupg was updated with fixes for CVE-2025-68972 and CVE-2025-68973.
securityhighGo security updates
go was updated with security fixes associated with CVE-2025-47910, CVE-2025-47912, CVE-2025-58183, and related advisories.
securityhighintel-microcode security updates
intel-microcode was updated with fixes associated with CVE-2024-28956, CVE-2024-43420, CVE-2025-20012, and related advisories.
securityhighlibxslt security updates
libxslt was updated with fixes for CVE-2025-7424 and CVE-2025-7425.
securityhighnvidia-drivers security updates
nvidia-drivers was updated with fixes for CVE-2025-23280, CVE-2025-23282, CVE-2025-23300, and related advisories.
securityhighopenssl security updates
openssl was updated with fixes for CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232.
securityhighPAM security updates
pam was updated with fixes for CVE-2024-10041, CVE-2024-10963, CVE-2024-22365, and CVE-2025-6020.
securitymediumbinutils security updates
binutils was updated with fixes for CVE-2025-5244, CVE-2025-5245, and CVE-2025-8225.
securitymediumcoreutils security update
coreutils was updated with a fix for CVE-2025-5278.
securitymediumlibpcre2 security update
libpcre2 was updated with a fix for CVE-2025-58050.
securitymediumnet-tools security update
net-tools was updated with a fix for CVE-2025-46836.
securitylowopenssh security updates
openssh was updated with fixes for CVE-2025-61984 and CVE-2025-61985.
securitylibxml2 update
libxml2 was updated to libxml2-20250908.
breakingOpenSSH algorithm configuration defaults
Ciphers, MACs, and KexAlgorithms were dropped from the sshd configuration. OpenSSH upstream defaults are used instead.
breakingReduced first-stage initrd kernel modules
The set of kernel modules available in the first initrd is reduced.
Check if affected (1)
breakingAutomatic startup for overlaybd sysext services
Applies if you use the overlaybd sysext.
This release expands Windows and device-management support while changing edge database and node-query behavior. It also updates Kubernetes and changes how consumers retrieve device status through the DeviceStatus CRD.
Check if affected (1)
breakingDevice status moved to the DeviceStatus CRD
Applies if you use the Device CRD.
