RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
cert-managerv1.20.0SecurityMar 10, 2026
ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

  • securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729

    Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.

  • breakingIssuer reference kind and group defaults, reverted

    The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

  • securityPotential cert-manager controller panic from cached DNS responses

    Applicability is not stated in the release notes.

  • breakingThe OtherNames feature, enabled by default

    Applies if you use the OtherNames feature.

  • breakingDefault container user and group IDs

    Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).

  • + 1 more on the release page
Source ↗
Keycloak26.5.5SecurityMar 5, 2026
CHECK 4View full analysis

This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.

Check if affected (4)

  • securityhighCVE-2026-3047 SAML broker authentication bypass

    Applies if you use SAML broker and configure a disabled SAML client.

  • securityhighCVE-2026-3009 disabled identity provider enforcement

    Applies if you configure Disabled Identity Provider.

  • securityhighCVE-2026-2603 disabled SAML IdP broker login

    Applies if you configure Disabled SAML IdP.

  • + 1 more on the release page
Source ↗
SPIREv1.14.2SecurityMar 3, 2026
CHECK 2View full analysis

Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.

Check if affected (2)

  • securityThe http_challenge server node attestor plugin, SSRF issue fixed

    Applies if you use http_challenge.

  • securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed

    Applies if you use x509pop.

Source ↗
SPIREv1.13.4SecurityMar 3, 2026
CHECK 2View full analysis

A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.

Check if affected (2)

  • securityThe http_challenge server node attestor plugin, SSRF issue corrected

    Applies if you use the http_challenge server node attestor plugin.

  • securityThe x509pop server node attestor plugin, CPU consumption issue corrected

    Applies if you use the x509pop server node attestor plugin.

Source ↗
Open Policy Agent (OPA)v1.14.0SecurityFeb 26, 2026
ACTION 1CHECK 1OTHER 21View full analysis

This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.

Action needed (1)

  • securityhighThe go.opentelemetry.io dependencies, updated for GHSA-9h8m-3fm2-qjrq

    The go.opentelemetry.io dependencies include the fix for GHSA-9h8m-3fm2-qjrq.

Check if affected (1)

  • breakingThe --h2c flag with Unix domain socket support

    Applies if you use --h2c with unix domain socket (UDS).

Source ↗
OpenFGAv1.11.6SecurityFeb 23, 2026
ACTION 1CHECK 1OTHER 1View full analysis

This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.

Action needed (1)

  • securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121

    The grpc-health-probe dependency is updated to v0.4.45 to address CVE-2025-68121.

Check if affected (1)

  • breakingInternal HTTP-to-gRPC communication over UDS

    Applies if you use --read-only.

Source ↗
Keycloak26.5.4SecurityFeb 20, 2026
ACTION 2CHECK 4OTHER 10View full analysis

A maintenance release with five disclosed security fixes, one new capability, and ten corrected bugs. It contains no operator prerequisites or dependency-manifest entries.

Action needed (2)

  • securitymediumCVE-2026-0707, authorization header parsing

    This release corrects authorization header parsing that could bypass security controls.

  • securitylowCVE-2025-5416, keycloak-core environment information disclosure

    This release fixes environment information disclosure in keycloak-core.

Check if affected (4)

Source ↗
Kyvernov1.17.1SecurityFeb 19, 2026
ACTION 1CHECK 1OTHER 21View full analysis

This release includes a security fix for CVE-2025-68121, along with defect corrections and dependency updates. It also changes operator-facing defaults and configuration documentation, including a default that now uses a duration string.

Action needed (1)

  • securitycriticalCVE-2025-68121 security fix

    CVE-2025-68121 is fixed in this release.

Check if affected (1)

  • breakingDefault value and Helm values documentation format change

    Applicability is not stated in the release notes.

Source ↗
cert-managerv1.19.3SecurityFeb 2, 2026
CHECK 1OTHER 3View full analysis

A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.

Check if affected (1)

  • securitymediumcert-manager controller DNS response panic fix, GHSA-gx3x-vq4p-mhhv

    Applicability is not stated in the release notes.

Source ↗
Kyvernov1.17.0SecurityFeb 2, 2026
ACTION 2CHECK 2OTHER 142View full analysis

A substantial feature and maintenance release adds CEL and policy capabilities while correcting controller and API defects. It also includes security fixes, including a kubectl image update for CVEs, along with dependency and integration changes.

Action needed (2)

  • securitySecurity vulnerabilities addressed

    Security vulnerabilities are addressed in this release.

  • securityUpdated kubectl image for CVE fixes

    The kubectl image is updated to address CVEs in this release.

Check if affected (2)

  • breakingRestricted resource access in namespaced CEL policy types

    Applies if you use namespaced CEL policy types.

  • breakingOpt-in VAP/MAP reporting

    Applies if you use VAP/MAP reporting.

Source ↗
Falco0.43.0SecurityJan 28, 2026
CHECK 2PLAN 4OTHER 16View full analysis

A maintenance release that removes source-config-path output from release builds, deprecates several userspace interfaces, and rotates the package-signing key. It also includes correctness fixes, dependency updates, and an image-size reduction.

Check if affected (2)

  • breakingSource config path output in release builds

    Applies if you use debug builds.

  • breakingGPG signing key for DEB/RPM packages, rotated

    Applies if you use DEB/RPM packages.

Plan ahead (4)

  • deprecatedThe --gvisor-generate-config CLI option, deprecated

    Applies if you use --gvisor-generate-config.

  • deprecatedThe legacy eBPF probe, deprecated

    Applies if you use the legacy eBPF probe.

  • deprecatedThe gVisor engine, deprecated

    Applies if you use the gVisor engine.

  • + 1 more on the release page
Source ↗
Kyvernov1.15.3SecurityJan 27, 2026
ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with security-related fixes for the Go toolchain and cross-namespace access through apiCall. It also contains ordinary defect fixes and capability or behavior changes.

Action needed (1)

  • securityThe go version update for standard library CVEs

    The go version is updated to fix standard library CVEs in this release.

Check if affected (1)

  • securityCross-namespace access through apiCall prevented

    Applies if you use apiCall.

Source ↗
Confidential Containersv0.18.0SecurityJan 23, 2026
CHECK 2PLAN 2OTHER 17View full analysis

A release that removes or deprecates several operator-facing components while adding capabilities and changing supported formats and behavior. It also updates shipped platform components, including Trustee, image-rs, guest kernels, and OVMF.

Check if affected (2)

  • breakingProcess-based confidential computing via enclave-cc, removed

    Applies if you use enclave-cc.

  • breakingExperimental Secure Comms mode, removed from the Cloud API Adaptor

    Applies if you configure Secure Comms mode.

Plan ahead (2)

  • breakingThe CoCo operator, deprecated, with Helm chart installation

    Applies if you use the CoCo operator.

  • deprecatedpacker guest images, deprecated in favor of mkosiremoval date not announced

    Applies if you use packer images.

Source ↗
Keycloak26.5.1SecurityJan 14, 2026
CHECK 1OTHER 13View full analysis

Keycloak 26.5.1 is a maintenance release with a security fix in the Organization feature. It also contains correctness fixes, a performance improvement, and changes to HTTP responses and realm administration.

Check if affected (1)

  • securityThe Organization feature account-name exposure fix

    Applies if you use the Organization feature.

Source ↗
Keycloak26.5.0SecurityJan 6, 2026
CHECK 2PLAN 1OTHER 247View full analysis

A substantial feature and maintenance release adds operator capabilities including workflows, JWT authorization grants, organization invitations, OpenTelemetry export, and Windows services. It also updates Quarkus and fixes correctness issues, while changing supported database versions and addressing a vulnerability in brute force detection settings.

Check if affected (2)

  • securityBrute force detection settings vulnerability, corrected

    Applies if you configure brute force detection settings.

  • breakingPostgreSQL 13.x support removal

    Applies if you depend on PostgreSQL 13.x.

Plan ahead (1)

  • deprecatedFine-Grained Admin Permissions v1, deprecated

    Applies if you enable admin/fine-grained-permissions.

Source ↗
← Newer
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023