AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with a Ceph security advisory, a disabled Rook manager module, and clearer CephX fallback errors. Users of Ceph are advised to upgrade, while CephX key fallback failures now report the actual error.
Check if affected (2)
securityCeph CVE-2025–30156 upgrade advisory
Applies if you depend on Ceph.
breakingThe rook mgr module, disabled
Applies if you enable the rook mgr module.
A release with breaking behavior for legacy V2 linked-clone volumes, a Kubernetes v1.25 minimum, and stronger default network controls, including expanded mTLS enforcement. It also adds V2 data engine capabilities and metrics while correcting defects across V2 operations, backups, expansion, and infrastructure.
Check if affected (6)
breakingInternal NetworkPolicy resources enabled by default
Applies if a NetworkPolicy provider is available in the cluster.
breakingCross-namespace Prometheus scraper access through the Longhorn Manager network policy
Applies if you use cross-namespace Prometheus scrapers.
breakingmTLS for all instance-manager gRPC services
Applies if you configure the longhorn-grpc-tls secret.
Plan ahead (1)
deprecatedLegacy V2 linked-clone volumes deprecated
Applies if you use V2 linked-clone volumes created in v1.12.0 or earlier.
A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.
Action needed (1)
securityThird-party dependency upgrades for TiKV 8.5
TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.
Check if affected (1)
breakingInvalid max_ts updates rejected by default
Applies if you do not set storage..
A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.
Action needed (1)
securityToken and blob-mount source validation
Blob-mount source projects are validated, and tokens without iat are rejected.
Check if affected (2)
breakingThe bundled PostgreSQL version, upgraded
Applies if you use PostgreSQL.
breakingThe cache backend, changed from redis to valkey
Applies if you use redis.
v2.5.0 adds operator-facing capabilities and changes download and proxy behavior. Deprecated API surface is removed and correctness issues are fixed; no security advisory is disclosed.
Action needed (1)
breakingHealth checks consolidated to /healthy
Health checks are consolidated to the /healthy endpoint in v2.5.0.
Check if affected (1)
breakingDeprecated V1 preheat API endpoints removed
Applies if you use the deprecated V1 preheat API endpoints.
A release with operator-facing configuration and behavior changes, including a new default and cleanup of stale resources. It also includes dependency and feature updates, with no security advisory disclosed.
Check if affected (2)
breakingStale MDS and RGW pdbs removed
Applies if you configure MDS and RGW pdbs.
breakingcsi-addons disabled by default
Applies if you enable csi-addons.
This release updates the default Ceph version and changes operational handling for Helm ownership, stale PDB cleanup, OSD device classes, and post-upgrade releases. It contains no disclosed security advisories.
Check if affected (2)
breakingDefault Ceph version 19.2.4
Applies if you use Ceph.
breakingStale MDS and RGW PDB cleanup
Applicability is not stated in the release notes.
A breaking release for CSI configuration also changes unused CRUSH rule handling and supported Kubernetes versions. It adds storage and object-store capabilities, including SSE-S3 with Vault Agent authentication, object-store account management, and encrypted OSD disk expansion.
Check if affected (2)
breakingCeph CSI operator for driver settings
Applies if you configure CSI driver settings.
breakingROOK_DELETE_UNUSED_CRUSH_RULES default
Applies if the Ceph mgr is running.
A broad maintenance and feature release combines bug fixes with new capabilities, configuration options, and platform support. It also changes defaults, tightens operational constraints, and removes V2 Backing Images.
Check if affected (5)
breakingV2 Backing Images removal
Applies if you use V2 Backing Images.
breakingThe data-engine-cpu-mask default, changed
Applies if you do not configure data-engine-cpu-mask.
breakingLive migration constraint for older CLI API versions
Applies if you use an engine image with a CLI API version older than 12.
A maintenance release with a correctness fix that reverts a VTOrc flag addition. It also updates planner handling for merged DML IN and NOT IN subqueries.
Check if affected (1)
breakingThe VTOrc cell-watch flag, reverted
Applies if VTOrc runs.
A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.
Action needed (2)
breakingUnqualified * rejection after commas in SELECT lists
vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.
breakingBare * restriction in the sqlparser grammar
sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.
Check if affected (1)
breakingEmergencyReparentShard replication-stop error validation
Applies if you use EmergencyReparentShard.
A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.
Action needed (3)
securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.
Check if affected (12)
securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
Plan ahead (4)
deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
A maintenance release with an RBAC grant removal, behavioral fixes, and new CephNFS API fields. It also updates exporter and OSD handling, including log collection, reconciliation, cancellation, encrypted OSD key rotation, and container selection.
Check if affected (1)
breakingThe nodes/proxy RBAC grant, removed
Applies if you use nodes/proxy.
A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.
Action needed (2)
securityBearer token validation
Harbor rejects bearer tokens issued before project creation.
breakingPort 9443 removed from the webhook event check
Port 9443 is removed from the Harbor IP used for webhook event checks.
Check if affected (2)
breakingThe pull-through cache is replaced by proxy cache
Applies if you use pull-through cache in Harbor.
breakingGCR replication removal
Applies if you use GCR replication in Harbor.
A feature and maintenance release that expands configuration and scheduler capabilities while changing configuration controls and the priorities type. Dependency versions are updated, and no security advisories or explicitly described vulnerabilities are mentioned.
Action needed (1)
breakingThe priorities type, changed to int32
The priorities type changed from string to int32 in v2.4.2.
Check if affected (1)
breakingThe Enable flag, removed from seedPeer
Applies if you configure Enable.
This release includes operator-facing behavior and API updates, along with default, image, and dependency changes. It also contains an internal build-tooling update and fixes for storage and gateway handling.
Check if affected (1)
breakingDefault gateway topology spread constraints for nvmeof
Applies if you use nvmeof.
A maintenance release with operator-facing removals, default and behavior changes, new CRD fields, expanded configuration support, and dependency updates. No security advisory is disclosed.
Action needed (1)
breakingNodes/proxy RBAC enablement removal
The unnecessary nodes/proxy RBAC enablement is removed.
Check if affected (2)
breakingDefault Ceph image pull policy
Applies if you do not configure ceph image pull policy.
breakingAutomated node fencing code removal
Applies if automated node fencing runs.
A substantial feature and maintenance release with V2 Data Engine changes, new capabilities, dependency updates, numerous fixes, and hotfix image replacements. It also deprecates V2 Backing Image functionality and includes a fix for an SPDK v25.05 CVE issue without a disclosed advisory identifier.
Action needed (1)
securityThe SPDK v25. CVE issue fix
The CVE issue in SPDK v25. is fixed in this release.
Check if affected (7)
breakingThe longhornio/longhorn-instance-manager:v1. image replacement
Applies if you use longhornio/longhorn-instance-manager:v1..
breakingThe longhornio/longhorn-manager:v1. image replacement
Applies if you use longhornio/longhorn-manager:v1..
breakingBackupstore-related settings removal
Applies if you configure backupstore related settings.
Plan ahead (2)
deprecatedBacking Image for the V2 Data Engine deprecationremoval planned in v1.12.0
Applies if you use Backing Image and the V2 Data Engine.
deprecatedV2 Backing Image Feature deprecation
Applies if you use the V2 Backing Image Feature.
A maintenance release includes a hotfixed operator image, a security-relevant DNS query correction, and fixes across volume, replica, CSI, and management paths. It also adds namespace inheritance for longhorn-share-manager in FastFailover mode.
Check if affected (2)
securityThe instance-manager DNS query behavior
Applies if you do not use a hard or solid state disk.
breakingThe backing-image-manager:v1. image, replaced with backing-image-manager:v1.
Applies if you use backing-image-manager:v1..
A maintenance release that removes deprecated preheat API endpoints and fixes unauthenticated access to the Dragonfly manager job API. Both changes affect users of the corresponding APIs.
Check if affected (2)
securityDragonfly manager job API unauthenticated access fix
Applies if you use Dragonfly manager job API.
breakingDeprecated preheat API endpoints removed
Applies if you use deprecated preheat API endpoints.
A breaking release changes supported Kubernetes versions and configuration behavior and removes automatic CSI client creation in external mode. It also adds storage features, reconciliation improvements, and operational changes including experimental NVMe-oF support, block volume statistics, encryption settings, and improved fencing and logging.
Check if affected (4)
breakingSupported Kubernetes versions
Applies if you run Kubernetes v1. through v1..
breakingactiveStandby behavior in the CephFilesystem CRD
Applies if activeStandby is set to false.
breakingCeph image settings in the rook-ceph-cluster chart
Applies if you use the rook-ceph-cluster chart.
