Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Daprv1.18.0Orchestration & ManagementJun 10, 2026

ACTION 8CHECK 6PLAN 1OTHER 108View full analysis

A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.

Action needed (8)

securitymediumThe golang.org/x/image dependency update for GO-2026-4962
golang.org/x/image is updated to v0.39.0 for GO-2026-4962.
securityThe durabletask-go and pgx dependency updates
durabletask-go is updated to v0.12.1, and pgx is updated as part of the vulnerability fixes.
breakingThe WorkflowsRemoteActivityReminder default, enabled
WorkflowsRemoteActivityReminder is enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.
breakingThe HotReload default, enabled
HotReload is enabled by default for Components, Subscriptions, MCPServers, Configurations, HTTPEndpoints, Resiliencies, and WorkflowAccessPolicies.
breakingSidecar probe defaults
Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.
breakingThe HotReload default, enabled in v1.18
HotReload is enabled by default in v1.18.
breakingLiveness and readiness probe defaults
The default liveness probe is widened, and the readiness probe default is tightened.
breakingChanged sidecar probe defaults
Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for daprd.

Check if affected (6)

securityService invocation path traversal ACL bypass fix
Applies if you use service invocation.
breakingThe MCPServerResource and WorkflowAccessPolicy feature gates, removed
Applies if you configure the MCPServerResource or WorkflowAccessPolicy feature gates.
breakingThe Sentry Ed25519 workload identity key rollback constraint
Applicability is not stated in the release notes.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe ScheduleJobAlpha1 alpha RPCs, deprecated
Applies if you use ScheduleJobAlpha1.

NATSv2.12.11Networking & MessagingJun 9, 2026

CHECK 3OTHER 18View full analysis

A feature and behavior release for JetStream and server operations, with new capabilities alongside changed defaults and downgrade constraints. Operators using strict JetStream requests, insecure TLS cipher suites, or new v2.12 features should review the changed behavior; the release also fixes a JetStream regression.

Check if affected (3)

breakingInsecure TLS cipher suite default
Applies if you enable allow_insecure_cipher_suites.
breakingJetStream strict mode default
Applies if you use JetStream.
breakingDowngrade compatibility for new v2.12 features
Applies if you use new v2.12 features.

CoreDNSv1.14.4Kubernetes CoreJun 9, 2026

CHECK 1OTHER 20View full analysis

A release with new plugin capabilities, stricter validation, DNS and cache behavior changes, expanded platform support, and malformed-input handling fixes. The HTTP/3 request header limit is narrowed for DoH3.

Check if affected (1)

breakingBound DoH3 HTTP/3 request header size
Applies if you use DoH3.

gRPCv1.81.1Networking & MessagingJun 8, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with fixes for correctness defects and a change to the default availability of the error_flatten experiment. It also includes an internal implementation change with no operator-facing impact.

Check if affected (1)

breakingThe error_flatten experiment, enabled in OSS
Applicability is not stated in the release notes.

Cortexv1.21.1ObservabilityJun 5, 2026

CHECK 3OTHER 7View full analysis

A maintenance release with operator-facing security fixes and configuration changes across ingestion, distribution, and status pages. It also includes fixes for request handling, authentication, configuration exposure, gossip limits, and client and runtime panics.

Check if affected (3)

securityStored XSS protection in Alertmanager and Store Gateway status pages
Applies if you run Alertmanager or Store Gateway.
securityWrappedHistogram native histogram size limit
Applies if you use native histograms.
breakingDecompressed gzip output limit for ParseProtoReader and OTLP ingestion
Applies if you use the OTLP ingestion path.

Istio1.30.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 1OTHER 15View full analysis

A maintenance release with an Envoy denial-of-service security fix, defect corrections, new operator-facing capabilities, a dependency update, and removal of a feature-gate guard. The security fix addresses disclosed advisory CVE-2026-47774.

Action needed (1)

securityhighCVE-2026-47774 Envoy denial-of-service fix
The fix addresses CVE-2026-47774 in Envoy, where specially crafted HTTP/2 requests could exhaust process memory because decoded header size was not fully limited during request validation.

Check if affected (1)

breakingPILOT_ENABLE_ALPHA_GATEWAY_API guard removed from ListenerSet
Applies if you use the ListenerSet API.

Envoyv1.38.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 4OTHER 2View full analysis

A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.

Action needed (1)

securityhighnghttp2 patch for CVE-2026-27135
The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Check if affected (4)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use oauth2.
breakingRouter transport-failure reason response body
Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.
+ 1 more on the release page

Keycloak26.6.3SecurityJun 4, 2026

ACTION 2CHECK 15OTHER 30View full analysis

A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.

Action needed (2)

securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.
securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization
CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Check if affected (15)

securitymediumCVE-2026-7500 account API access control
Applies if you use account/api.
securitymediumCVE-2026-8922 OIDC token introspection notBefore handling
Applies if you use oidc.
securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use authentication/webauthn.
+ 12 more on the release page

Rookv1.20.0Storage & DataJun 2, 2026

CHECK 2OTHER 8View full analysis

A breaking release for CSI configuration also changes unused CRUSH rule handling and supported Kubernetes versions. It adds storage and object-store capabilities, including SSE-S3 with Vault Agent authentication, object-store account management, and encrypted OSD disk expansion.

Check if affected (2)

breakingCeph CSI operator for driver settings
Applies if you configure CSI driver settings.
breakingROOK_DELETE_UNUSED_CRUSH_RULES default
Applies if the Ceph mgr is running.

Longhornv1.12.0Storage & DataJun 2, 2026

CHECK 5OTHER 111View full analysis

A broad maintenance and feature release combines bug fixes with new capabilities, configuration options, and platform support. It also changes defaults, tightens operational constraints, and removes V2 Backing Images.

Check if affected (5)

breakingV2 Backing Images removal
Applies if you use V2 Backing Images.
breakingThe data-engine-cpu-mask default, changed
Applies if you do not configure data-engine-cpu-mask.
breakingLive migration constraint for older CLI API versions
Applies if you use an engine image with a CLI API version older than 12.
+ 2 more on the release page

KEDAv2.20.0Orchestration & ManagementJun 1, 2026

CHECK 7PLAN 1OTHER 70View full analysis

This release adds scalers, configuration options, metrics, authentication modes, and compatibility improvements. Operators with custom RBAC need to account for the Kubernetes events API migration, and users of removed scaler settings need to update their configurations.

Check if affected (7)

securityCredential headers on cross-host redirects and HTTPS downgrades
Applicability is not stated in the release notes.
breakingScaledObject name length validation
Applies when a ScaledObject name exceeds 63 characters.
breakingPositive unprocessedEventThreshold values
Applies if you configure a non-positive unprocessedEventThreshold.
+ 4 more on the release page

Plan ahead (1)

deprecatedThe buildId, selectAllActive, and selectUnversioned settings, deprecated
Applies if you configure buildId, selectAllActive, or selectUnversioned.

Limav2.1.2Kubernetes CoreJun 1, 2026

CHECK 1PLAN 1OTHER 34View full analysis

A feature and maintenance release with CLI and template changes, QEMU behavior updates, and fixes across drivers, hostagent, shell, and guest support. It also includes a deprecation, while no security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingQEMU 2MB OVMF images dropped by openSUSE
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedThe _LIMA_QEMU_UEFI_IN_BIOS flag, deprecated
Applies if you configure _LIMA_QEMU_UEFI_IN_BIOS.

Volcanov1.15.0Orchestration & ManagementJun 1, 2026

ACTION 4CHECK 2OTHER 83View full analysis

A feature and operational-hardening release that adds alpha scheduling capabilities, new scheduler and Helm configuration, and fixes scheduler and integration stability issues. Operators should review Kubernetes and DRA compatibility requirements, the changed DRA default, and the disclosed denial-of-service and Prometheus security fixes.

Action needed (4)

securitymediumPrometheus dependency update for GHSA-vffh-x6r8-xx99
Updates github.com/prometheus/prometheus to address stored XSS advisory GHSA-vffh-x6r8-xx99.
securitymediumAdmission webhook request body limits
The admission webhook now limits request bodies, fixing the denial-of-service risk identified by CVE-2026-44247 and GHSA-8wxp-xxp2-rcgx.
breakingDRA scheduling integration default
DRA scheduling integration is enabled by default.
breakingDRA scheduling integration default behavior
DRA scheduling integration is enabled by default to align with Kubernetes 1.34 and later behavior. Set predicate.DynamicResourceAllocationEnable to false to disable it.

Check if affected (2)

breakingOpt-in SchedulingGatesQueueAdmission
Applies if you enable SchedulingGatesQueueAdmission.
breakingOpt-in gang-aware preemption and reclamation
Applies if you configure gangPreempt and gangReclaim and do not configure preempt or reclaim.

Karmadav1.18.0Orchestration & ManagementMay 30, 2026

ACTION 1CHECK 9OTHER 35View full analysis

A feature and maintenance release that adds overflow scheduling and scheduling overcommit protection, along with API, default, constraint, metric, and flag changes. It also includes a security-related alpine base-image update and numerous defect corrections.

Action needed (1)

securityThe alpine base image update
The alpine base image has changed from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (9)

breakingThe overflowAffinities field
Applies if you configure overflowAffinities.
breakingStricter clusterTolerations operator validation
Applies if you set spec.placement.clusterTolerations with Lt or Gt.
breakingThe operator's default verbosity level
Applies if you run the operator.
+ 6 more on the release page

OpenCostv1.120.3ObservabilityMay 29, 2026

ACTION 1CHECK 1OTHER 51View full analysis

A maintenance release with dependency updates, correctness fixes, and new cloud and query capabilities. Configuration and output behavior also change, along with a Go dependency upgrade for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Action needed (1)

securityhighGo dependency upgrades for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986
Go dependencies are upgraded for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Check if affected (1)

breakingThe MCP_SERVER_ENABLED default is false
Applies if you do not configure MCP_SERVER_ENABLED.

Kubescapev4.0.9SecurityMay 29, 2026

ACTION 3CHECK 3OTHER 105View full analysis

A broad maintenance release with correctness fixes, new CLI and reporting capabilities, anonymization updates, a performance improvement, added validation, and dependency refreshes. It also includes security fixes alongside changes to output and push defaults.

Action needed (3)

securityDependency updates for security advisories
Dependencies are updated to address security advisories.
securityEnvFrom clearing in container data removal
removeContainersData now clears EnvFrom to prevent secret name leakage.
securityEnv[].ValueFrom clearing in container data removal
removeContainersData and removeEphemeralContainersData now clear Env[].ValueFrom.

Check if affected (3)

security/v1/results access control hardening
Applies if you use /v1/results.
breakingThe pdf/html output default changed to file output
Applies if you use pdf/html output.
breakingThe push default changed to opt-in
Applies if you use push.

Cloud Custodian0.9.51.0SecurityMay 28, 2026

CHECK 1OTHER 90View full analysis

This is a broad operator-focused multi-cloud release with additions and extensions across AWS, Azure, and especially GCP. It also includes defect fixes and dependency updates, with no security advisories or explicit vulnerability disclosures noted.

Check if affected (1)

breakingThe json-diff filter for aws.iam-access-key, removed
Applies if your policies use the json-diff filter on aws.iam-access-key.

Prometheusv3.12.0ObservabilityMay 28, 2026

ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

breakingConcurrent fgprof profile rejection
The API rejects concurrent fgprof profiles.

Check if affected (3)

securityRemote Write decoded-length constraint
Applies if you use Remote Write.
securityPlaintext secret exposure in STACKIT SD
Applies if you use STACKIT SD.
breakingDecompressed body-size limit for OTLP write requests
Applies if you use OTLP.

Falco0.44.0SecurityMay 26, 2026

ACTION 1CHECK 5OTHER 34View full analysis

A release that removes several supported engines and outputs and restricts falco-webui access. It also adds rule and configuration capabilities, includes defect fixes and dependency updates, and discloses no security advisory.

Action needed (1)

breakinggRPC server support, removed
gRPC server support is removed in this release.

Check if affected (5)

securityPlugin library path traversal prevention
Applies if you configure the plugin library path.
breakingThe gRPC output, removed
Applies if you use the gRPC output.
breakingThe gVisor engine, removed
Applies if you use the gVisor engine.
+ 2 more on the release page

OpenTelemetryv0.153.0ObservabilityMay 25, 2026

CHECK 3OTHER 14View full analysis

This release updates configuration and metadata handling, with new schema and configuration capabilities and several API and feature-gate maturity changes. It also fixes Snappy memory corruption and fatal errors.

Check if affected (3)

breakingThe pdata.useCustomProtoEncoding feature gate, removed
Applies if you use pdata.useCustomProtoEncoding.
breakingDefault reaggregation_enabled behavior
Applies if you run cmd/mdatagen.
breakingStricter feature_gates validation
Applies if you configure feature_gates in metadata.yaml.

Crossplanev2.3.0Orchestration & ManagementMay 21, 2026

ACTION 14CHECK 3OTHER 20View full analysis

Crossplane v2.3.0 combines breaking API naming and path changes with new operator capabilities and correctness fixes. It also updates several Go dependencies and the Go toolchain, which matters to API consumers and builds that depend on the affected packages.

Action needed (14)

securityThe github.com/cloudflare/circl dependency, updated to v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3 in Crossplane v2.3.0.
securityThe google.golang.org/grpc dependency, updated to v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in Crossplane v2.3.0.
securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency, updated to v1.43.0
The go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module is updated to v1.43.0 in Crossplane v2.3.0.
securityThe github.com/go-git/go-git/v5 dependency, updated to v5.17.1
The github.com/go-git/go-git/v5 module is updated to v5.17.1 in Crossplane v2.3.0.
securityThe github.com/go-jose/go-jose/v4 dependency, updated to v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Crossplane v2.3.0.
securityThe github.com/sigstore/cosign/v3 dependency, updated to v3.0.5
The github.com/sigstore/cosign/v3 module is updated to v3.0.5 in Crossplane v2.3.0.
securityThe github.com/docker/cli dependency, updated to v29.2.0+incompatible
The github.com/docker/cli module is updated to v29.2.0+incompatible in Crossplane v2.3.0.
securityThe github.com/sigstore/timestamp-authority/v2 dependency, updated to v2.0.6
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.0.6 in Crossplane v2.3.0.
securityThe Go toolchain, updated to 1.25.9
The Go toolchain is updated to 1.25.9 in Crossplane v2.3.0.
securityThe github.com/moby/spdystream dependency, updated to v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1 in Crossplane v2.3.0.
securityThe github.com/go-git/go-git/v5 dependency, updated to v5.18.0
The github.com/go-git/go-git/v5 module is updated to v5.18.0 in Crossplane v2.3.0.
securityThe github.com/in-toto/in-toto-golang dependency, updated to v0.11.0
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in Crossplane v2.3.0.
securityThe golang.org/x/net dependency, updated to v0.53.0
The golang.org/x/net module is updated to v0.53.0 in Crossplane v2.3.0.
securityThe Go toolchain, updated to 1.25.10
The Go toolchain is updated to 1.25.10 in Crossplane v2.3.0 to fix standard library CVEs.

Check if affected (3)

breakingThe Crossplane API dependency path, renamed
Applies if you build external consumers of Crossplane APIs.
breakingThe common API package, moved
Applies if you use the common APIs from crossplane-runtime.
breakingThe v1.Resource* types, renamed
Applies if you use the old v1.Resource* types.

containerdv2.0.9Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1OTHER 7View full analysis

A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.

Action needed (1)

securityhighThe CVE-2026-46680 security fix
A security fix for CVE-2026-46680, also identified as GHSA-fqw6-gf59-qr4w, ships in this release.

Check if affected (1)

breakingThe default seccomp socket policy
Applies if you use seccomp.

containerdv2.3.1Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

securityhighCVE-2026-46680 correction
The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

breakingThe overlayfs "rebase" capability, disabled in user namespaces
Applies if you use overlayfs and run in a user namespace.

Plan ahead (1)

deprecatedTask fields in Runc options, deprecated
Applies if you configure task fields in Runc options.

Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026

ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

securityModule Federation packages at v2.3.3
Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
+ 6 more on the release page

Plan ahead (4)

deprecatedThe PolicyQueryUser.identity field, deprecated
Applies if you use PolicyQueryUser.identity.
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated
Applies if you configure catalog.stitchingStrategy.mode.
+ 1 more on the release page

OpenTelemetryv0.152.1ObservabilityMay 19, 2026

CHECK 2PLAN 1OTHER 7View full analysis

A maintenance release that adds exporter in-flight request monitoring and configuration-validation APIs while correcting runtime and configuration behavior. It also changes Prometheus telemetry defaults for explicitly configured metrics and deprecates older validation APIs.

Check if affected (2)

breakingThe max_request_body_size limit for snappy requests
Applies if you configure max_request_body_size.
breakingPrometheus exporter defaults for explicitly configured telemetry
Applies if you configure the telemetry metrics section.

Plan ahead (1)

deprecatedThe xconfmap.Validator and confmap.Validate APIs
Applies if you use xconfmap.Validator or confmap.Validate.

Keycloak26.6.2SecurityMay 19, 2026

ACTION 6CHECK 12OTHER 13View full analysis

A maintenance release with numerous disclosed security fixes, dependency updates, enhancements, and bug fixes. It also corrects forced object deletion during the operator upgrade path.

Action needed (6)

securityhighCVE-2026-33871: HTTP/2 CONTINUATION frame flood denial of service
The release fixes the HTTP/2 CONTINUATION frame flood denial-of-service issue identified by CVE-2026-33871.
securityhighCVE-2026-33870: HTTP request smuggling through chunked extension parsing
The release corrects the HTTP request smuggling primitive caused by chunked extension quoted-string parsing, identified by CVE-2026-33870.
securityhighBouncycastle updates for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598
The release updates bouncycastle for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598.
securityhighCVE-2026-7504: Redirect URI validation bypass
The release corrects the redirect URI validation bypass in Keycloak, identified by CVE-2026-7504.
securitymediumCVE-2026-5588: Bouncy Castle bcpkix cryptographic algorithm vulnerability
The release updates the bcpkix modules affected by the broken or risky cryptographic algorithm vulnerability in the Bouncy Castle Crypto Package for Java, identified by CVE-2026-5588.
securityPermission and policy call ordering in admin/api
The release corrects the ordering of permission and policy calls in admin/api that led to exposure of a client ID.

Check if affected (12)

securityhighCVE-2026-7307: Denial of service at the /saml endpoint
Applies if you use /saml.
securityhighCVE-2026-7571: Access token disclosure and implicit flow bypass
Applies if you use implicit flow.
securityhighCVE-2026-7507: Session fixation in the OIDC login flow
Applies if you use OIDC login flow.
+ 9 more on the release page

hamiv2.9.0AI & MLMay 19, 2026

ACTION 3CHECK 3OTHER 59View full analysis

A feature and maintenance release that adds HAMi-core, Ascend and vNPU virtualization, DRA, CDI, monitoring, metrics, deployment, and debugging capabilities. It also includes scheduling, allocation, device, chart, and compatibility fixes, security updates, dependency upgrades, and removal of a deprecated scheduler policy ConfigMap.

Action needed (3)

securityThe tensorflow/tensorflow dependency, upgraded
The tensorflow/tensorflow dependency was upgraded from 2.20.0rc0-gpu to 2.21.0rc0-gpu in this release.
securityThe tensorflow/tensorflow dependency, upgraded again
The tensorflow/tensorflow dependency was upgraded from 2.21.0rc0-gpu to 2.21.0rc1-gpu in this release.
securityThe golang dependency, upgraded
The golang dependency was upgraded for a security issue in this release.

Check if affected (3)

breakingThe deprecated scheduler policy configmap, removed
Applies if you configure scheduler policy configmap.
breakingThe Helm nvidia.overwriteEnv default
Applies if you use Helm.
breakingHost networking for the device plugin, disabled
Applies if the device plugin runs.

OpenCostv1.120.2ObservabilityMay 18, 2026

ACTION 1CHECK 2OTHER 40View full analysis

A maintenance release with dependency updates, operator-visible configuration and behavior changes, new integrations and capabilities, and correctness fixes. It also includes an explicitly disclosed security-related Go dependency upgrade.

Action needed (1)

securityhighGo dependency upgrades for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986
Go dependencies were upgraded to address GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Check if affected (2)

breakingThe provider config source, changed
Applies if you configure provider config.
breakingThe MCP_SERVER_ENABLED default, changed to false
Applies if you use the MCP server.

Istio1.30.0Networking & MessagingMay 18, 2026

ACTION 1CHECK 1OTHER 33View full analysis

A feature release adds Gateway API, ambient-mode, telemetry, Helm, and operability capabilities. Authenticated XDS debug endpoints and the new default image registry are the changes most likely to affect deployment and operational configuration.

Action needed (1)

breakingDefault Istio image registry
The default registry for Istio images is now registry.istio.io.

Check if affected (1)

breakingAuthentication required for XDS debug endpoints
Applies if ENABLE_DEBUG_ENDPOINT_AUTH is set.

Istio1.29.3Networking & MessagingMay 18, 2026

ACTION 1CHECK 2OTHER 6View full analysis

A maintenance release adds Gateway API compatibility, analyzer and HBONE tuning capabilities, and fixes certificate, controller, probe, output, and authorization issues. The authorization fixes address cross-namespace configuration access and regex handling in AuthorizationPolicy.

Action needed (1)

securityCross-namespace access to istio.io/debug/syncz and istio.io/debug/config_dump
Authorization is fixed so an authenticated workload cannot enumerate proxies or retrieve configuration dumps for workloads in other namespaces through istio.io/debug/syncz and istio.io/debug/config_dump.

Check if affected (2)

securityRegex handling in AuthorizationPolicy identity fields
Applicability is not stated in the release notes.
breakingThe AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE setting and kubelet health probes
Applies when ambient mesh pods run on AWS EKS and use Security Groups for Pods (branch ENI).

The Update Framework (TUF)v7.0.0SecurityMay 18, 2026

ACTION 1CHECK 1PLAN 1View full analysis

A release focused on a security fix and API evolution. It tightens the Updater() contract and begins preparation for removal of an existing module.

Action needed (1)

securitymediumGHSA-qp9x-wp8f-qgjj fixed
The release fixes GHSA-qp9x-wp8f-qgjj.

Check if affected (1)

breakingThe Updater() bootstrap argument, now required
Applies if you use Updater().

Plan ahead (1)

deprecatedPreparation for removal of securesystemslib.hash
Applies if you use securesystemslib.hash.

Daprv1.17.7Orchestration & ManagementMay 15, 2026

CHECK 1OTHER 19View full analysis

Dapr v1.17.7 is a corrective release focused on workflow, scheduler, actor, networking, and pub/sub reliability defects. It also adds workflow payload metrics, changes scheduler defaults, adds a scheduler flag, and updates github.com/dapr/kit.

Check if affected (1)

breakingThe actor drainOngoingCallTimeout constraint
Applies if an application supplies an actor drainOngoingCallTimeout that meets or exceeds the daprd-side placement dissemination timeout, which defaults to 30 seconds.

Ciliumv1.19.4Networking & MessagingMay 13, 2026

ACTION 2CHECK 1OTHER 46View full analysis

A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github.com/moby/spdystream dependency.

Action needed (2)

securityThe github.com/moby/spdystream module update
The github.com/moby/spdystream module is updated to v0.5.1.
breakingService-label filtering for EndpointSlice watches
The loadbalancer/reflectors component filters EndpointSlice watches by service labels.

Check if affected (1)

breakingLabel filtering for EndpointSlices
Applies if you set --k8s-service-proxy-name.

Ciliumv1.17.16Networking & MessagingMay 13, 2026

ACTION 1CHECK 1OTHER 23View full analysis

A maintenance release with an enforced policy behavior change, bug fixes, new metrics, and Helm image overrides. It also updates dependencies and container images and refreshes container image manifests.

Action needed (1)

securityThe github.com/moby/spdystream dependency update
The github.com/moby/spdystream module is updated to v0.5.1 in v1.17.16.

Check if affected (1)

breakingCiliumLocalRedirectPolicy addressMatcher override behavior
Applies if you use addressMatcher in CiliumLocalRedirectPolicy and do not enable --enable-lrp-address-matcher-override=true.

Kubescapev4.0.7SecurityMay 8, 2026

CHECK 3OTHER 29View full analysis

A maintenance release with operator-facing correctness fixes, new control and TLS configuration capabilities, narrower CRD scan-mode support, and interface simplifications. It also improves validation and error reporting, with no security advisories or vulnerability disclosures.

Check if affected (3)

breakingprotobuf content type removal
Applies if you use protobuf content type.
breakingSidecar requirement removal
Applies if you use a sidecar.
breakingThe --output flag, removed
Applies if you configure --output.

metal3-iov0.13.0Provisioning & RuntimeMay 8, 2026

ACTION 1CHECK 3PLAN 1OTHER 40View full analysis

This release removes the iRMC driver and legacy vbmctl entrypoint, deprecates BMH.Spec.Firmware, and changes defaults and constraints. It also adds HostClaim and vbmctl capabilities, corrects bugs, and updates dependencies.

Action needed (1)

breakingManager TLS default set to unset
The manager TLS default is set back to unset in this release.

Check if affected (3)

breakingThe iRMC driver, removed
Applies if you use the iRMC driver.
breakingPreprovisioningImage required for deprovisioning
Applies if cleaning is enabled.
breakingThe legacy vbmctl entrypoint, removed
Applies if you use the legacy vbmctl entrypoint.

Plan ahead (1)

deprecatedThe BMH.Spec.Firmware field, deprecated
Applies if you configure BMH.Spec.Firmware.

wasmCloudv2.1.0Orchestration & ManagementMay 7, 2026

CHECK 1OTHER 14View full analysis

A maintenance release with correctness fixes, dependency updates, and new deployment and plugin capabilities. It also removes the obsolete canary-v2 identifier.

Check if affected (1)

breakingThe canary-v2 canary identifier, removed
Applies if you configure canary-v2.

Vitessv24.0.1Storage & DataMay 7, 2026

CHECK 1OTHER 1View full analysis

A maintenance release with a correctness fix that reverts a VTOrc flag addition. It also updates planner handling for merged DML IN and NOT IN subqueries.

Check if affected (1)

breakingThe VTOrc cell-watch flag, reverted
Applies if VTOrc runs.

Vitessv23.0.4Storage & DataMay 7, 2026

ACTION 2CHECK 1OTHER 27View full analysis

A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.

Action needed (2)

breakingUnqualified * rejection after commas in SELECT lists
vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.
breakingBare * restriction in the sqlparser grammar
sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.

Check if affected (1)

breakingEmergencyReparentShard replication-stop error validation
Applies if you use EmergencyReparentShard.

Argov3.4.1CI/CD & App DeliveryMay 6, 2026

ACTION 4CHECK 2OTHER 275View full analysis

A broad maintenance and feature release with correctness, performance, dependency, and operator-facing changes. Operators should review the cluster-version annotation format and changed defaults, while dependency updates include Kubernetes and Helm changes; no explicitly disclosed exploitable vulnerability or security advisory is identified.

Action needed (4)

securityThe k8s.io/kubernetes module, updated to v1.34.2
The k8s.io/kubernetes module is updated to v1.34.2 as a security-related dependency update.
securityThe helm dependency, updated to 3.19.4
The helm dependency is updated to 3.19.4 due to a CVE.
breakinggRPC service config DNS TXT lookups, disabled by default
gRPC service config DNS TXT lookups are disabled by default.
breakingThe appset resource status count, defaulted to 5000
The default appset resource status count is changed to 5000.

Check if affected (2)

breakingThe --client flag in the Helm version command, removed
Applies if you use --client.
breakingThe cluster-version annotation format, renamed
Applies if you use Application Sets with Cluster Generators and configure argocd.argoproj.io/auto-label-cluster-info.

← NewerJun 10, 2026 – May 6, 2026Older →

Browse by month