Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

NATSv2.11.15Networking & MessagingMar 24, 2026

ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

breakingThe JWT size limit
JWTs now have a 1MB size limit.

Check if affected (11)

securityhighCVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 fixes for MQTT systems
Applies if you use MQTT.
securityhighCVE-2026-33218 fix for leafnodes
Applies if you use leafnodes.
securityhighCVE-2026-33247 fix for command-line credentials
Applies if you configure credentials on the command line.
+ 8 more on the release page

Contourv1.33.3Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with security-related dependency updates and removal of the hostPort setting from example manifests. It also documents compatibility testing with Kubernetes 1.32 through 1.34.

Action needed (2)

securitycriticalgoogle.golang.org/grpc v1.79.3 update
google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected by this advisory.
securityEnvoy v1.35.9 update
The Envoy dependency is updated to v1.35.9 to address security vulnerabilities.

Check if affected (1)

breakingRemoval of hostPort: 8002 from example manifests
Applies if you use hostPort in example manifests.

Contourv1.32.4Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with updated Envoy and gRPC dependencies, plus a change to the example manifests. It is tested against Kubernetes 1.31 through 1.33.

Action needed (2)

securitycriticalgoogle.golang.org/grpc updated to v1.79.3
google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.
securityEnvoy updated to v1.34.13
Envoy is updated to v1.34.13 to address security vulnerabilities and improve stability.

Check if affected (1)

breakinghostPort: 8002 removed from example manifests
Applies if hostPort: 8002 is configured in example manifests.

Contourv1.31.5Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release contains dependency security updates and an example-manifest cleanup. It also documents testing against Kubernetes 1.30 through 1.32.

Action needed (2)

securitycriticalgoogle.golang.org/grpc updated to v1.79.3 for CVE-2026-33186
The release updates google.golang.org/grpc to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.
securityEnvoy updated to v1.34.13
The release bumps Envoy to v1.34.13.

Check if affected (1)

breakingEnvoy metrics hostPort: 8002 removed from example manifests
Applies if example manifests use hostPort: 8002.

k8gbv0.19.0Kubernetes CoreMar 22, 2026

CHECK 2OTHER 16View full analysis

A feature and maintenance release that introduces a vendor-neutral API with a user-controlled migration workflow, alongside preview Dynamic Zones support. It also changes Helm and runtime image distribution locations and updates dependencies.

Check if affected (2)

breakingThe helm repository, switched to OCI
Applies if you use Helm.
breakingThe API group, renamed to k8gb.io/v1beta1
Applies if you use k8gb.absa.oss/v1beta1.

Kubeflow26.03AI & MLMar 22, 2026

ACTION 1CHECK 1OTHER 18View full analysis

This release updates supported Kubernetes and pod-security configurations, installation behavior, and bundled component versions. The main operator-facing changes are the Kubernetes 1.34+ requirement and the baseline pod-security enforcement default, alongside fixes and new capabilities.

Action needed (1)

breakingBaseline pod security enforcement
Pod security enforcement changes to the baseline level in this release.

Check if affected (1)

breakingKubernetes 1.34+ requirement
Applies if you use Kubernetes 1.34+.

Backstagev1.49.1CI/CD & App DeliveryMar 20, 2026

CHECK 1OTHER 6View full analysis

This release contains API and template changes, new DevTools functionality, frontend behavior changes, and defect corrections. No security advisories or security-specific fixes are stated.

Check if affected (1)

breakingThe catalog entity page layout header is disabled
Applies if you use the catalog entity page in the new frontend system.

Harborv2.15.0Storage & DataMar 20, 2026

ACTION 2CHECK 2OTHER 72View full analysis

A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.

Action needed (2)

securityBearer token validation
Harbor rejects bearer tokens issued before project creation.
breakingPort 9443 removed from the webhook event check
Port 9443 is removed from the Harbor IP used for webhook event checks.

Check if affected (2)

breakingThe pull-through cache is replaced by proxy cache
Applies if you use pull-through cache in Harbor.
breakingGCR replication removal
Applies if you use GCR replication in Harbor.

Daprv1.17.2Orchestration & ManagementMar 19, 2026

ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os.FileInfo root boundaries
os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.

Backstagev1.49.0CI/CD & App DeliveryMar 17, 2026

CHECK 14PLAN 7OTHER 38View full analysis

A breaking compatibility release changes defaults and removes or narrows support across the frontend, CLI, catalog, and integrations. It also introduces new frontend, catalog, scaffolder, CLI, and integration capabilities, while deprecated functionality remains in some areas and requires planning. The release contains no security fixes.

Check if affected (14)

breakingThe New Frontend System as the default for new apps
Applicability is not stated in the release notes.
breakingThe create-app frontend selection flag
Applies if you use the --next flag for create-app.
breakingDeprecated types and options
Applies if you use deprecated types and options.
+ 11 more on the release page

Plan ahead (7)

deprecatedDeprecated variant, columns, and tableOptions props
Applies if you use the variant, columns, or tableOptions props.
deprecatedThe RelatedEntitiesCard component
Applies if you use RelatedEntitiesCard.
deprecatedThe CLI built-in set fallback
Applicability is not stated in the release notes.
+ 4 more on the release page

Limav2.1.0Kubernetes CoreMar 17, 2026

CHECK 1OTHER 13View full analysis

A feature release that adds guest OS support, CLI capabilities, virtualization and synchronization features, template support, and a default hypervisor change for non-native architectures. The guest home directory moves from /home/${USER}.linux to /home/${USER}.guest with a compatibility symlink, and no security changes are disclosed.

Check if affected (1)

breakingQEMU as the default hypervisor for non-native architectures
Applies if QEMU runs on non-native architectures.

KubeVirtv1.6.4Orchestration & ManagementMar 16, 2026

ACTION 1CHECK 2OTHER 16View full analysis

A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.

Action needed (1)

securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.

Check if affected (2)

breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.

KServev0.17.0AI & MLMar 13, 2026

ACTION 13CHECK 6OTHER 91View full analysis

An operator release with expanded configuration and LLMInferenceService capabilities, plus chart and dependency updates, behavior changes, removals, and defect corrections. It also includes security fixes for operators to review.

Action needed (13)

securitycriticalh11 malformed-body fix for CVE-2025-43859
h11 malformed-body handling associated with CVE-2025-43859 is addressed in this release.
securityhighstarlette version 0.49.1
starlette is pinned to version 0.49.1 to fix CVE-2025-62727 in this release.
securityhighlightgbm version 4.6.0
lightgbm is updated to version 4.6.0 for CVE-2024-43598 in this release.
securityhighCVE-2025-66418 decompression-chain fix
The unbounded number of links in the decompression chain associated with CVE-2025-66418 is addressed in this release.
securityhighexpr-lang/expr version v1.17.7
expr-lang/expr is updated to v1.17.7 to fix CVE-2025-68156 in this release.
securityhighcryptography fix for CVE-2026-26007
The cryptography issue associated with CVE-2026-26007 is addressed in this release.
securityhighpython-multipart fix for CVE-2026-24486
The arbitrary file write issue in python-multipart associated with CVE-2026-24486 is addressed in this release.
securitymediumFixes for CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181
This release addresses CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181.
securityhttps.go path traversal prevention
The path traversal issue in https.go is prevented in this release.
securitySeveral CVE fixes
This release addresses several CVEs.
securityAIOHTTP HTTP Parser auto_decompress fix
The AIOHTTP HTTP Parser auto_decompress feature issue involving zip bombs is addressed in this release.
securityextractTarFiles path traversal fix
The path traversal vulnerability in extractTarFiles is addressed in this release.
breakingminio replacement with seaweedfs
minio is replaced with seaweedfs in this release.

Check if affected (6)

breakinginferenceservice CRD cert-manager annotation removal
Applies if you use the inferenceservice CRD.
breakingPython 3.9 support removal
Applies if you run Python 3.9.
breakingDeprecated --disable-log-requests flag removal
Applies if you configure --disable-log-requests.
+ 3 more on the release page

OpenFGAv1.12.0SecurityMar 13, 2026

ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

securityhighGo toolchain version 1.25.8
The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.

Strimzi0.45.2Networking & MessagingMar 12, 2026

ACTION 8CHECK 1PLAN 3OTHER 5View full analysis

A maintenance release that narrows Kubernetes support to version 1.25 and newer and marks several older Kafka and extension components for removal. It adds Kafka 3.9.2 support and includes dependency updates addressing multiple CVEs and a GHSA advisory.

Action needed (8)

securityhighGRPC Netty Shaded update for CVE-2025-55163
GRPC Netty Shaded was upgraded to remediate CVE-2025-55163.
securitymediumZookeeper update for CVE-2024-47554
The Zookeeper dependency was upgraded to remediate CVE-2024-47554.
securitymediumNimbus Jose JWT 10.0.2 update for CVE-2025-53864
Nimbus Jose JWT was upgraded to version 10.0.2 to remediate CVE-2025-53864.
securitymediumNetty 4.1.130.Final update for CVE-2025-67735
Netty was updated to version 4.1.130.Final to resolve CVE-2025-67735.
securitymediumApache Log4J 2.25.3 update for CVE-2025-68161
Apache Log4J was updated to version 2.25.3 to remediate CVE-2025-68161.
securitymediumVertx 4.5.24 update for CVE-2026-1002
Vertx was updated to version 4.5.24 to remediate CVE-2026-1002.
securitymediumJackson update for GHSA-72hv-8253-57qq
Jackson was updated to address GHSA-72hv-8253-57qq.
securityVert.x and Netty dependency updates
The Vert.x and Netty dependencies were bumped on the 0.45.x branch to fix CVEs.

Check if affected (1)

breakingKubernetes support narrowed to 1.25 and newer
Applies if you use Kubernetes 1.23 or Kubernetes 1.24.

Plan ahead (3)

breakingStrimzi MirrorMaker 2 Extensions deprecationdeprecated since 0.28.0 · removal planned in 0.46
Applies if you use the Strimzi MirrorMaker 2 Extensions.
breakingStrimzi EnvVar Configuration Provider inclusiondeprecated since 0.38.0 · removal planned in 0.46
Applies if you use the Strimzi EnvVar Configuration Provider.
deprecatedZooKeeper-based Kafka and MirrorMaker 1 supportremoval planned in 0.46
Applies if you use ZooKeeper-based Apache Kafka clusters or MirrorMaker 1 deployments.

Linkerdedge-26.3.2Networking & MessagingMar 12, 2026

CHECK 1OTHER 25View full analysis

This release narrows Linkerd Viz scraping behavior and adds the inbound_http_request_duration_seconds and inbound_grpc_request_duration_seconds metrics histograms. It also updates dependencies and ships proxy v2.342.0.

Check if affected (1)

breakingLinkerd Viz default scraping configuration
Applies if you use Linkerd Viz.

KubeEdgev1.23.0Provisioning & RuntimeMar 11, 2026

CHECK 1OTHER 8View full analysis

This release expands Windows and device-management support while changing edge database and node-query behavior. It also updates Kubernetes and changes how consumers retrieve device status through the DeviceStatus CRD.

Check if affected (1)

breakingDevice status moved to the DeviceStatus CRD
Applies if you use the Device CRD.

cert-managerv1.20.0SecurityMar 10, 2026

ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
+ 1 more on the release page

Argov3.3.3CI/CD & App DeliveryMar 9, 2026

CHECK 1OTHER 5View full analysis

A maintenance release with a compatibility update for cluster version labels and several ordinary defect corrections. The compatibility update concerns Application Sets that fetch clusters based on Kubernetes version.

Check if affected (1)

breakingThe argocd.argoproj.io/kubernetes-version format, changed
Applies if argocd.argoproj.io/auto-label-cluster-info and argocd.argoproj.io/kubernetes-version are configured.

NATSv2.12.5Networking & MessagingMar 9, 2026

CHECK 3OTHER 65View full analysis

A maintenance release with fixes for two CVEs, many correctness issues, expanded JetStream configuration capabilities, and dependency updates. Operators of clustered deployments should review the documented regression affecting stream updates and the changed max_conns behavior.

Check if affected (3)

securityCVE-2026-29785 fix for leafnode compression
Applies if leafnode compression is enabled.
securityCVE-2026-27889 fix for WebSockets
Applies if WebSockets are enabled.
breakingThe max_conns server configuration value
Applies if you configure max_conns in the server configuration.

Dragonflyv2.4.2Storage & DataMar 9, 2026

ACTION 1CHECK 1OTHER 19View full analysis

A feature and maintenance release that expands configuration and scheduler capabilities while changing configuration controls and the priorities type. Dependency versions are updated, and no security advisories or explicitly described vulnerabilities are mentioned.

Action needed (1)

breakingThe priorities type, changed to int32
The priorities type changed from string to int32 in v2.4.2.

Check if affected (1)

breakingThe Enable flag, removed from seedPeer
Applies if you configure Enable.

Jaegerv2.16.0ObservabilityMar 7, 2026

ACTION 1CHECK 2OTHER 5View full analysis

A release with breaking configuration and API changes, a Go 1.25.7 requirement, new capabilities, and bug and performance fixes. No security advisories or security-specific fixes are identified.

Action needed (1)

breakingGo 1.25.7 requirement
The codebase now requires Go 1.25.7, with Go version consistency enforced across the codebase.

Check if affected (2)

breakingLegacy response format of the remote sampling endpoint, removed
Applies if you use the remote sampling endpoint.
breakingtraces.topic renamed to traces.topics
Applies if you configure traces.topic.

Strimzi0.51.0Networking & MessagingMar 6, 2026

ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.
breakingThe ServerSideApplyPhase1 feature gate default
The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

breakingKubernetes version support
Applies if you use Kubernetes 1.27, 1.28, or 1.29.
breakingKafka 4.0.0 and 4.0.1 support
Applies if you use Kafka 4.0.0 or 4.0.1.

Plan ahead (1)

deprecatedThe ingress listener type deprecation
Applies if you configure the ingress listener type.

Karmadav1.17.0Orchestration & ManagementFeb 28, 2026

CHECK 4PLAN 3OTHER 34View full analysis

A feature and maintenance release adds workload affinity and anti-affinity scheduling, operator and API capabilities, and Helm encryption at rest. It also includes controller and scheduler fixes, dependency and image updates, and deprecations and removals.

Check if affected (4)

breakingnamespace validation for spec.resourceSelectors
Applies if you use PropagationPolicy or OverridePolicy.
breakingStricter GroupByLabelKey validation in WorkloadAffinity
Applies if you configure GroupByLabelKey in WorkloadAffinity.
breakingUpdated default Kubernetes and ETCD images
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (3)

deprecatedThe --cluster-lease-duration flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-duration.
deprecatedThe --cluster-lease-renew-interval-fraction flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-renew-interval-fraction.
deprecatedEtcd.Local.InitImage in Karmada Init Configuration, deprecatedremoval date not announced
Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.

Daprv1.17.0Orchestration & ManagementFeb 27, 2026

ACTION 9CHECK 3PLAN 2OTHER 151View full analysis

A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.

Action needed (9)

securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto dependency is bumped.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github.com/coreos/go-oidc/v3 dependency, updated
The github.com/coreos/go-oidc/v3 dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.

Check if affected (3)

securityPlacement authorization for Dapr actor types
Applies if you use Placement.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.

Plan ahead (2)

deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.

Open Policy Agent (OPA)v1.14.0SecurityFeb 26, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.

Action needed (1)

securityhighThe go.opentelemetry.io dependencies, updated for GHSA-9h8m-3fm2-qjrq
The go.opentelemetry.io dependencies include the fix for GHSA-9h8m-3fm2-qjrq.

Check if affected (1)

breakingThe --h2c flag with Unix domain socket support
Applies if you use --h2c with unix domain socket (UDS).

Prometheusv3.10.0ObservabilityFeb 26, 2026

CHECK 1OTHER 29View full analysis

This release adds Prometheus capabilities and image/build options, changes defaults and outputs, improves performance, and fixes correctness defects. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingExpanded alert annotations hidden by default
Applies if you use the UI on the /alerts page.

OpenKruisev1.8.3CI/CD & App DeliveryFeb 25, 2026

CHECK 1View full analysis

OpenKruise v1.8.3 includes a constraint change for probe host configuration. Existing configurations that rely on previously accepted host values may require changes.

Check if affected (1)

breakingThe probe host field, restricted
Applies if your probe configurations use the host field.

OpenKruisev1.7.5CI/CD & App DeliveryFeb 25, 2026

CHECK 1View full analysis

This release restricts the host field in probe configuration. The section heading carries no operator-facing change.

Check if affected (1)

breakingRestricted probe host field
Applies if you configure host.

Rookv1.19.2Storage & DataFeb 24, 2026

CHECK 1OTHER 10View full analysis

This release includes operator-facing behavior and API updates, along with default, image, and dependency changes. It also contains an internal build-tooling update and fixes for storage and gateway handling.

Check if affected (1)

breakingDefault gateway topology spread constraints for nvmeof
Applies if you use nvmeof.

Fluxv2.8.0CI/CD & App DeliveryFeb 24, 2026

CHECK 1OTHER 41View full analysis

Flux v2.8.0 expands capabilities across controllers, notifications, the CLI, and artifact handling while also including fixes and dependency updates. It removes the deprecated API versions v1beta2 and v2beta2 from CRDs and changes Kubernetes compatibility requirements, so users of those APIs or affected Kubernetes versions are the main audience.

Check if affected (1)

breakingThe Flux APIs v1beta2 and v2beta2, removed from CRDs
Applies if you use the Flux APIs v1beta2 or v2beta2 in CRDs.

OpenFGAv1.11.6SecurityFeb 23, 2026

ACTION 1CHECK 1OTHER 1View full analysis

This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.

Action needed (1)

securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121
The grpc-health-probe dependency is updated to v0.4.45 to address CVE-2025-68121.

Check if affected (1)

breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use --read-only.

Kyvernov1.17.1SecurityFeb 19, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release includes a security fix for CVE-2025-68121, along with defect corrections and dependency updates. It also changes operator-facing defaults and configuration documentation, including a default that now uses a duration string.

Action needed (1)

securitycriticalCVE-2025-68121 security fix
CVE-2025-68121 is fixed in this release.

Check if affected (1)

breakingDefault value and Helm values documentation format change
Applicability is not stated in the release notes.

Crossplanev2.2.0Orchestration & ManagementFeb 17, 2026

ACTION 7CHECK 2OTHER 41View full analysis

A release with breaking changes to package installation and package-cache side-loading, alongside new operator capabilities and ordinary defect corrections. It also includes security-tagged dependency updates, but no advisory identifiers or vulnerability details are provided.

Action needed (7)

securitySecurity update for golang.org/x/crypto
The golang.org/x/crypto module was updated to v0.45.0 as a security update.
securitySecurity update for github.com/go-chi/chi/v5
The github.com/go-chi/chi/v5 module was updated to v5.2.4 as a security update.
securitySecurity update for github.com/sigstore/cosign/v3
The github.com/sigstore/cosign/v3 module was updated to v3.0.4 as a security update.
securitySecurity update for github.com/theupdateframework/go-tuf/v2
The github.com/theupdateframework/go-tuf/v2 module was updated to v2.4.1 as a security update.
securitySecurity update for github.com/sigstore/rekor
The github.com/sigstore/rekor module was updated to v1.5.0 as a security update.
securitySecurity update for github.com/sigstore/sigstore
The github.com/sigstore/sigstore module was updated to v1.10.4 as a security update.
securitySecurity update for github.com/quic-go/quic-go
The github.com/quic-go/quic-go module was updated to v0.57.0 as a security update.

Check if affected (2)

breakingInput CRD installation from Function packages
Applies if you use Function packages and Input CRDs.
breakingPackage cache structure
Applicability is not stated in the release notes.

Backstagev1.48.0CI/CD & App DeliveryFeb 17, 2026

CHECK 7PLAN 2OTHER 15View full analysis

A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.

Check if affected (7)

breakingStable catalogProcessingExtensionPoint export
Applies if you use catalogProcessingExtensionPoint when providing custom processors and entity providers into the catalog.
breakingRejected CatalogApi and ErrorApi overrides
Applicability is not stated in the release notes.
breakingRemoved auth.experimentalDynamicClientRegistration.tokenExpiration
Applies if you configure auth.experimentalDynamicClientRegistration.tokenExpiration.
+ 4 more on the release page

Plan ahead (2)

deprecatedDeprecated IconComponent type
Applies if you use IconComponent.
deprecatedDeprecated items prop
Applies if you use the items prop.

Istio1.28.4Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 7View full analysis

A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.

Action needed (1)

securityhighCVE-2025-61732 cgo comment parsing flaw
This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Check if affected (4)

securitycriticalCVE-2025-68121 TLS session resumption validation
Applies if you use Config.Clone with mutations or Config.GetConfigForClient.
securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
securityResource annotation validation against container injection
Applies if you configure resource annotations.
+ 1 more on the release page

Istio1.29.0Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 18View full analysis

This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.

Action needed (1)

breakingAutomatic GOMEMLIMIT setting for istiod
istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

breakingDefault iptables reconciliation
Applies when the istio-cni DaemonSet is upgraded.
breakingDefault debug endpoint authorization
Applies to debug endpoints on port 15014.
breakingDefault HTTP compression for Envoy metrics
Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.
+ 1 more on the release page

Thanosv0.41.0ObservabilityFeb 12, 2026

CHECK 1OTHER 10View full analysis

This release combines performance improvements, bug fixes, and new configuration capabilities with a shuffle-sharding behavior change in Receive. It also upgrades Prometheus, deprecates a flag, and makes native histogram ingestion always enabled.

Check if affected (1)

breakingReceive shuffle sharding now uses consistent hashing
Applies if you use Receive.

Kubernetesv1.35.1Kubernetes CoreFeb 10, 2026

CHECK 1OTHER 17View full analysis

A maintenance release with numerous correctness fixes and an enforced feature-gate default change. It also updates the Go toolchain and hnslib dependency, with no disclosed security advisories.

Check if affected (1)

breakingThe SchedulerAsyncAPICalls feature gate, disabled by default
Applies if you use the SchedulerAsyncAPICalls feature gate.

Istio1.27.6Networking & MessagingFeb 10, 2026

ACTION 1CHECK 2OTHER 2View full analysis

This release includes security safeguards for gateway resource creation and pod specification rendering, along with stricter authorization for debug endpoints. It also adds a Helm configuration field and corrects a TLS configuration mapping.

Action needed (1)

securityResource annotation validation
Resource annotation validation now rejects newline and control characters that could inject containers into pod specifications through template rendering.

Check if affected (2)

securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
breakingNamespace-based authorization for debug endpoints
Applies if you use debug endpoints on port 15014.

← NewerMar 24, 2026 – Feb 10, 2026Older →

Browse by month