Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: cert-managerClear ×

cert-managerv1.21.0SecurityJul 8, 2026

CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
The cert-manager-edit aggregate ClusterRole no longer grants create on ACME Challenge resources or create, patch, and update on Order resources. This prevents direct manipulation of these internal resources and addresses GHSA-8rvj-mm4h-c258.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
The deprecated ObjectReference API is removed in this release.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.
The Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path are removed.
+ 2 more on the release page

Plan ahead (2)

deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.
The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet.
deprecatedServerSideApply feature gate deprecation
cainjector now uses server-side apply unconditionally, and the ServerSideApply feature gate is deprecated.

Source ↗

cert-managerv1.20.0SecurityMar 10, 2026

ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
The cert-manager controller no longer risks a panic when it caches a DNS response in an unexpected order. An attacker who can modify DNS responses or control the DNS server could otherwise cause a denial of service.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
The OtherNames feature is promoted to Beta and enabled by default.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
The default container user UID changes from 1000 to 65532, and the default container group GID changes from 0 to 65532.
+ 1 more on the release page

Source ↗

Browse by month