Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jul 2026Clear ×

Open Policy Agent (OPA)v1.19.0SecurityJul 30, 2026

ACTION 3CHECK 2OTHER 36View full analysis

A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.

Action needed (3)

securityhighoras.land/oras-go/v2 update for GHSA-fxhp-mv3v-67qp
oras.land/oras-go/v2 is updated from 2.6.1 to 2.6.2 to address GHSA-fxhp-mv3v-67qp.
breakingReadHeaderTimeout default
All HTTP servers now set ReadHeaderTimeout to 32s.
breakingPartial set and -object rule name conflicts
The AST rejects partial set and -object rules that share a name.

Check if affected (2)

securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
breakingStricter := safety checking
Applicability is not stated in the release notes.

Source ↗

NATSv2.14.4Networking & MessagingJul 30, 2026

CHECK 4OTHER 37View full analysis

A maintenance release with dependency and toolchain updates, JetStream performance and configuration improvements, and broad correctness fixes. It also includes authentication and permission fixes.

Check if affected (4)

securityJWT validation with whitespace-only permissions
Applies if you use JWT validation.
securityverify_and_map authentication with blank passwords
Applies if TLS verify_and_map is configured.
securityMQTT subscription restriction for $MQTT.> subjects
Applies if you use MQTT.
+ 1 more on the release page

Source ↗

NATSv2.12.14Networking & MessagingJul 30, 2026

ACTION 1CHECK 2OTHER 33View full analysis

A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.

Action needed (1)

breakingThe disk concurrency semaphore, increased to 4096 slots
The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.

Check if affected (2)

securityAuthentication checks with no_auth_user and auth callouts
Applies if you configure no_auth_user and use auth callouts.
securityTLS verify_and_map authentication with blank passwords
Applies if you use TLS and configure verify_and_map.

Source ↗

Ciliumv1.20.0Networking & MessagingJul 29, 2026

ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

securitygoogle.golang.org/grpc v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in the main branch.
securitygoogle.golang.org/grpc v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.
securityhelm.sh/helm/v4 v4.1.4
The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.
securitygithub.com/cloudflare/circl v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3.
securitygithub.com/go-jose/go-jose/v4 v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.
securitygithub.com/moby/spdystream v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1.
breakingcni.customConf CNI configuration version
The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.

Check if affected (28)

securitytbid traffic host namespace handling
Applies if you use tbid traffic.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
+ 25 more on the release page

Plan ahead (6)

deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[].subnet or interfaces[].cidr.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
+ 3 more on the release page

Source ↗

etcdv3.7.1Kubernetes CoreJul 23, 2026

ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

securityhighThe google.golang.org/grpc dependency update
The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.

Source ↗

gRPCv1.83.0Networking & MessagingJul 22, 2026

CHECK 1View full analysis

This release includes a security-related default change in TLS key exchange. The change affects deployments that use TLS key exchange.

Check if affected (1)

securityPost-Quantum Cryptography as the default for TLS key exchange
Applies when TLS key exchange is used.

Source ↗

KubeVelav1.11.0CI/CD & App DeliveryJul 20, 2026

CHECK 3OTHER 67View full analysis

A release with operator-facing authorization and credential-handling fixes, alongside new Helm, CUE, and workflow capabilities. It also adds validation improvements and dependency updates.

Check if affected (3)

securityExplicit authorization for vela-system definitions
Applies if you use vela-system definitions.
securityCredential redaction for Terraform module remote URLs
Applies if you configure Terraform module remote URLs.
breakingUndeclared parameter validation in application definitions
Applies if you use application definitions.

Source ↗

Envoyv1.39.0Networking & MessagingJul 14, 2026

CHECK 11OTHER 50View full analysis

A broad release with operator-facing changes across configuration, protocols, extensions, networking, and observability. Security fixes address multiple identified CVEs and a GHSA, while changed defaults, stricter input validation, and removed functionality may affect existing deployments.

Check if affected (11)

securityhighHTTP/2 header limits and flood protection
Applies if you use HTTP/2.
securityhighHTTP/3 QPACK and content-length security fixes
Applies if you use HTTP/3.
securityhighAdditional protocol, parser, formatter, and decompression security fixes
Applies if you use DNS query validation, JSON nesting limits, PROXY protocol TLV, the formatter, TCP StatsD, TLS SAN, or Zstd decompression.
+ 8 more on the release page

Source ↗

Buildpacksv0.40.8CI/CD & App DeliveryJul 13, 2026

CHECK 1OTHER 3View full analysis

A maintenance release rebuilds the pack on Go 1.25.12 to address two disclosed standard library security issues. It also updates several dependencies and includes a newer default lifecycle version.

Check if affected (1)

securityhighGo 1.25.12 standard library rebuild for GO-2026-4970 and GO-2026-5856
Applies if you use 1.25.11 -> 1.25.12.

Source ↗

Kyvernov1.18.2SecurityJul 10, 2026

ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with operator-relevant fixes and behavior changes, plus security work in the 1.18 release line. It includes namespace-boundary enforcement for generators and security dependency updates.

Action needed (1)

securitySecurity dependency updates
Security dependency updates from #16340 are backported to release-1.18.

Check if affected (1)

securityNamespace-boundary enforcement in generator.apply()
Applies if you use generator.apply().

Source ↗

Keycloak26.7.0SecurityJul 9, 2026

ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

securityPre-account takeover attack exposure
The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

securitymediumCVE-2026-9796, admin role rename authorization
Applies if you use manage-clients.
securitymediumCVE-2026-9689, OIDC redirect URI parameter handling
Applies if you use OIDC.
securitymediumCVE-2026-9798, CIBA account lockout
Applies if you run the CIBA authentication flow.
+ 16 more on the release page

Plan ahead (4)

deprecatedThe V1 API, deprecated
Applies if you use V1.
deprecatedThe Require Discoverable Credential option, deprecated
Applies if you configure the Require Discoverable Credential option.
deprecatedThe Twitter IDP implementation, deprecated
Applies if you use the Twitter IDP implementation.
+ 1 more on the release page

Source ↗

cert-managerv1.21.0SecurityJul 8, 2026

CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.
+ 2 more on the release page

Plan ahead (2)

deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.
deprecatedServerSideApply feature gate deprecation

Source ↗

etcdv3.7.0Kubernetes CoreJul 8, 2026

ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

securityhighgolang.org/x/crypto updated to v0.52.0
The release updates golang.org/x/crypto to v0.52.0 to resolve CVE-2026-46598, CVE-2026-39835, CVE-2026-39828, and CVE-2026-46597.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if you configure --listen-client-http-urls.

Source ↗

Thanosv0.42.0ObservabilityJul 8, 2026

ACTION 1CHECK 4OTHER 19View full analysis

A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.

Action needed (1)

securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186
The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.

Check if affected (4)

securityReceive tenant ID validation
Applies if you run Receive.
breakingQuery-Frontend time_taken field renamed to time_taken_ms
Applies if you run Query-Frontend.
breaking--shipper.ignore-unequal-block-size flag removed
Applies if you configure --shipper.ignore-unequal-block-size.
+ 1 more on the release page

Source ↗

etcdv3.6.13Kubernetes CoreJul 1, 2026

ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0
The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.
securityhighgolang.org/x/crypto, updated to v0.52.0
The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if --listen-client-http-urls is configured.

Source ↗

etcdv3.5.32Kubernetes CoreJul 1, 2026

ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

securityCRL enforcement with --listen-client-http-urls
Applies if --listen-client-http-urls is configured.

Source ↗

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().

Source ↗

Browse by month