Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: cert-managerClear ×

cert-managerv1.21.0SecurityJul 8, 2026

CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
The cert-manager-edit aggregate ClusterRole no longer grants create on ACME Challenge resources or create, patch, and update on Order resources. This prevents direct manipulation of these internal resources and addresses GHSA-8rvj-mm4h-c258.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
The deprecated ObjectReference API is removed in this release.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.
The Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path are removed.
+ 2 more on the release page

Plan ahead (2)

deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.
The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet.
deprecatedServerSideApply feature gate deprecation
cainjector now uses server-side apply unconditionally, and the ServerSideApply feature gate is deprecated.

Source ↗

cert-managerv1.19.6SecurityJun 25, 2026

ACTION 2CHECK 1View full analysis

cert-manager v1.19.6 changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.

Action needed (2)

securityhighGo v1.25.11 with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507
Go is updated to v1.25.11 in cert-manager v1.19.6 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityGo 1.25.10 dependency upgrade
Go is upgraded to 1.25.10 as part of the dependency updates in cert-manager v1.19.6.

Check if affected (1)

securityReduced cert-manager-edit permissions for Challenge and Order creation and updates
Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.
The cert-manager-edit aggregate ClusterRole no longer includes the create, patch, or update verbs for Challenge and Order. This change ships in cert-manager v1.19.6 and addresses GHSA-8rvj-mm4h-c258.

Source ↗

cert-managerv1.20.3SecurityJun 25, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.

Action needed (1)

securityhighGo updated to v1.26.4
Go is updated to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

Check if affected (1)

securityThe cert-manager-edit aggregate ClusterRole permissions
Applicability is not stated in the release notes.
The default cert-manager-edit aggregate ClusterRole no longer grants namespace users permission to create ACME Challenge and Order resources directly. This fixes GHSA-8rvj-mm4h-c258.

Source ↗

cert-managerv1.20.0SecurityMar 10, 2026

ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
The cert-manager controller no longer risks a panic when it caches a DNS response in an unexpected order. An attacker who can modify DNS responses or control the DNS server could otherwise cause a denial of service.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
The OtherNames feature is promoted to Beta and enabled by default.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
The default container user UID changes from 1000 to 65532, and the default container group GID changes from 0 to 65532.
+ 1 more on the release page

Source ↗

cert-managerv1.19.3SecurityFeb 2, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.

Check if affected (1)

securitymediumcert-manager controller DNS response panic fix, GHSA-gx3x-vq4p-mhhv
Applicability is not stated in the release notes.
This release fixes a potential panic in the cert-manager controller when a cached DNS response arrives in an unexpected order. The issue is tracked as GHSA-gx3x-vq4p-mhhv and could cause denial of service when an attacker modifies DNS responses or controls the DNS server.

Source ↗

Browse by month