Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Feb 2026Clear ×

Karmadav1.17.0Orchestration & ManagementFeb 28, 2026

CHECK 4PLAN 3OTHER 34View full analysis

A feature and maintenance release adds workload affinity and anti-affinity scheduling, operator and API capabilities, and Helm encryption at rest. It also includes controller and scheduler fixes, dependency and image updates, and deprecations and removals.

Check if affected (4)

breakingnamespace validation for spec.resourceSelectors
Applies if you use PropagationPolicy or OverridePolicy.
breakingStricter GroupByLabelKey validation in WorkloadAffinity
Applies if you configure GroupByLabelKey in WorkloadAffinity.
breakingUpdated default Kubernetes and ETCD images
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (3)

deprecatedThe --cluster-lease-duration flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-duration.
deprecatedThe --cluster-lease-renew-interval-fraction flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-renew-interval-fraction.
deprecatedEtcd.Local.InitImage in Karmada Init Configuration, deprecatedremoval date not announced
Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.

Daprv1.17.0Orchestration & ManagementFeb 27, 2026

ACTION 9CHECK 3PLAN 2OTHER 151View full analysis

A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.

Action needed (9)

securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto dependency is bumped.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github.com/coreos/go-oidc/v3 dependency, updated
The github.com/coreos/go-oidc/v3 dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.

Check if affected (3)

securityPlacement authorization for Dapr actor types
Applies if you use Placement.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.

Plan ahead (2)

deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.

Vitessv22.0.4Storage & DataFeb 27, 2026

CHECK 2OTHER 14View full analysis

A maintenance release with security fixes in backup restore behavior, along with routine bug fixes, a Go toolchain dependency update, and a performance improvement. The backup changes affect manifest-based external decompression and protection against path traversal during restores.

Check if affected (2)

securitycriticalBackup restore path traversal protection
Applies if you use backup storage.
securityhighManifest-based external decompression default, changed
Applies if you use an external decompressor command and do not pass --external-decompressor-use-manifest.

Vitessv23.0.3Storage & DataFeb 27, 2026

CHECK 2OTHER 12View full analysis

A security-focused maintenance release with changes to backup and restore behavior, bug fixes, and additional hardening. Backup MANIFEST handling now requires explicit opt-in for compressor commands, and restore blocks path traversal through MANIFEST files.

Check if affected (2)

securityLoading compressor commands from MANIFEST, opt-in
Applies if you use --external-decompressor-use-manifest.
securityPath traversal through backup MANIFEST on restore blocked
Applies if backupengine runs.

Open Policy Agent (OPA)v1.14.0SecurityFeb 26, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.

Action needed (1)

securityhighThe go.opentelemetry.io dependencies, updated for GHSA-9h8m-3fm2-qjrq
The go.opentelemetry.io dependencies include the fix for GHSA-9h8m-3fm2-qjrq.

Check if affected (1)

breakingThe --h2c flag with Unix domain socket support
Applies if you use --h2c with unix domain socket (UDS).

Prometheusv3.10.0ObservabilityFeb 26, 2026

CHECK 1OTHER 29View full analysis

This release adds Prometheus capabilities and image/build options, changes defaults and outputs, improves performance, and fixes correctness defects. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingExpanded alert annotations hidden by default
Applies if you use the UI on the /alerts page.

OpenKruisev1.8.3CI/CD & App DeliveryFeb 25, 2026

CHECK 1View full analysis

OpenKruise v1.8.3 includes a constraint change for probe host configuration. Existing configurations that rely on previously accepted host values may require changes.

Check if affected (1)

breakingThe probe host field, restricted
Applies if your probe configurations use the host field.

OpenKruisev1.7.5CI/CD & App DeliveryFeb 25, 2026

CHECK 1View full analysis

This release restricts the host field in probe configuration. The section heading carries no operator-facing change.

Check if affected (1)

breakingRestricted probe host field
Applies if you configure host.

Rookv1.19.2Storage & DataFeb 24, 2026

CHECK 1OTHER 10View full analysis

This release includes operator-facing behavior and API updates, along with default, image, and dependency changes. It also contains an internal build-tooling update and fixes for storage and gateway handling.

Check if affected (1)

breakingDefault gateway topology spread constraints for nvmeof
Applies if you use nvmeof.

Fluxv2.8.0CI/CD & App DeliveryFeb 24, 2026

CHECK 1OTHER 41View full analysis

Flux v2.8.0 expands capabilities across controllers, notifications, the CLI, and artifact handling while also including fixes and dependency updates. It removes the deprecated API versions v1beta2 and v2beta2 from CRDs and changes Kubernetes compatibility requirements, so users of those APIs or affected Kubernetes versions are the main audience.

Check if affected (1)

breakingThe Flux APIs v1beta2 and v2beta2, removed from CRDs
Applies if you use the Flux APIs v1beta2 or v2beta2 in CRDs.

OpenFGAv1.11.6SecurityFeb 23, 2026

ACTION 1CHECK 1OTHER 1View full analysis

This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.

Action needed (1)

securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121
The grpc-health-probe dependency is updated to v0.4.45 to address CVE-2025-68121.

Check if affected (1)

breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use --read-only.

Keycloak26.5.4SecurityFeb 20, 2026

ACTION 2CHECK 4OTHER 10View full analysis

A maintenance release with five disclosed security fixes, one new capability, and ten corrected bugs. It contains no operator prerequisites or dependency-manifest entries.

Action needed (2)

securitymediumCVE-2026-0707, authorization header parsing
This release corrects authorization header parsing that could bypass security controls.
securitylowCVE-2025-5416, keycloak-core environment information disclosure
This release fixes environment information disclosure in keycloak-core.

Check if affected (4)

securitymediumCVE-2026-2575, excessive SAMLRequest decompression
Applies if you use SAML.
securitylowCVE-2026-1190, SAML brokering response delay
Applies if you use SAML brokering.
securitylowCVE-2026-2733, disabled client check for Docker Registry Protocol
Applies if you use the Docker Registry Protocol.
+ 1 more on the release page

Kyvernov1.17.1SecurityFeb 19, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release includes a security fix for CVE-2025-68121, along with defect corrections and dependency updates. It also changes operator-facing defaults and configuration documentation, including a default that now uses a duration string.

Action needed (1)

securitycriticalCVE-2025-68121 security fix
CVE-2025-68121 is fixed in this release.

Check if affected (1)

breakingDefault value and Helm values documentation format change
Applicability is not stated in the release notes.

Crossplanev2.2.0Orchestration & ManagementFeb 17, 2026

ACTION 7CHECK 2OTHER 41View full analysis

A release with breaking changes to package installation and package-cache side-loading, alongside new operator capabilities and ordinary defect corrections. It also includes security-tagged dependency updates, but no advisory identifiers or vulnerability details are provided.

Action needed (7)

securitySecurity update for golang.org/x/crypto
The golang.org/x/crypto module was updated to v0.45.0 as a security update.
securitySecurity update for github.com/go-chi/chi/v5
The github.com/go-chi/chi/v5 module was updated to v5.2.4 as a security update.
securitySecurity update for github.com/sigstore/cosign/v3
The github.com/sigstore/cosign/v3 module was updated to v3.0.4 as a security update.
securitySecurity update for github.com/theupdateframework/go-tuf/v2
The github.com/theupdateframework/go-tuf/v2 module was updated to v2.4.1 as a security update.
securitySecurity update for github.com/sigstore/rekor
The github.com/sigstore/rekor module was updated to v1.5.0 as a security update.
securitySecurity update for github.com/sigstore/sigstore
The github.com/sigstore/sigstore module was updated to v1.10.4 as a security update.
securitySecurity update for github.com/quic-go/quic-go
The github.com/quic-go/quic-go module was updated to v0.57.0 as a security update.

Check if affected (2)

breakingInput CRD installation from Function packages
Applies if you use Function packages and Input CRDs.
breakingPackage cache structure
Applicability is not stated in the release notes.

Backstagev1.48.0CI/CD & App DeliveryFeb 17, 2026

CHECK 7PLAN 2OTHER 15View full analysis

A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.

Check if affected (7)

breakingStable catalogProcessingExtensionPoint export
Applies if you use catalogProcessingExtensionPoint when providing custom processors and entity providers into the catalog.
breakingRejected CatalogApi and ErrorApi overrides
Applicability is not stated in the release notes.
breakingRemoved auth.experimentalDynamicClientRegistration.tokenExpiration
Applies if you configure auth.experimentalDynamicClientRegistration.tokenExpiration.
+ 4 more on the release page

Plan ahead (2)

deprecatedDeprecated IconComponent type
Applies if you use IconComponent.
deprecatedDeprecated items prop
Applies if you use the items prop.

Istio1.28.4Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 7View full analysis

A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.

Action needed (1)

securityhighCVE-2025-61732 cgo comment parsing flaw
This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Check if affected (4)

securitycriticalCVE-2025-68121 TLS session resumption validation
Applies if you use Config.Clone with mutations or Config.GetConfigForClient.
securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
securityResource annotation validation against container injection
Applies if you configure resource annotations.
+ 1 more on the release page

Istio1.29.0Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 18View full analysis

This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.

Action needed (1)

breakingAutomatic GOMEMLIMIT setting for istiod
istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

breakingDefault iptables reconciliation
Applies when the istio-cni DaemonSet is upgraded.
breakingDefault debug endpoint authorization
Applies to debug endpoints on port 15014.
breakingDefault HTTP compression for Envoy metrics
Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.
+ 1 more on the release page

Thanosv0.41.0ObservabilityFeb 12, 2026

CHECK 1OTHER 10View full analysis

This release combines performance improvements, bug fixes, and new configuration capabilities with a shuffle-sharding behavior change in Receive. It also upgrades Prometheus, deprecates a flag, and makes native histogram ingestion always enabled.

Check if affected (1)

breakingReceive shuffle sharding now uses consistent hashing
Applies if you use Receive.

Kubernetesv1.35.1Kubernetes CoreFeb 10, 2026

CHECK 1OTHER 17View full analysis

A maintenance release with numerous correctness fixes and an enforced feature-gate default change. It also updates the Go toolchain and hnslib dependency, with no disclosed security advisories.

Check if affected (1)

breakingThe SchedulerAsyncAPICalls feature gate, disabled by default
Applies if you use the SchedulerAsyncAPICalls feature gate.

Istio1.27.6Networking & MessagingFeb 10, 2026

ACTION 1CHECK 2OTHER 2View full analysis

This release includes security safeguards for gateway resource creation and pod specification rendering, along with stricter authorization for debug endpoints. It also adds a Helm configuration field and corrects a TLS configuration mapping.

Action needed (1)

securityResource annotation validation
Resource annotation validation now rejects newline and control characters that could inject containers into pod specifications through template rendering.

Check if affected (2)

securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
breakingNamespace-based authorization for debug endpoints
Applies if you use debug endpoints on port 15014.

Jaegerv2.15.0ObservabilityFeb 6, 2026

CHECK 1OTHER 16View full analysis

Jaeger v2.15.0 introduces a breaking constraint for trace and metric storage configuration. It also adds experimental MCP and ClickHouse capabilities, corrects API behavior, and includes an internal implementation change without direct operator impact.

Check if affected (1)

breakingTrace and metric storage configuration backend constraint
Applies if you configure trace or metric storage with more than one backend type.

Rookv1.19.1Storage & DataFeb 5, 2026

ACTION 1CHECK 2OTHER 8View full analysis

A maintenance release with operator-facing removals, default and behavior changes, new CRD fields, expanded configuration support, and dependency updates. No security advisory is disclosed.

Action needed (1)

breakingNodes/proxy RBAC enablement removal
The unnecessary nodes/proxy RBAC enablement is removed.

Check if affected (2)

breakingDefault Ceph image pull policy
Applies if you do not configure ceph image pull policy.
breakingAutomated node fencing code removal
Applies if automated node fencing runs.

Ciliumv1.19.0Networking & MessagingFeb 4, 2026

ACTION 15CHECK 30PLAN 7OTHER 436View full analysis

A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.

Action needed (15)

securityThe github.com/containerd/containerd dependency, updated
The github.com/containerd/containerd module is updated to v1.7.29.
securityThe github.com/go-viper/mapstructure/v2 dependency, updated
The github.com/go-viper/mapstructure/v2 module is updated to v2.4.0.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker module is updated to v28.3.3+incompatible.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto module is updated to v0.45.0.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.4
The helm.sh/helm/v3 module is updated to v3.18.4.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.5
The helm.sh/helm/v3 module is updated to v3.18.5.
breakingThe plpmtud default, set to blackhole
The default plpmtud mode is now blackhole (blackhole-detected).
breakingThe AddressScopeMax default, set to 254
The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.
breakingThe tls authMode default, set to migration
tls authMode is set to migration by default.
breakingThe CNI deletion timeout, reduced to 1.5 seconds
The CNI deletion timeout is reduced to 1.5 seconds.
breakingThe policy-default-local-cluster default
policy-default-local-cluster is now set by default.
breakingHost firewall bypass, disabled by default
Host firewall bypass is disabled by default.
breakingFQDN match pattern sanitization
FQDN match pattern sanitization is refactored and tightened.
breakingEncrypted traffic forwarding via cilium_host, removed
Forwarding encrypted traffic via cilium_host has been removed.
breakingCNI configuration in the container image, removed
The CNI configuration is no longer installed in the container image.

Check if affected (30)

breakingLocal-cluster default for network policy selectors
Applies if you do not set cluster in network policy selectors.
breakingThe CiliumBGPPeeringPolicy v1 API, removed
Applies if you use CiliumBGPPeeringPolicy.
breakingMutual Authentication, disabled by default
Applies if you enable Mutual Authentication.
+ 27 more on the release page

Plan ahead (7)

deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced
Applies if you use --enable-ipsec-encrypted-overlay.
deprecatedKafka match fields and ToRequires and FromRequires, deprecated
Applies if you use ToRequires or FromRequires.
deprecatedTLS certificate and key Helm values, deprecated
Applies if you pass TLS certificates or keys in Helm values.
+ 4 more on the release page

Backstagev1.47.3CI/CD & App DeliveryFeb 2, 2026

CHECK 1View full analysis

A security-focused release with fixes for the TechDocs Node plugin. The release is relevant to deployments that use @backstage/plugin-techdocs-node.

Check if affected (1)

securitySecurity fixes for @backstage/plugin-techdocs-node
Applies if you use @backstage/plugin-techdocs-node.

cert-managerv1.19.3SecurityFeb 2, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.

Check if affected (1)

securitymediumcert-manager controller DNS response panic fix, GHSA-gx3x-vq4p-mhhv
Applicability is not stated in the release notes.

Kyvernov1.17.0SecurityFeb 2, 2026

ACTION 2CHECK 2OTHER 142View full analysis

A substantial feature and maintenance release adds CEL and policy capabilities while correcting controller and API defects. It also includes security fixes, including a kubectl image update for CVEs, along with dependency and integration changes.

Action needed (2)

securitySecurity vulnerabilities addressed
Security vulnerabilities are addressed in this release.
securityUpdated kubectl image for CVE fixes
The kubectl image is updated to address CVEs in this release.

Check if affected (2)

breakingRestricted resource access in namespaced CEL policy types
Applies if you use namespaced CEL policy types.
breakingOpt-in VAP/MAP reporting
Applies if you use VAP/MAP reporting.

KEDAv2.19.0Orchestration & ManagementFeb 2, 2026

CHECK 1OTHER 18View full analysis

A feature and maintenance release that adds scaler and authentication capabilities, updates scaler behavior and status reporting, and corrects several defects. It also replaces a deprecated dependency and removes the NATS Streaming scaler.

Check if affected (1)

breakingThe NATS Streaming scaler, removed
Applies if you use the NATS Streaming scaler.

Argov3.3.0CI/CD & App DeliveryFeb 2, 2026

ACTION 3CHECK 1OTHER 362View full analysis

Argo v3.3.0 is a substantial feature and maintenance release with changes across synchronization, health, hydration, diff and apply behavior, the UI, and resource operations. It also updates core dependencies and removes an app controller flag.

Action needed (3)

securityThe k8s.io/kubernetes module, updated to v1.34.2
The k8s.io/kubernetes module is updated to v1.34.2 in Argo v3.3.0.
securityHelm 3.19.4
Helm is updated to 3.19.4 in Argo v3.3.0.
securityRedis, updated to the latest stable release
Redis is updated to the latest stable release in Argo v3.3.0.

Check if affected (1)

breakingThe --self-heal-backoff-cooldown-seconds flag, removed
Applies if your app controller configuration uses --self-heal-backoff-cooldown-seconds.

Browse by month