Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Feb 2026Clear ×Project: VitessClear ×

Vitessv22.0.4Storage & DataFeb 27, 2026

CHECK 2OTHER 14View full analysis

A maintenance release with security fixes in backup restore behavior, along with routine bug fixes, a Go toolchain dependency update, and a performance improvement. The backup changes affect manifest-based external decompression and protection against path traversal during restores.

Check if affected (2)

securitycriticalBackup restore path traversal protection
Applies if you use backup storage.
Vitess now prevents a common Path Traversal attack in which someone with write access to backup storage modifies the MANIFEST to escape the target restore directory and write to arbitrary filesystem paths. This fix includes CVE-2026-27969 and GHSA-r492-hjgh-c9gw.
securityhighManifest-based external decompression default, changed
Applies if you use an external decompressor command and do not pass --external-decompressor-use-manifest.
The external decompressor command stored in a backup's MANIFEST file is no longer used during restore by default. --external-decompressor-use-manifest restores manifest-based decompression in this release, which includes CVE-2026-27965 and GHSA-8g8j-r87h-p36x.

Source ↗

Vitessv23.0.3Storage & DataFeb 27, 2026

CHECK 2OTHER 12View full analysis

A security-focused maintenance release with changes to backup and restore behavior, bug fixes, and additional hardening. Backup MANIFEST handling now requires explicit opt-in for compressor commands, and restore blocks path traversal through MANIFEST files.

Check if affected (2)

securityLoading compressor commands from MANIFEST, opt-in
Applies if you use --external-decompressor-use-manifest.
Restore loads compressor commands from MANIFEST only when --external-decompressor-use-manifest is used. This opt-in behavior ships in the restore path.
securityPath traversal through backup MANIFEST on restore blocked
Applies if backupengine runs.
backupengine disallows path traversal through backup MANIFEST files during restore. The protection ships in the backup restore path.

Source ↗

Browse by month