Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jun 2026Clear ×Project: cert-managerClear ×

cert-managerv1.19.6SecurityJun 25, 2026

ACTION 2CHECK 1View full analysis

cert-manager v1.19.6 changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.

Action needed (2)

securityhighGo v1.25.11 with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507
Go is updated to v1.25.11 in cert-manager v1.19.6 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityGo 1.25.10 dependency upgrade
Go is upgraded to 1.25.10 as part of the dependency updates in cert-manager v1.19.6.

Check if affected (1)

securityReduced cert-manager-edit permissions for Challenge and Order creation and updates
Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.
The cert-manager-edit aggregate ClusterRole no longer includes the create, patch, or update verbs for Challenge and Order. This change ships in cert-manager v1.19.6 and addresses GHSA-8rvj-mm4h-c258.

Source ↗

cert-managerv1.20.3SecurityJun 25, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.

Action needed (1)

securityhighGo updated to v1.26.4
Go is updated to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

Check if affected (1)

securityThe cert-manager-edit aggregate ClusterRole permissions
Applicability is not stated in the release notes.
The default cert-manager-edit aggregate ClusterRole no longer grants namespace users permission to create ACME Challenge and Order resources directly. This fixes GHSA-8rvj-mm4h-c258.

Source ↗

Browse by month