Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Aug 2026Clear ×

hamiv2.10.0AI & MLYesterdayAug 21, 2026

ACTION 3CHECK 7OTHER 195View full analysis

A substantial operator-focused maintenance release with broad bug and behavior fixes, alongside new scheduling, device, configuration, and observability capabilities. It also updates security-relevant dependencies and the runtime/toolchain while removing obsolete functionality that may affect compatibility and configuration.

Action needed (3)

securitytensorflow/tensorflow upgraded to 2.21.0rc0-gpu
The tensorflow/tensorflow dependency is upgraded from 2.20.0rc0-gpu to 2.21.0rc0-gpu.
securitytensorflow/tensorflow upgraded to 2.21.0rc1-gpu
The tensorflow/tensorflow dependency is upgraded from 2.21.0rc0-gpu to 2.21.0rc1-gpu.
securitygolang security upgrade
The golang runtime is upgraded to address a security issue.

Check if affected (7)

breakingDRA components removed from the HAMi main chart
Applies if you use DRA components in the HAMi main chart.
breakingWebhook denial of privileged containers
Applies if you use the webhook.
breakingDeprecated scheduler policy configmap removed
Applies if you configure the deprecated scheduler policy configmap.
+ 4 more on the release page

Rookv1.20.6Storage & DataAug 20, 2026

CHECK 2OTHER 1View full analysis

A maintenance release with a Ceph security advisory, a disabled Rook manager module, and clearer CephX fallback errors. Users of Ceph are advised to upgrade, while CephX key fallback failures now report the actual error.

Check if affected (2)

securityCeph CVE-2025–30156 upgrade advisory
Applies if you depend on Ceph.
breakingThe rook mgr module, disabled
Applies if you enable the rook mgr module.

Rookv1.19.10Storage & DataAug 20, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a security-driven Ceph upgrade recommendation and a disabled Rook manager module. It also adds or changes CephCluster and CephX error-reporting behavior.

Action needed (1)

breakingThe Rook manager module, disabled
The Rook manager module is disabled in this release.

Check if affected (1)

securityCeph upgrade recommendation for CVE-2025-30156
Applies if you use Ceph.

Crossplanev2.4.0Orchestration & ManagementAug 20, 2026

ACTION 15CHECK 4PLAN 1OTHER 33View full analysis

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

securityGo version and dependency security updates
Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.
securityGo 1.25.10
Go was updated to 1.25.10 to fix standard library CVEs.
securitygolang.org/x/crypto v0.52.0
The golang.org/x/crypto module was updated to v0.52.0 for security fixes.
securitygolang.org/x/sys v0.44.0
The golang.org/x/sys module was updated to v0.44.0 for security fixes.
securitygolang.org/x/net v0.55.0
The golang.org/x/net module was updated to v0.55.0 for security fixes.
securitygithub.com/sigstore/cosign/v3 v3.0.6
The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.
securitygithub.com/sigstore/rekor v1.5.2
The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.
securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0
The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.0
The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.
securityCombined grpc, x/net, and x/text security updates
Combined security updates were applied to grpc, x/net, and x/text.
securitygolang.org/x/net v0.56.0
The golang.org/x/net module was updated to v0.56.0 for security fixes.
securitygolang.org/x/text v0.39.0
The golang.org/x/text module was updated to v0.39.0 for security fixes.
securityVulnerable dependency updates
Vulnerable dependencies were updated for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.1
The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.
securitygolang.org/x/mod v0.40.0
The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

breakingCrossplane CLI publication location and binary name
Applies if you use the Crossplane CLI.
breakingspec.replicas behavior in DeploymentRuntimeConfig
Applies if DeploymentRuntimeConfig configures spec.replicas.
breakingNarrowed composed resource garbage collection
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (1)

deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)
Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.

Kyvernov1.19.0SecurityAug 20, 2026

ACTION 7CHECK 6PLAN 1OTHER 160View full analysis

A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.

Action needed (7)

securityhighIntermediate certificate limits
Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.
securityhighGo toolchain 1.26.3
The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.
securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9
CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.
securityUpdated golang.org/x/crypto and x/net dependencies
The golang.org/x/crypto dependency was updated to v0.53.0 and x/net to v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.
securityPatched ORAS and sigstore vulnerabilities
The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.
securityCodeQL vulnerability fixes
Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.
securitycel-go v0.30.0
cel-go was updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.

Check if affected (6)

breakingRequired --resource for the migrate command
Applies when the migrate command runs.
breakingDefault userInfo groups and UID during background scans
Applies when background scans run.
breakingexcludeBootstrapResources webhook flag
Applies when you configure Fail webhooks.
+ 3 more on the release page

Plan ahead (1)

deprecatedDeprecation notices for legacy kyverno.io policy types
Applies when you use legacy kyverno.io policy types.

Strimzi1.2.0Networking & MessagingAug 20, 2026

ACTION 2CHECK 3OTHER 7View full analysis

This release removes legacy CRD API versions and resource state metrics, and changes defaults for token mounting, feature gates, and container security contexts. It also adds Kafka and configuration capabilities and updates shipped dependencies.

Action needed (2)

breakingService Account token mounting
Service Account tokens are no longer auto-mounted into Pods. They are mounted through a volume instead.
breakingThe ServerSideApplyPhase1 feature gate, permanently enabled
The ServerSideApplyPhase1 feature gate has moved to GA and is permanently enabled. It can no longer be disabled.

Check if affected (3)

breakingLegacy CRD API versions, no longer supported
Applies before upgrading to Strimzi 1.0.0 or later if you use the v1beta2, v1beta1, or v1alpha1 APIs.
breakingResource state metrics, removed
Applicability is not stated in the release notes.
breakingDefault securityContext for operator installations
Applies if you use the Cluster, Topic, and User Operator YAML installation files or the Cluster Operator Helm Chart.

Rookv1.20.5Storage & DataAug 19, 2026

CHECK 1OTHER 3View full analysis

A security-focused release with an advisory requiring Rook and Ceph upgrades. It also adds support for the new cephx key type, changes external version validation to ignore Ceph commit IDs, and fixes monitor registration in the v1 failover path.

Check if affected (1)

securityCeph CVE-2025–30156 advisory
Applies if you use Ceph.

Keycloak26.7.2SecurityAug 19, 2026

ACTION 2CHECK 6OTHER 14View full analysis

A maintenance release with disclosed security fixes, a cleartext vault-keystore password correction, a Quarkus dependency upgrade, and other bug corrections. The fixes cover account and permission flows, secret handling, and runtime dependencies.

Action needed (2)

securitymediumCVE-2026-59888 and CVE-2026-59889 fixes in jackson-databind
jackson-databind is upgraded to 2.21.5 to address CVE-2026-59888 and CVE-2026-59889. The dependency update ships in this Keycloak release.
securitymediumCVE-2026-45292 OpenTelemetry Java SDK memory allocation correction
CVE-2026-45292 corrects unbounded memory allocation in W3C Baggage Propagation in the OpenTelemetry Java SDK.

Check if affected (6)

securitycriticalCVE-2026-18963 reset-credentials flow bypass correction
Applies if you use the reset-credentials flow.
securityhighCVE-2026-15571 predictable account-linking hash correction
Applies if you use oidc.
securitymediumCVE-2026-14613 fine-grained admin permissions bypass correction
Applies if you use the admin/fine-grained-permissions API.
+ 3 more on the release page

CoreDNSv1.14.7Kubernetes CoreAug 19, 2026

ACTION 1CHECK 3OTHER 42View full analysis

A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.

Action needed (1)

securityhighGo 1.26.6 security fixes
The release is built with Go 1.26.6, including fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.

Check if affected (3)

securityplugin/acl autopath ACL checks
Applies if you use plugin/acl and autopath.
breakingplugin/forward default connection attempts
Applies if you use plugin/forward.
breakingplugin/hosts unsupported-type fallthrough
Applies if you use plugin/hosts.

Backstagev1.54.0CI/CD & App DeliveryAug 18, 2026

ACTION 2CHECK 16PLAN 3OTHER 238View full analysis

A broad release with dependency updates, breaking changes to commands, authentication patterns, and connection APIs, plus new AWS connection support and updates across the catalog, scaffolder, search, and UI. It also includes Kubernetes plugin security fixes and an undisclosed security announcement.

Action needed (2)

breakingStrict TypeScript configuration schema validation
Package preparation now validates TypeScript configuration schemas strictly before publishing.
breakingPortable configuration schemas for root connection types
Connection types now use portable configuration schemas as the source of root connection types.

Check if affected (16)

securityKubernetes plugin security fixes
Applies if you use the Kubernetes plugin.
breakingBackend connection APIs, removed from package exports
Applies if you use connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, or AnyRootConnection.
breakingNode.js snapshots in generated backend Dockerfiles
Applies if you configure generated backend Dockerfiles.
+ 13 more on the release page

Plan ahead (3)

deprecatedThe plugin-web-library template, updated to toastApiRef
Applies if you use the plugin-web-library template.
deprecatedZod v3 schemas, deprecated
Applies if you depend on Zod v3 schemas.
deprecatedThe catalog.providers.backstageOpenapi.plugins option, deprecated
Applies if you configure catalog.providers.backstageOpenapi.plugins.

Ciliumv1.20.1Networking & MessagingAug 18, 2026

CHECK 1OTHER 51View full analysis

A maintenance release with numerous operator-facing bug fixes and behavior corrections, alongside dependency and image updates. It also introduces a decoder-memory limit and fixes a CIDR policy bypass that could cause traffic drops after an agent restart.

Check if affected (1)

securityThe endpoint CIDR policy bypass, fixed
Applicability is not stated in the release notes.

Prometheusv3.14.0ObservabilityAug 18, 2026

ACTION 1CHECK 1PLAN 1OTHER 39View full analysis

A maintenance release with an API deprecation, operator-visible removals and default changes, new capabilities, performance improvements, and correctness fixes across discovery, PromQL, TSDB, and other components. No security advisories or explicitly described security vulnerabilities are included.

Action needed (1)

breakingDefault support for PromQL duration expressions
Duration expressions are enabled by default in PromQL. The promql-duration-expr feature flag is now a no-op.

Check if affected (1)

breakingThe __meta_hetzner_datacenter label, removed
Applies if you use hcloud targets.

Plan ahead (1)

deprecatedThe stats query parameter, deprecated for other valuesremoval date not announced
Applies if you set stats to a value other than true or all.

OpenTelemetryv0.159.0ObservabilityAug 17, 2026

CHECK 2OTHER 6View full analysis

A release that adds exporter queue batching controls, changes exporter and scraper metric behavior, and updates public API field shapes. Schema-based configuration migrations are also included, with no security advisories or security fixes disclosed.

Check if affected (2)

breakingThe confighttp.ServerConfig field shape in Config
Applies if you use extension/zpages.
breakingThe configauth.Config field shape in AuthConfig
Applies if you use configauth.Config.

Longhornv1.12.1Storage & DataAug 14, 2026

CHECK 6PLAN 1OTHER 46View full analysis

A release with breaking behavior for legacy V2 linked-clone volumes, a Kubernetes v1.25 minimum, and stronger default network controls, including expanded mTLS enforcement. It also adds V2 data engine capabilities and metrics while correcting defects across V2 operations, backups, expansion, and infrastructure.

Check if affected (6)

breakingInternal NetworkPolicy resources enabled by default
Applies if a NetworkPolicy provider is available in the cluster.
breakingCross-namespace Prometheus scraper access through the Longhorn Manager network policy
Applies if you use cross-namespace Prometheus scrapers.
breakingmTLS for all instance-manager gRPC services
Applies if you configure the longhorn-grpc-tls secret.
+ 3 more on the release page

Plan ahead (1)

deprecatedLegacy V2 linked-clone volumes deprecated
Applies if you use V2 linked-clone volumes created in v1.12.0 or earlier.

Contourv1.33.6Networking & MessagingAug 12, 2026

ACTION 1CHECK 1OTHER 3View full analysis

A maintenance release with a security fix for an external authorization bypass and dependency updates for CVE fixes. It also updates the tested Kubernetes range to 1.32 through 1.34, Go to 1.25.12, and Envoy to v1.38.3.

Action needed (1)

securityDependency updates for CVE fixes
Dependencies were updated to fix CVEs. The updates ship in Contour v1.33.6.

Check if affected (1)

securityExternal authorization bypass with disabled authPolicy
Applies if authPolicy is not configured.

containerdv2.2.7Kubernetes CoreAug 12, 2026

CHECK 3PLAN 1OTHER 5View full analysis

A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.

Check if affected (3)

breakingThe enable_experimental_restore_via_create default
Applies if you use CreateContainer.
breakingThe ScrubLogs default on Windows
Applies if you run on Windows.
breakingCheckpoint restore without CRIU
Applies if you do not have CRIU installed.

Plan ahead (1)

deprecatedRestore in CreateContainer, deprecated
Applies if you use CreateContainer.

containerdv2.3.4Kubernetes CoreAug 12, 2026

CHECK 3PLAN 1OTHER 11View full analysis

A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.

Check if affected (3)

breakingCheckpoint restore in CreateContainer disabled by default
Applies if you set enable_experimental_restore_via_create.
breakingruntimeFeatures.UserNamespacesHostNetwork enabled by default
Applies if you run CRI.
breakingLog scrubbing enabled by default on Windows
Applies if you run Windows.

Plan ahead (1)

deprecatedCheckpoint restore in CreateContainer deprecated
Applies if you use CreateContainer.

Argov3.3.14CI/CD & App DeliveryAug 12, 2026

ACTION 2CHECK 2OTHER 2View full analysis

A maintenance release with fixes for secret masking and pprof endpoint configuration, alongside dependency updates for two listed CVEs. The secret-handling fixes and dependency updates are addressed by upgrading, while the remaining defect fixes require no operator action.

Action needed (2)

securityhighThe /ui brace-expansion dependency update for CVE-2026-69152
The /ui dependency brace-expansion is updated to 2.1.4 and 1.1.18 for CVE-2026-69152.
securitymediumThe DOMPurify dependency update for CVE-2026-49978
The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.

Check if affected (2)

securitySSD CLI secret mask spoofing prevention
Applies if you use SSD CLI.
securitySecret hiding in the last-applied-configuration annotation
Applies if you configure last-applied-configuration.

Kubescapev4.0.12SecurityAug 12, 2026

ACTION 3CHECK 3OTHER 220View full analysis

A corrective and performance-focused release with operator-visible default and constraint changes, deprecated flag removal, and dependency vulnerability fixes. It also expands scanning, output, registry, and MCP capabilities.

Action needed (3)

securityBatch dependency vulnerability fixes
Batch 1 and 2 dependency vulnerability fixes are included in this release.
breakingRegoV1 evaluation and v0 compatibility shim removal
Rego evaluation now uses RegoV1 and drops the v0 compatibility shim in this release.
breakingLoopback-only constraint
A loopback-only constraint is applied in this release.

Check if affected (3)

breakingOpt-in pprof debug server
Applies if you enable the pprof debug server.
breaking--frameworks default set to all
Applies if you do not configure --frameworks.
breakingDeprecated flags removal
Applies if you configure deprecated flags.

Fluxv2.9.4CI/CD & App DeliveryAug 7, 2026

CHECK 3OTHER 8View full analysis

A maintenance release with correctness fixes that narrow some existing configuration constraints. It also adds CLI repository migration support and updates dependencies; no explicit security advisory or vulnerability is disclosed.

Check if affected (3)

breakingThe image-automation-controller refspec constraint
Applies if you configure refspecs.
breakingGCS static authentication limited to service account keys
Applies if you configure GCS static authentication.
breakingThe allow-webhooks network policy restriction
Applies if you configure allow-webhooks.

KServev0.20.0AI & MLAug 6, 2026

ACTION 2CHECK 7OTHER 48View full analysis

This release adds new inference-service, storage, runtime, routing, and deployment capabilities, alongside correctness fixes and dependency updates. Operators should review the Starlette security update, changed defaults, and narrower readiness behavior.

Action needed (2)

securitymediumstarlette dependency update for CVE-2026-48710
The starlette dependency is bumped to >=1.0.1 for CVE-2026-48710.
breakingStandard default alignment with the llm-d optimized baseline
The standard default is aligned with the llm-d optimized baseline.

Check if affected (7)

breakinglora-affinity-scorer default for LoRA adapters
Applies if you use LoRA adapters.
breakingLLMInferenceServiceConfig deletion-prevention finalizer
Applies if you use LLMInferenceServiceConfig.
breakingendpointPickerRef default EPP port
Applies if you configure endpointPickerRef and do not configure port.
+ 4 more on the release page

Keycloak26.7.1SecurityAug 5, 2026

CHECK 12OTHER 5View full analysis

A maintenance release with security fixes and additional bug fixes. The security fixes require upgrading, and the ordinary bug fixes require no operator action beyond upgrading.

Check if affected (12)

securityhighCVE-2026-15573 unnormalized URI matching in pathmatcher
Applies if you use pathmatcher.
securityhighCVE-2026-15572 DCR protocol mapper type-swap policy
Applies if you use DCR.
securityhighCVE-2026-16442 SAML broker login restriction
Applies if you use the SAML broker.
+ 9 more on the release page

OpenTelemetryv0.158.0ObservabilityAug 4, 2026

CHECK 1OTHER 9View full analysis

OpenTelemetry v0.158.0 adds a replacement processor and configuration-schema capabilities, along with changes to component maturity and several defect corrections. It also removes the pkg/xconfmap validation API in favor of symbols in confmap.

Check if affected (1)

breakingThe pkg/xconfmap validation symbols, renamed
Applies if you use pkg/xconfmap's Validator or Validate symbols.

Argov3.5.0CI/CD & App DeliveryAug 4, 2026

ACTION 3CHECK 1OTHER 286View full analysis

A maintenance release focused on operator-facing bug fixes, with additional feature and configuration work. It also includes dependency updates, including a UI dependency update for CVE-2026-41240.

Action needed (3)

securitymediumThe redoc/dompurify dependency update for CVE-2026-41240
The UI dependency redoc/dompurify is bumped to v3.4.0 to fix CVE-2026-41240.
securityThe formidable dependency update
The formidable dependency is updated to v2.1.3.
breakingThe auto-sync toggle removal from the app top bar
The auto-sync toggle is removed from the app top bar.

Check if affected (1)

breakingThe theme default changed to auto
Applies if theme is not configured.

Browse by month