Releases — RATATOSK

Kyvernov1.19.0SecurityAug 20, 2026

ACTION 7CHECK 6PLAN 1OTHER 160View full analysis

A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.

Action needed (7)

securityhighIntermediate certificate limits
Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.
securityhighGo toolchain 1.26.3
The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.
securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9
CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.
securityUpdated golang.org/x/crypto and x/net dependencies
The golang.org/x/crypto dependency was updated to v0.53.0 and x/net to v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.
securityPatched ORAS and sigstore vulnerabilities
The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.
securityCodeQL vulnerability fixes
Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.
securitycel-go v0.30.0
cel-go was updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.

Check if affected (6)

breakingRequired --resource for the migrate command
Applies when the migrate command runs.
The migrate command now requires --resource. This constraint ships in Kyverno v1.19.0.
breakingDefault userInfo groups and UID during background scans
Applies when background scans run.
Background scans now default userInfo groups and UID for admission policies. The corrected defaults ship in Kyverno v1.19.0.
breakingexcludeBootstrapResources webhook flag
Applies when you configure Fail webhooks.
The webhook configuration adds the excludeBootstrapResources flag, which skips Node and CSR resources on Fail webhooks. The flag ships in Kyverno v1.19.0.
+ 3 more on the release page

Plan ahead (1)

deprecatedDeprecation notices for legacy kyverno.io policy types
Applies when you use legacy kyverno.io policy types.
Deprecation of legacy kyverno.io policy types is surfaced through warnings, a Helm notice, and the PSS default. This deprecation notice ships in Kyverno v1.19.0.

Source ↗