RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
containerdv2.2.7Kubernetes CoreAug 12, 2026
CHECK 3PLAN 1OTHER 5View full analysis

A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.

Check if affected (3)

  • breakingThe enable_experimental_restore_via_create default

    Applies if you use CreateContainer.

  • breakingThe ScrubLogs default on Windows

    Applies if you run on Windows.

  • breakingCheckpoint restore without CRIU

    Applies if you do not have CRIU installed.

Plan ahead (1)

  • deprecatedRestore in CreateContainer, deprecated

    Applies if you use CreateContainer.

Source ↗
containerdv2.3.4Kubernetes CoreAug 12, 2026
CHECK 3PLAN 1OTHER 11View full analysis

A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.

Check if affected (3)

  • breakingCheckpoint restore in CreateContainer disabled by default

    Applies if you set enable_experimental_restore_via_create.

  • breakingruntimeFeatures.UserNamespacesHostNetwork enabled by default

    Applies if you run CRI.

  • breakingLog scrubbing enabled by default on Windows

    Applies if you run Windows.

Plan ahead (1)

  • deprecatedCheckpoint restore in CreateContainer deprecated

    Applies if you use CreateContainer.

Source ↗
Kubernetesv1.34.10Kubernetes CoreJul 22, 2026
PLAN 1OTHER 7View full analysis

A maintenance release with kubeadm and kubelet behavior corrections, a changed kubeadm timeout default, and a deferred Kubelet deprecation removal. It also includes a toolchain dependency update and no identified security advisories.

Plan ahead (1)

  • deprecatedKubelet configurations flags deprecation removal timelineremoval planned in 1.38

    Applies if you configure Kubelet's configurations flags.

Source ↗
etcdv3.4.45Kubernetes CoreJun 1, 2026
PLAN 1OTHER 1View full analysis

A maintenance release that ends support for the v3.4 line and updates the Go toolchain used to compile binaries. No further patches will be issued for v3.4.

Plan ahead (1)

  • deprecatedThe v3.4 line, end of support

Source ↗
Limav2.1.2Kubernetes CoreJun 1, 2026
CHECK 1PLAN 1OTHER 34View full analysis

A feature and maintenance release with CLI and template changes, QEMU behavior updates, and fixes across drivers, hostagent, shell, and guest support. It also includes a deprecation, while no security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

  • breakingQEMU 2MB OVMF images dropped by openSUSE

    Applicability is not stated in the release notes.

Plan ahead (1)

  • deprecatedThe _LIMA_QEMU_UEFI_IN_BIOS flag, deprecated

    Applies if you configure _LIMA_QEMU_UEFI_IN_BIOS.

Source ↗
containerdv2.3.1Kubernetes CoreMay 20, 2026
ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

  • securityhighCVE-2026-46680 correction

    The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

  • breakingThe overlayfs "rebase" capability, disabled in user namespaces

    Applies if you use overlayfs and run in a user namespace.

Plan ahead (1)

  • deprecatedTask fields in Runc options, deprecated

    Applies if you configure task fields in Runc options.

Source ↗
Helmv4.2.0Kubernetes CoreMay 14, 2026
ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

  • securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394

    Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

  • securityPlugin version path traversal fix

    Applies if you use the Plugin extension.

Plan ahead (1)

  • deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated

    Applies if you use --hide-notes or --render-subchart-notes.

Source ↗
containerdv2.3.0Kubernetes CoreApr 30, 2026
ACTION 1PLAN 1OTHER 41View full analysis

A substantial operator-facing release with new capabilities, behavior changes, a compatibility constraint, and a deprecation. It is the first annual LTS release under a Kubernetes-aligned cadence, with support planned for at least two years.

Action needed (1)

  • breakingPlugin names disallow commas

    OCI hook adjustments accumulate owners, and commas are disallowed in plugin names in this release.

Plan ahead (1)

  • deprecatedThe shim.Command API, deprecated

    Applies if you use shim.Command.

Source ↗
Kubernetesv1.36.0Kubernetes CoreApr 22, 2026
ACTION 11CHECK 25PLAN 6OTHER 293View full analysis

A broad operator-significant release with API, configuration, CLI default, scheduling, runtime, feature-gate, metric, and dependency changes. Upgrade review and testing matter for users of removed or deprecated interfaces, changed defaults, custom scheduler integrations, CRDs, audit logging, and affected metrics.

Action needed (11)

  • breakingStrictIPCIDRValidation enabled by default

    The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.

  • breakingThe default debug profile, changed to general

    The default debug profile changes from legacy to general.

  • breakingWatchCacheInitializationPostStartHook enabled by default

    The WatchCacheInitializationPostStartHook feature gate is enabled by default.

  • breakingKubeletPSI graduation to GA

    The KubeletPSI feature graduated to GA and is enabled by default.

  • breakingRelaxedServiceNameValidation at beta, enabled by default

    The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.

  • breakingRestartAllContainersOnContainerExits at beta, enabled by default

    The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.

  • breakingSuspended-job feature gates enabled by default

    The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.

  • breakingAtomicFIFO informer store updates

    Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.

  • breakingUnlockWhileProcessing informer behavior

    Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.

  • breakingClientsAllowCARotation functionality enabled by default

    This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.

  • breakingClientsAllowTLSCacheGC functionality enabled by default

    This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.

Check if affected (25)

  • breakingThe volume_operation_total_errors metric, renamed

    Applies if you use volume_operation_total_errors.

  • breakingThe git-repo volume plugin, disabled

    Applies if you use the git-repo volume plugin.

  • breakingAllowlistEntry.Name, renamed to AllowlistEntry.Command

    Applies if you configure AllowlistEntry.Name.

  • + 22 more on the release page

Plan ahead (6)

  • deprecatedService .spec.externalIPs deprecation

    Applies if you configure Service .spec.externalIPs.

  • deprecatedDirect access to metav1.FieldsV1.Raw, deprecated

    Applies if you use metav1.FieldsV1.Raw.

  • deprecatedMinNodeScore and MaxNodeScore, deprecated

    Applies if you use MinNodeScore or MaxNodeScore.

  • + 3 more on the release page
Source ↗
etcdv3.6.8Kubernetes CoreFeb 13, 2026
ACTION 2PLAN 1OTHER 1View full analysis

A maintenance release postpones removal of one flag and reverses another flag's deprecation. It also includes dependency and toolchain updates addressing named security advisories.

Action needed (2)

Plan ahead (1)

  • deprecatedThe --max-snapshots flag, removal postponedremoval planned in v3.8

    Applies if you use --max-snapshots.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023