RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Crossplanev2.4.0Orchestration & ManagementAug 20, 2026
ACTION 15CHECK 4PLAN 1OTHER 33View full analysis

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

  • securityGo version and dependency security updates

    Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.

  • securityGo 1.25.10

    Go was updated to 1.25.10 to fix standard library CVEs.

  • securitygolang.org/x/crypto v0.52.0

    The golang.org/x/crypto module was updated to v0.52.0 for security fixes.

  • securitygolang.org/x/sys v0.44.0

    The golang.org/x/sys module was updated to v0.44.0 for security fixes.

  • securitygolang.org/x/net v0.55.0

    The golang.org/x/net module was updated to v0.55.0 for security fixes.

  • securitygithub.com/sigstore/cosign/v3 v3.0.6

    The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.

  • securitygithub.com/sigstore/rekor v1.5.2

    The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.

  • securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0

    The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.

  • securitygithub.com/sigstore/sigstore-go v1.2.0

    The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.

  • securityCombined grpc, x/net, and x/text security updates

    Combined security updates were applied to grpc, x/net, and x/text.

  • securitygolang.org/x/net v0.56.0

    The golang.org/x/net module was updated to v0.56.0 for security fixes.

  • securitygolang.org/x/text v0.39.0

    The golang.org/x/text module was updated to v0.39.0 for security fixes.

  • securityVulnerable dependency updates

    Vulnerable dependencies were updated for security fixes.

  • securitygithub.com/sigstore/sigstore-go v1.2.1

    The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.

  • securitygolang.org/x/mod v0.40.0

    The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

  • breakingCrossplane CLI publication location and binary name

    Applies if you use the Crossplane CLI.

  • breakingspec.replicas behavior in DeploymentRuntimeConfig

    Applies if DeploymentRuntimeConfig configures spec.replicas.

  • breakingNarrowed composed resource garbage collection

    Applicability is not stated in the release notes.

  • + 1 more on the release page

Plan ahead (1)

  • deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)

    Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.

Source ↗
Karmadav1.18.2Orchestration & ManagementJul 31, 2026
ACTION 2CHECK 8PLAN 4OTHER 65View full analysis

A broad operator-impacting maintenance release with security-related base image updates, API and configuration changes, scheduling capabilities, and deprecations and removals. Operators should review changed defaults and constraints and account for migration work affecting their configurations, APIs, and metrics.

Action needed (2)

  • securityThe alpine base image update

    The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns.

  • securityThe alpine base image update

    The alpine base image is updated from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (8)

  • breakingThe cluster lease duration flags, removed

    Applies if you configure either --cluster-lease-duration or --cluster-lease-renew-interval-fraction.

  • breakingThe Estimator metric label value, removed

    Applies if you use either estimating_plugin_execution_duration_seconds or estimating_plugin_extension_point_duration_seconds.

  • breakingThe Etcd.Local.InitImage configuration field, removed

    Applies if you configure Etcd.Local.InitImage.

  • + 5 more on the release page

Plan ahead (4)

  • deprecatedThe ReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0

    Applies if you use ReplicaRequirements.resourceRequest.

  • deprecatedThe ComponentReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0

    Applies if you use ComponentReplicaRequirements.resourceRequest.

  • deprecatedThe NodeClaim.nodeAffinity field deprecationdeprecated since v1.18.0

    Applies if you use NodeClaim.nodeAffinity.

  • + 1 more on the release page
Source ↗
Karmadav1.17.5Orchestration & ManagementJul 31, 2026
ACTION 1CHECK 4PLAN 2OTHER 82View full analysis

A mixed maintenance and feature release with workload-affinity and anti-affinity support, encryption-at-rest capabilities, bug fixes, and updates to dependencies and default images. It also changes operational defaults and validation while deprecating or removing configuration flags and fields, so compatibility and configuration changes are part of the release.

Action needed (1)

  • breakingControllerPriorityQueue promotion to beta and default enablement

    ControllerPriorityQueue is promoted to beta and enabled by default.

Check if affected (4)

  • breakingThe --etcd-init-image flag, removed from karmadactl init

    Applies if you use the --etcd-init-image flag.

  • breakingnamespace validation for spec.resourceSelectors

    Applies if you use PropagationPolicy or OverridePolicy.

  • breakingDistinct GroupByLabelKey values in WorkloadAffinity

    Applies if you configure WorkloadAffinity.

  • + 1 more on the release page

Plan ahead (2)

  • deprecatedEtcd.Local.InitImage deprecationdeprecated since v1.17.0 · removal date not announced

    Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.

  • deprecatedDeprecation of cluster lease flagsdeprecated since v1.17.0 · removal date not announced

    Applies if you use --cluster-lease-duration or --cluster-lease-renew-interval-fraction.

Source ↗
Karmadav1.16.8Orchestration & ManagementJul 31, 2026
ACTION 1CHECK 4PLAN 2OTHER 104View full analysis

A mixed maintenance and feature release with bug fixes, new APIs and capabilities, performance and instrumentation improvements, dependency updates, and deprecated field removals. Operators should review the removed fields and the updated dependency, while the release also adds multi-component scheduling, configurable initialization, eviction queue support, and new workload interpreters.

Action needed (1)

  • securitymediumThe github.com/vektra/mockery dependency update

    The github.com/vektra/mockery dependency was bumped to v3.5.5 to address security concerns identified by GO-2025-3900.

Check if affected (4)

  • breakingThe external etcd fields CAData, CertData, and KeyData, removed

    Applies if you configure CAData, CertData, or KeyData.

  • breakingThe init command's default component images

    Applies if you run the init command.

  • breakingA 32s default timeout for the member cluster client

    Applies if you use the member cluster client.

  • + 1 more on the release page

Plan ahead (2)

  • deprecatedThe --etcd-init-image flag, deprecatedremoval date not announced

    Applies if you use --etcd-init-image.

  • breakingThe Prometheus metric labels cluster and cluster_name, replaced by member_clusterremoval planned in 1.18

    Applies if you use the cluster or cluster_name metric labels.

Source ↗
KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026
ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

  • securitycriticalThe grpc dependency, updated

    grpc is updated to 1.79.3 to remediate CVE-2026-33186.

  • securityhighThe github.com/moby/spdystream dependency, updated

    The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

  • breakingStricter network interface binding admission

    Applies if you configure network interface bindings.

  • breakingThe Template feature gate, enabled by default

    Applies if you enable the Template feature gate.

  • breakingThe ephemeral hotplug volume metric and alert, removed

    Applies if you use the ephemeral hotplug volume metric.

  • + 6 more on the release page

Plan ahead (2)

  • deprecatedcgroup v1 support, deprecatedremoval date not announced

    Applies if you run with cgroup v1 support.

  • deprecatedLegacy VM creation recording rules and metrics, deprecated

    Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗
Daprv1.18.0Orchestration & ManagementJun 10, 2026
ACTION 8CHECK 6PLAN 1OTHER 108View full analysis

A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.

Action needed (8)

  • securitymediumThe golang.org/x/image dependency update for GO-2026-4962

    golang.org/x/image is updated to v0.39.0 for GO-2026-4962.

  • securityThe durabletask-go and pgx dependency updates

    durabletask-go is updated to v0.12.1, and pgx is updated as part of the vulnerability fixes.

  • breakingThe WorkflowsRemoteActivityReminder default, enabled

    WorkflowsRemoteActivityReminder is enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.

  • breakingThe HotReload default, enabled

    HotReload is enabled by default for Components, Subscriptions, MCPServers, Configurations, HTTPEndpoints, Resiliencies, and WorkflowAccessPolicies.

  • breakingSidecar probe defaults

    Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.

  • breakingThe HotReload default, enabled in v1.18

    HotReload is enabled by default in v1.18.

  • breakingLiveness and readiness probe defaults

    The default liveness probe is widened, and the readiness probe default is tightened.

  • breakingChanged sidecar probe defaults

    Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for daprd.

Check if affected (6)

  • securityService invocation path traversal ACL bypass fix

    Applies if you use service invocation.

  • breakingThe MCPServerResource and WorkflowAccessPolicy feature gates, removed

    Applies if you configure the MCPServerResource or WorkflowAccessPolicy feature gates.

  • breakingThe Sentry Ed25519 workload identity key rollback constraint

    Applicability is not stated in the release notes.

  • + 3 more on the release page

Plan ahead (1)

  • deprecatedThe ScheduleJobAlpha1 alpha RPCs, deprecated

    Applies if you use ScheduleJobAlpha1.

Source ↗
KubeVirtv1.8.3Orchestration & ManagementJun 3, 2026
ACTION 2PLAN 1OTHER 13View full analysis

A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc update to 1.79.3

    The google.golang.org/grpc dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.

  • securitySymlink traversal fix in the VMExport directory handler

    The VMExport directory handler is fixed to prevent symlink traversal.

Plan ahead (1)

  • deprecatedDeprecated kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total recording rules

    Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗
KEDAv2.20.0Orchestration & ManagementJun 1, 2026
CHECK 7PLAN 1OTHER 70View full analysis

This release adds scalers, configuration options, metrics, authentication modes, and compatibility improvements. Operators with custom RBAC need to account for the Kubernetes events API migration, and users of removed scaler settings need to update their configurations.

Check if affected (7)

  • securityCredential headers on cross-host redirects and HTTPS downgrades

    Applicability is not stated in the release notes.

  • breakingScaledObject name length validation

    Applies when a ScaledObject name exceeds 63 characters.

  • breakingPositive unprocessedEventThreshold values

    Applies if you configure a non-positive unprocessedEventThreshold.

  • + 4 more on the release page

Plan ahead (1)

  • deprecatedThe buildId, selectAllActive, and selectUnversioned settings, deprecated

    Applies if you configure buildId, selectAllActive, or selectUnversioned.

Source ↗
wasmCloudv2.0.3Orchestration & ManagementApr 14, 2026
ACTION 1CHECK 1PLAN 1OTHER 10View full analysis

This release adds Kubernetes-native service routing and related CRD fields, changes Helm behavior, fixes a NATS subscriber initialization race, and retires the runtime-gateway path. Operators using the deprecated gateway configuration need to account for the routing change and removed chart behavior.

Action needed (1)

  • breakingThe default chart tag is removed

    The default tag is removed, so the chart uses chart.yaml's appVersion.

Check if affected (1)

  • breakingNative Kubernetes Service routing replaces runtime-gateway

    Applies if you use runtime-gateway.

Plan ahead (1)

  • deprecatedThe Helm gateway section is deprecated

    Applies if you configure gateway.

Source ↗
KubeVirtv1.8.0Orchestration & ManagementMar 24, 2026
CHECK 7PLAN 4OTHER 98View full analysis

A broad operator-facing feature and maintenance release with API and behavior changes, dependency updates, deprecations, and removals. Monitoring and configuration changes include recording-rule and feature-gate updates, alongside scheduling and security-related behavior changes; no security advisories are reported.

Check if affected (7)

  • breakingNetwork attachment definition get permissions in the virt-controller ClusterRole, removed

    Applicability is not stated in the release notes.

  • breakingStop requests for paused VMIs, rejected

    Applies if you run paused VMIs.

  • breakingThe EnableVirtioFsConfigVolumes feature, graduated to GA

    Applies if you use the EnableVirtioFsConfigVolumes feature gate.

  • + 4 more on the release page

Plan ahead (4)

  • deprecatedThe DisableMDEVConfiguration feature gate, deprecatedremoval date not announced

    Applies if you use the DisableMDEVConfiguration feature gate.

  • deprecatedThe kubevirt_vmi_migration_data_total_bytes metric, deprecated

    Applies if you use the kubevirt_vmi_migration_data_total_bytes metric.

  • deprecatedThe MultiArchitecture feature gate, deprecated

    Applies if you use the MultiArchitecture feature gate.

  • + 1 more on the release page
Source ↗
Karmadav1.17.0Orchestration & ManagementFeb 28, 2026
CHECK 4PLAN 3OTHER 34View full analysis

A feature and maintenance release adds workload affinity and anti-affinity scheduling, operator and API capabilities, and Helm encryption at rest. It also includes controller and scheduler fixes, dependency and image updates, and deprecations and removals.

Check if affected (4)

  • breakingnamespace validation for spec.resourceSelectors

    Applies if you use PropagationPolicy or OverridePolicy.

  • breakingStricter GroupByLabelKey validation in WorkloadAffinity

    Applies if you configure GroupByLabelKey in WorkloadAffinity.

  • breakingUpdated default Kubernetes and ETCD images

    Applicability is not stated in the release notes.

  • + 1 more on the release page

Plan ahead (3)

  • deprecatedThe --cluster-lease-duration flag, deprecatedremoval date not announced

    Applies if you use --cluster-lease-duration.

  • deprecatedThe --cluster-lease-renew-interval-fraction flag, deprecatedremoval date not announced

    Applies if you use --cluster-lease-renew-interval-fraction.

  • deprecatedEtcd.Local.InitImage in Karmada Init Configuration, deprecatedremoval date not announced

    Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.

Source ↗
Daprv1.17.0Orchestration & ManagementFeb 27, 2026
ACTION 9CHECK 3PLAN 2OTHER 151View full analysis

A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.

Action needed (9)

  • securityGo cryptography dependency updates

    The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.

  • securityGo vulnerability fix

    A vulnerability in Go is fixed.

  • securityRoot-only UID check

    The UID check now checks only the root UID.

  • securityHTTP path matching and invocation auto-registration

    HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.

  • securityThe golang.org/x/crypto dependency, updated

    The golang.org/x/crypto dependency is bumped.

  • securityThe github.com/docker/docker dependency, updated

    The github.com/docker/docker dependency is bumped.

  • securitySecurity fixes

    Security fixes ship in the release.

  • securityThe github.com/coreos/go-oidc/v3 dependency, updated

    The github.com/coreos/go-oidc/v3 dependency is bumped.

  • securityNATS vulnerability fix

    A vulnerability in NATS is fixed.

Check if affected (3)

  • securityPlacement authorization for Dapr actor types

    Applies if you use Placement.

  • securityCloudflare worker vulnerability fix

    Applies if you use the Cloudflare worker.

  • breakingScheduler resources removed from the Helm chart

    Applies if you use the Helm chart.

Plan ahead (2)

  • deprecatedAlpha Bulk PubSub APIs and app callback deprecation

    Applies if you use /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.

  • deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated

    Applies if you use OnBulkTopicEventAlpha1.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023