RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Kyvernov1.19.0SecurityAug 20, 2026
ACTION 7CHECK 6PLAN 1OTHER 160View full analysis

A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.

Action needed (7)

  • securityhighIntermediate certificate limits

    Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.

  • securityhighGo toolchain 1.26.3

    The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.

  • securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9

    CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.

  • securityUpdated golang.org/x/crypto and x/net dependencies

    The golang.org/x/crypto dependency was updated to v0.53.0 and x/net to v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.

  • securityPatched ORAS and sigstore vulnerabilities

    The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.

  • securityCodeQL vulnerability fixes

    Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.

  • securitycel-go v0.30.0

    cel-go was updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.

Check if affected (6)

  • breakingRequired --resource for the migrate command

    Applies when the migrate command runs.

  • breakingDefault userInfo groups and UID during background scans

    Applies when background scans run.

  • breakingexcludeBootstrapResources webhook flag

    Applies when you configure Fail webhooks.

  • + 3 more on the release page

Plan ahead (1)

  • deprecatedDeprecation notices for legacy kyverno.io policy types

    Applies when you use legacy kyverno.io policy types.

Source ↗
Keycloak26.7.0SecurityJul 9, 2026
ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

  • securityPre-account takeover attack exposure

    The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

Plan ahead (4)

  • deprecatedThe V1 API, deprecated

    Applies if you use V1.

  • deprecatedThe Require Discoverable Credential option, deprecated

    Applies if you configure the Require Discoverable Credential option.

  • deprecatedThe Twitter IDP implementation, deprecated

    Applies if you use the Twitter IDP implementation.

  • + 1 more on the release page
Source ↗
cert-managerv1.21.0SecurityJul 8, 2026
CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

  • securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258

    Applies if you use the cert-manager-edit aggregate ClusterRole.

  • breakingObjectReference API removal

    Applies if you use ObjectReference in an API.

  • breakingPrometheus ServiceMonitor and PodMonitor Helm value removal

    Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.

  • + 2 more on the release page

Plan ahead (2)

  • deprecatedGateway API controller configuration fields

    Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.

  • deprecatedServerSideApply feature gate deprecation

Source ↗
Confidential Containersv0.21.0SecurityMay 29, 2026
ACTION 1PLAN 4OTHER 16View full analysis

A release with Trustee, KBS, attestation, and platform-support changes, plus a security advisory fix. It also deprecates several CAA components and images planned for removal in 0.22.

Action needed (1)

  • securityGHSA-84rc-2q4r-45pc advisory fix

    The release patches GHSA-84rc-2q4r-45pc in the guest components.

Plan ahead (4)

  • deprecatedpacker-built CAA podvm image deprecationdeprecated since 0.17 · removal planned in 0.22

    Applies if you use the packer-built CAA podvm image.

  • deprecatedCAA docker provider deprecationdeprecated since 0.20 · removal planned in 0.22

    Applies if you use the CAA docker provider.

  • deprecatedFedora-based mkosi-built CAA podvm image deprecationdeprecated since 0.20 · removal planned in 0.22

    Applies if you use the Fedora-based mkosi-built CAA podvm image.

  • + 1 more on the release page
Source ↗
The Update Framework (TUF)v7.0.0SecurityMay 18, 2026
ACTION 1CHECK 1PLAN 1View full analysis

A release focused on a security fix and API evolution. It tightens the Updater() contract and begins preparation for removal of an existing module.

Action needed (1)

Check if affected (1)

  • breakingThe Updater() bootstrap argument, now required

    Applies if you use Updater().

Plan ahead (1)

  • deprecatedPreparation for removal of securesystemslib.hash

    Applies if you use securesystemslib.hash.

Source ↗
Confidential Containersv0.20.0SecurityMay 5, 2026
ACTION 1PLAN 3OTHER 12View full analysis

Confidential Containers v0.20.0 combines operator-visible capability and compatibility updates with deprecations of several image and provider paths. It also includes a security fix identified by GHSA-q49m-57vm-c8cc.

Action needed (1)

  • securityhighGHSA-q49m-57vm-c8cc security fix

    The release includes a fix for the security issue identified by GHSA-q49m-57vm-c8cc.

Plan ahead (3)

  • deprecatedThe Docker CAA provider, deprecatedremoval date not announced

    Applies if you use the Docker CAA provider.

  • breakingThe Fedora-based mkosi CAA podvm image, deprecatedremoval date not announced

    Applies if you use the Fedora-based mkosi CAA podvm image.

  • deprecatedSupport for packer images, deprecatedremoval date not announced

    Applies if you use packer images.

Source ↗
Keycloak26.6.0SecurityApr 8, 2026
ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

  • securitySeparate password and OTP brute force protection

    Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.

  • securityResourceAdminManager URL construction validation

    URL construction in ResourceAdminManager is validated against matrix parameter injection.

  • securityClient retrieval anti-ID phishing check

    Client retrieval now includes the missing anti-ID phishing check.

  • breakingZero-downtime patch releases enabled by default

    Zero-downtime patch releases are now promoted to supported and enabled by default.

  • breaking--truststore-kubernetes-enabled enabled by default

    The behavior controlled by --truststore-kubernetes-enabled is enabled by default.

  • breakingTen-second default not-before validation

    The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

  • securityWorkflows admin permission boundaries

    Applies if you use Workflows.

  • securityOrganizations login IdP alias disclosure

    Applies if you use Organizations.

  • securitySCIM PUT body ID override protection

    Applies if you use SCIM.

  • + 4 more on the release page

Plan ahead (1)

  • deprecatedToken Exchange v1 deprecation

    Applies if you use Token Exchange v1.

Source ↗
OpenFGAv1.14.0SecurityApr 3, 2026
ACTION 1CHECK 1PLAN 2OTHER 5View full analysis

This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.

Action needed (1)

  • securitymediumBatchCheck policy enforcement fix for CVE-2026-34972

    The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

  • breakingPlayground authentication limited to none

    Applies if the Playground runs with preshared key authentication.

Plan ahead (2)

  • deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced

    Applies if you use the built-in OpenFGA Playground.

  • deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation

    Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.

Source ↗
Confidential Containersv0.19.0SecurityMar 30, 2026
CHECK 5PLAN 1OTHER 10View full analysis

A release that narrows supported environments and installation paths while adding storage, attestation, GPU, API, signature, and image-handling capabilities. It also updates guest and image handling, including sealed-secret signatures, cosign signatures with newlines, in-memory LUKS headers, and improved Vault/OpenBao support.

Check if affected (5)

  • breakingGo support in CDH removed

    Applies if you use CDH.

  • breakingCanonical TDX Tech preview support removed

    Applies if you use Canonical TDX Tech preview.

  • breakingUbuntu version requirement

    Applies if you use Ubuntu 24.04.4 (linux-image-generic-hwe-24.04) or 25.10.

  • + 2 more on the release page

Plan ahead (1)

  • deprecatedpacker images support, planned for removalremoval date not announced

    Applies if you use packer images.

Source ↗
Falco0.43.0SecurityJan 28, 2026
CHECK 2PLAN 4OTHER 16View full analysis

A maintenance release that removes source-config-path output from release builds, deprecates several userspace interfaces, and rotates the package-signing key. It also includes correctness fixes, dependency updates, and an image-size reduction.

Check if affected (2)

  • breakingSource config path output in release builds

    Applies if you use debug builds.

  • breakingGPG signing key for DEB/RPM packages, rotated

    Applies if you use DEB/RPM packages.

Plan ahead (4)

  • deprecatedThe --gvisor-generate-config CLI option, deprecated

    Applies if you use --gvisor-generate-config.

  • deprecatedThe legacy eBPF probe, deprecated

    Applies if you use the legacy eBPF probe.

  • deprecatedThe gVisor engine, deprecated

    Applies if you use the gVisor engine.

  • + 1 more on the release page
Source ↗
Confidential Containersv0.18.0SecurityJan 23, 2026
CHECK 2PLAN 2OTHER 17View full analysis

A release that removes or deprecates several operator-facing components while adding capabilities and changing supported formats and behavior. It also updates shipped platform components, including Trustee, image-rs, guest kernels, and OVMF.

Check if affected (2)

  • breakingProcess-based confidential computing via enclave-cc, removed

    Applies if you use enclave-cc.

  • breakingExperimental Secure Comms mode, removed from the Cloud API Adaptor

    Applies if you configure Secure Comms mode.

Plan ahead (2)

  • breakingThe CoCo operator, deprecated, with Helm chart installation

    Applies if you use the CoCo operator.

  • deprecatedpacker guest images, deprecated in favor of mkosiremoval date not announced

    Applies if you use packer images.

Source ↗
Keycloak26.5.0SecurityJan 6, 2026
CHECK 2PLAN 1OTHER 247View full analysis

A substantial feature and maintenance release adds operator capabilities including workflows, JWT authorization grants, organization invitations, OpenTelemetry export, and Windows services. It also updates Quarkus and fixes correctness issues, while changing supported database versions and addressing a vulnerability in brute force detection settings.

Check if affected (2)

  • securityBrute force detection settings vulnerability, corrected

    Applies if you configure brute force detection settings.

  • breakingPostgreSQL 13.x support removal

    Applies if you depend on PostgreSQL 13.x.

Plan ahead (1)

  • deprecatedFine-Grained Admin Permissions v1, deprecated

    Applies if you enable admin/fine-grained-permissions.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023