Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

May 2026Clear ×

Confidential Containersv0.21.0SecurityMay 29, 2026

ACTION 1PLAN 4OTHER 16View full analysis

A release with Trustee, KBS, attestation, and platform-support changes, plus a security advisory fix. It also deprecates several CAA components and images planned for removal in 0.22.

Action needed (1)

securityGHSA-84rc-2q4r-45pc advisory fix
The release patches GHSA-84rc-2q4r-45pc in the guest components.

Plan ahead (4)

deprecatedpacker-built CAA podvm image deprecationdeprecated since 0.17 · removal planned in 0.22
Applies if you use the packer-built CAA podvm image.
deprecatedCAA docker provider deprecationdeprecated since 0.20 · removal planned in 0.22
Applies if you use the CAA docker provider.
deprecatedFedora-based mkosi-built CAA podvm image deprecationdeprecated since 0.20 · removal planned in 0.22
Applies if you use the Fedora-based mkosi-built CAA podvm image.
+ 1 more on the release page

Source ↗

containerdv2.3.1Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

securityhighCVE-2026-46680 correction
The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

breakingThe overlayfs "rebase" capability, disabled in user namespaces
Applies if you use overlayfs and run in a user namespace.

Plan ahead (1)

deprecatedTask fields in Runc options, deprecated
Applies if you configure task fields in Runc options.

Source ↗

Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026

ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

securityModule Federation packages at v2.3.3
Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
+ 6 more on the release page

Plan ahead (4)

deprecatedThe PolicyQueryUser.identity field, deprecated
Applies if you use PolicyQueryUser.identity.
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated
Applies if you configure catalog.stitchingStrategy.mode.
+ 1 more on the release page

Source ↗

OpenTelemetryv0.152.1ObservabilityMay 19, 2026

CHECK 2PLAN 1OTHER 7View full analysis

A maintenance release that adds exporter in-flight request monitoring and configuration-validation APIs while correcting runtime and configuration behavior. It also changes Prometheus telemetry defaults for explicitly configured metrics and deprecates older validation APIs.

Check if affected (2)

breakingThe max_request_body_size limit for snappy requests
Applies if you configure max_request_body_size.
breakingPrometheus exporter defaults for explicitly configured telemetry
Applies if you configure the telemetry metrics section.

Plan ahead (1)

deprecatedThe xconfmap.Validator and confmap.Validate APIs
Applies if you use xconfmap.Validator or confmap.Validate.

Source ↗

The Update Framework (TUF)v7.0.0SecurityMay 18, 2026

ACTION 1CHECK 1PLAN 1View full analysis

A release focused on a security fix and API evolution. It tightens the Updater() contract and begins preparation for removal of an existing module.

Action needed (1)

securitymediumGHSA-qp9x-wp8f-qgjj fixed
The release fixes GHSA-qp9x-wp8f-qgjj.

Check if affected (1)

breakingThe Updater() bootstrap argument, now required
Applies if you use Updater().

Plan ahead (1)

deprecatedPreparation for removal of securesystemslib.hash
Applies if you use securesystemslib.hash.

Source ↗

Helmv4.2.0Kubernetes CoreMay 14, 2026

ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394
Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

securityPlugin version path traversal fix
Applies if you use the Plugin extension.

Plan ahead (1)

deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated
Applies if you use --hide-notes or --render-subchart-notes.

Source ↗

Argov3.2.12CI/CD & App DeliveryMay 13, 2026

PLAN 1OTHER 2View full analysis

A maintenance release that closes the 3.2 series and marks it as end of life. It also contains an operator-visible bug fix and a dependency update.

Plan ahead (1)

deprecatedThe 3.2 release series reaches end of life
Applies if you use the 3.2 release series.

Source ↗

OpenTelemetryv0.152.0ObservabilityMay 11, 2026

PLAN 1OTHER 10View full analysis

OpenTelemetry v0.152.0 adds exporter observability and configuration/API capabilities while correcting bugs in request handling, telemetry, and value formatting. It also deprecates older configuration validation APIs in favor of the confmap APIs.

Plan ahead (1)

deprecatedThe xconfmap.Validator and confmap.Validate APIs, deprecated
Applies if you use xconfmap.Validator or the deprecated confmap.Validate API for configuration validation.

Source ↗

metal3-iov0.13.0Provisioning & RuntimeMay 8, 2026

ACTION 1CHECK 3PLAN 1OTHER 40View full analysis

This release removes the iRMC driver and legacy vbmctl entrypoint, deprecates BMH.Spec.Firmware, and changes defaults and constraints. It also adds HostClaim and vbmctl capabilities, corrects bugs, and updates dependencies.

Action needed (1)

breakingManager TLS default set to unset
The manager TLS default is set back to unset in this release.

Check if affected (3)

breakingThe iRMC driver, removed
Applies if you use the iRMC driver.
breakingPreprovisioningImage required for deprovisioning
Applies if cleaning is enabled.
breakingThe legacy vbmctl entrypoint, removed
Applies if you use the legacy vbmctl entrypoint.

Plan ahead (1)

deprecatedThe BMH.Spec.Firmware field, deprecated
Applies if you configure BMH.Spec.Firmware.

Source ↗

OpenYurtv1.7.0Provisioning & RuntimeMay 6, 2026

CHECK 4PLAN 2OTHER 38View full analysis

A feature and maintenance release adds OTA image preheating, K8s-on-K8s deployment, declarative YurtHub conversion, and new hub and YurtHub capabilities. It also removes or deprecates legacy components and fixes multiple defects, with no security advisories identified.

Check if affected (4)

breakingThe YurtAppOverrider removal
Applies if you use YurtAppOverrider.
breakingThe yurt-coordinator removal from Helm charts
Applies if you use both yurt-coordinator and Helm charts.
breakingThe yurt-coordinator-cert controller removal from yurt-manager
Applies if you use both yurt-coordinator-cert controller and yurt-manager.
+ 1 more on the release page

Plan ahead (2)

deprecatedThe yurtmanager delegate lease controller, deprecated
Applies if you use yurtmanager delegate lease controller.
deprecatedThe YurtAppDaemon controller and YurtAppDaemon webhook, deprecated
Applies if you use YurtAppDaemon controller or YurtAppDaemon webhook.

Source ↗

Confidential Containersv0.20.0SecurityMay 5, 2026

ACTION 1PLAN 3OTHER 12View full analysis

Confidential Containers v0.20.0 combines operator-visible capability and compatibility updates with deprecations of several image and provider paths. It also includes a security fix identified by GHSA-q49m-57vm-c8cc.

Action needed (1)

securityhighGHSA-q49m-57vm-c8cc security fix
The release includes a fix for the security issue identified by GHSA-q49m-57vm-c8cc.

Plan ahead (3)

deprecatedThe Docker CAA provider, deprecatedremoval date not announced
Applies if you use the Docker CAA provider.
breakingThe Fedora-based mkosi CAA podvm image, deprecatedremoval date not announced
Applies if you use the Fedora-based mkosi CAA podvm image.
deprecatedSupport for packer images, deprecatedremoval date not announced
Applies if you use packer images.

Source ↗

Argov3.1.16CI/CD & App DeliveryMay 5, 2026

PLAN 1OTHER 2View full analysis

A maintenance release that ends the 3.1 series on May 06th 2026, after which it will no longer receive bug fixes or security updates. It also includes a fix for an error when attempting a second delete operation.

Plan ahead (1)

deprecatedThe 3.1 release series, end of liferemoval planned in May 06th 2026
Applies if you run the 3.1 release series.

Source ↗

Browse by month