Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Feb 2026Clear ×

Karmadav1.17.0Orchestration & ManagementFeb 28, 2026

CHECK 4PLAN 3OTHER 34View full analysis

A feature and maintenance release adds workload affinity and anti-affinity scheduling, operator and API capabilities, and Helm encryption at rest. It also includes controller and scheduler fixes, dependency and image updates, and deprecations and removals.

Check if affected (4)

breakingnamespace validation for spec.resourceSelectors
Applies if you use PropagationPolicy or OverridePolicy.
breakingStricter GroupByLabelKey validation in WorkloadAffinity
Applies if you configure GroupByLabelKey in WorkloadAffinity.
breakingUpdated default Kubernetes and ETCD images
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (3)

deprecatedThe --cluster-lease-duration flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-duration.
deprecatedThe --cluster-lease-renew-interval-fraction flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-renew-interval-fraction.
deprecatedEtcd.Local.InitImage in Karmada Init Configuration, deprecatedremoval date not announced
Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.

Source ↗

Daprv1.17.0Orchestration & ManagementFeb 27, 2026

ACTION 9CHECK 3PLAN 2OTHER 151View full analysis

A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.

Action needed (9)

securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto dependency is bumped.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github.com/coreos/go-oidc/v3 dependency, updated
The github.com/coreos/go-oidc/v3 dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.

Check if affected (3)

securityPlacement authorization for Dapr actor types
Applies if you use Placement.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.

Plan ahead (2)

deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.

Source ↗

Strimzi0.50.1Networking & MessagingFeb 19, 2026

ACTION 1PLAN 1OTHER 12View full analysis

A maintenance release with two security fixes and a deprecated KafkaUser API field that requires migration. It also includes API conversion fixes, broker certificate output changes, and dependency and container image updates.

Action needed (1)

securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
The release includes security fixes for CVE-2026-27133 and CVE-2026-27134.

Plan ahead (1)

deprecatedThe .spec.authorization.acls[]operation field is deprecated
Applies if you configure .spec.authorization.acls[]operation.

Source ↗

Backstagev1.48.0CI/CD & App DeliveryFeb 17, 2026

CHECK 7PLAN 2OTHER 15View full analysis

A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.

Check if affected (7)

breakingStable catalogProcessingExtensionPoint export
Applies if you use catalogProcessingExtensionPoint when providing custom processors and entity providers into the catalog.
breakingRejected CatalogApi and ErrorApi overrides
Applicability is not stated in the release notes.
breakingRemoved auth.experimentalDynamicClientRegistration.tokenExpiration
Applies if you configure auth.experimentalDynamicClientRegistration.tokenExpiration.
+ 4 more on the release page

Plan ahead (2)

deprecatedDeprecated IconComponent type
Applies if you use IconComponent.
deprecatedDeprecated items prop
Applies if you use the items prop.

Source ↗

etcdv3.6.8Kubernetes CoreFeb 13, 2026

ACTION 2PLAN 1OTHER 1View full analysis

A maintenance release postpones removal of one flag and reverses another flag's deprecation. It also includes dependency and toolchain updates addressing named security advisories.

Action needed (2)

securityhighThe go toolchain, updated to 1.24.13
Binaries are compiled using go 1.24.13. The toolchain update addresses CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.
securitymediumThe golang.org/x/crypto dependency, updated to 0.45.0
golang.org/x/crypto is updated to 0.45.0 to address CVE-2025-47914 and CVE-2025-58181.

Plan ahead (1)

deprecatedThe --max-snapshots flag, removal postponedremoval planned in v3.8
Applies if you use --max-snapshots.

Source ↗

Ciliumv1.19.0Networking & MessagingFeb 4, 2026

ACTION 15CHECK 30PLAN 7OTHER 436View full analysis

A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.

Action needed (15)

securityThe github.com/containerd/containerd dependency, updated
The github.com/containerd/containerd module is updated to v1.7.29.
securityThe github.com/go-viper/mapstructure/v2 dependency, updated
The github.com/go-viper/mapstructure/v2 module is updated to v2.4.0.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker module is updated to v28.3.3+incompatible.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto module is updated to v0.45.0.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.4
The helm.sh/helm/v3 module is updated to v3.18.4.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.5
The helm.sh/helm/v3 module is updated to v3.18.5.
breakingThe plpmtud default, set to blackhole
The default plpmtud mode is now blackhole (blackhole-detected).
breakingThe AddressScopeMax default, set to 254
The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.
breakingThe tls authMode default, set to migration
tls authMode is set to migration by default.
breakingThe CNI deletion timeout, reduced to 1.5 seconds
The CNI deletion timeout is reduced to 1.5 seconds.
breakingThe policy-default-local-cluster default
policy-default-local-cluster is now set by default.
breakingHost firewall bypass, disabled by default
Host firewall bypass is disabled by default.
breakingFQDN match pattern sanitization
FQDN match pattern sanitization is refactored and tightened.
breakingEncrypted traffic forwarding via cilium_host, removed
Forwarding encrypted traffic via cilium_host has been removed.
breakingCNI configuration in the container image, removed
The CNI configuration is no longer installed in the container image.

Check if affected (30)

breakingLocal-cluster default for network policy selectors
Applies if you do not set cluster in network policy selectors.
breakingThe CiliumBGPPeeringPolicy v1 API, removed
Applies if you use CiliumBGPPeeringPolicy.
breakingMutual Authentication, disabled by default
Applies if you enable Mutual Authentication.
+ 27 more on the release page

Plan ahead (7)

deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced
Applies if you use --enable-ipsec-encrypted-overlay.
deprecatedKafka match fields and ToRequires and FromRequires, deprecated
Applies if you use ToRequires or FromRequires.
deprecatedTLS certificate and key Helm values, deprecated
Applies if you pass TLS certificates or keys in Helm values.
+ 4 more on the release page

Source ↗

Browse by month