RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Jun 2026Clear ×
OpenTelemetryv0.155.0ObservabilityJun 23, 2026
CHECK 9PLAN 1OTHER 10View full analysis

A release that removes stabilized feature gates, updates processor metric names, and changes service configuration APIs. It also adds schema and metadata tooling capabilities and fixes generator defects.

Check if affected (9)

  • breakingThe confightp.framedSnappy feature gate, removed

    Applies if you use confightp.framedSnappy.

  • breakingThe configoptional.AddEnabledField feature gate, removed

    Applies if you use configoptional.AddEnabledField.

  • breakingThe confmap.newExpandedValueSanitizer feature gate, removed

    Applies if you use confmap.newExpandedValueSanitizer.

  • + 6 more on the release page

Plan ahead (1)

  • deprecatedService configuration API deprecations

    Applies if you use service.Settings.CollectorConf or extensioncapabilities.ConfigWatcher.

Source ↗
Backstagev1.52.0CI/CD & App DeliveryJun 16, 2026
ACTION 2CHECK 7PLAN 9OTHER 288View full analysis

A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.

Action needed (2)

  • securityThe infinispan dependency upgrade

    infinispan was upgraded from ^0.12.0 to ^0.13.0 to address known vulnerabilities.

  • breakingThe unused json-schema runtime dependency, removed

    The unused json-schema runtime dependency has been removed.

Check if affected (7)

  • breakingThe catalog.stitchingStrategy.mode: 'immediate' setting, removed

    Applies if you configure catalog.stitchingStrategy.mode.

  • breakingComboboxProps as a union type

    Applies if you use ComboboxProps.

  • breakingThe default /kubernetes page, removed

    Applies if you use /kubernetes.

  • + 4 more on the release page

Plan ahead (9)

  • deprecatedTop-level Combobox input state props, deprecated

    Applies if you use plain-array options.

  • deprecatedPrevious tokens, deprecatedremoval date not announced

    Applicability is not stated in the release notes.

  • deprecatedThe single-module runCliModule helper, deprecated

    Applies if you use runCliModule.

  • + 6 more on the release page
Source ↗
Envoyv1.38.2Networking & MessagingJun 10, 2026
PLAN 1OTHER 3View full analysis

This maintenance release adds HTTP/2 runtime controls and corrects runtime guard override handling. It also announces future removal of the HTTP/2 histogram feature and its runtime guard.

Plan ahead (1)

  • deprecatedFuture removal of envoy.reloadable_features.http2_record_histogramsremoval date not announced

    Applies if envoy.reloadable_features.http2_record_histograms is enabled.

Source ↗
Envoyv1.37.4Networking & MessagingJun 10, 2026
PLAN 1OTHER 3View full analysis

This release adds HTTP/2 header-statistics histograms and a cookie-size limit, and fixes RTDS runtime guard override removal. The HTTP/2 histogram runtime guard is planned for removal in a future Envoy release.

Plan ahead (1)

  • deprecatedThe envoy.reloadable_features.http2_record_histograms histograms and runtime guard, planned for future removalremoval date not announced

    Applies if you use envoy.reloadable_features.http2_record_histograms.

Source ↗
Envoyv1.36.8Networking & MessagingJun 10, 2026
PLAN 1OTHER 3View full analysis

A maintenance release corrects RTDS runtime-guard override behavior and adds opt-in HTTP/2 cookie and header capabilities. The existing HTTP/2 histogram capability and its runtime guard are announced for future removal.

Plan ahead (1)

  • deprecatedenvoy.reloadable_features.http2_record_histograms, future removalremoval date not announced

    Applies if you use envoy.reloadable_features.http2_record_histograms.

Source ↗
Daprv1.18.0Orchestration & ManagementJun 10, 2026
ACTION 8CHECK 6PLAN 1OTHER 108View full analysis

A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.

Action needed (8)

  • securitymediumThe golang.org/x/image dependency update for GO-2026-4962

    golang.org/x/image is updated to v0.39.0 for GO-2026-4962.

  • securityThe durabletask-go and pgx dependency updates

    durabletask-go is updated to v0.12.1, and pgx is updated as part of the vulnerability fixes.

  • breakingThe WorkflowsRemoteActivityReminder default, enabled

    WorkflowsRemoteActivityReminder is enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.

  • breakingThe HotReload default, enabled

    HotReload is enabled by default for Components, Subscriptions, MCPServers, Configurations, HTTPEndpoints, Resiliencies, and WorkflowAccessPolicies.

  • breakingSidecar probe defaults

    Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.

  • breakingThe HotReload default, enabled in v1.18

    HotReload is enabled by default in v1.18.

  • breakingLiveness and readiness probe defaults

    The default liveness probe is widened, and the readiness probe default is tightened.

  • breakingChanged sidecar probe defaults

    Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for daprd.

Check if affected (6)

  • securityService invocation path traversal ACL bypass fix

    Applies if you use service invocation.

  • breakingThe MCPServerResource and WorkflowAccessPolicy feature gates, removed

    Applies if you configure the MCPServerResource or WorkflowAccessPolicy feature gates.

  • breakingThe Sentry Ed25519 workload identity key rollback constraint

    Applicability is not stated in the release notes.

  • + 3 more on the release page

Plan ahead (1)

  • deprecatedThe ScheduleJobAlpha1 alpha RPCs, deprecated

    Applies if you use ScheduleJobAlpha1.

Source ↗
KubeVirtv1.8.3Orchestration & ManagementJun 3, 2026
ACTION 2PLAN 1OTHER 13View full analysis

A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc update to 1.79.3

    The google.golang.org/grpc dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.

  • securitySymlink traversal fix in the VMExport directory handler

    The VMExport directory handler is fixed to prevent symlink traversal.

Plan ahead (1)

  • deprecatedDeprecated kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total recording rules

    Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗
etcdv3.4.45Kubernetes CoreJun 1, 2026
PLAN 1OTHER 1View full analysis

A maintenance release that ends support for the v3.4 line and updates the Go toolchain used to compile binaries. No further patches will be issued for v3.4.

Plan ahead (1)

  • deprecatedThe v3.4 line, end of support

Source ↗
KEDAv2.20.0Orchestration & ManagementJun 1, 2026
CHECK 7PLAN 1OTHER 70View full analysis

This release adds scalers, configuration options, metrics, authentication modes, and compatibility improvements. Operators with custom RBAC need to account for the Kubernetes events API migration, and users of removed scaler settings need to update their configurations.

Check if affected (7)

  • securityCredential headers on cross-host redirects and HTTPS downgrades

    Applicability is not stated in the release notes.

  • breakingScaledObject name length validation

    Applies when a ScaledObject name exceeds 63 characters.

  • breakingPositive unprocessedEventThreshold values

    Applies if you configure a non-positive unprocessedEventThreshold.

  • + 4 more on the release page

Plan ahead (1)

  • deprecatedThe buildId, selectAllActive, and selectUnversioned settings, deprecated

    Applies if you configure buildId, selectAllActive, or selectUnversioned.

Source ↗
Limav2.1.2Kubernetes CoreJun 1, 2026
CHECK 1PLAN 1OTHER 34View full analysis

A feature and maintenance release with CLI and template changes, QEMU behavior updates, and fixes across drivers, hostagent, shell, and guest support. It also includes a deprecation, while no security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

  • breakingQEMU 2MB OVMF images dropped by openSUSE

    Applicability is not stated in the release notes.

Plan ahead (1)

  • deprecatedThe _LIMA_QEMU_UEFI_IN_BIOS flag, deprecated

    Applies if you configure _LIMA_QEMU_UEFI_IN_BIOS.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023