A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.
Action needed (2)
securitycritical
google.update to 1.79.3golang. org/grpc The
google.dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.golang. org/grpc securitySymlink traversal fix in the
VMExportdirectory handlerThe
VMExportdirectory handler is fixed to prevent symlink traversal.
Plan ahead (1)
deprecatedDeprecated
kubevirt_vm_created_totalandkubevirt_vm_created_by_pod_totalrecording rulesApplies if you use
kubevirt_vm_created_totalorkubevirt_vm_created_by_pod_total.The recording rules
kubevirt_vm_created_totalandkubevirt_vm_created_by_pod_totalare deprecated in favor of new names to comply with recording-rule naming conventions. Both are deprecated completely.