RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Aug 2026Clear ×
Crossplanev2.4.0Orchestration & ManagementAug 20, 2026
ACTION 15CHECK 4PLAN 1OTHER 33View full analysis

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

  • securityGo version and dependency security updates

    Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.

  • securityGo 1.25.10

    Go was updated to 1.25.10 to fix standard library CVEs.

  • securitygolang.org/x/crypto v0.52.0

    The golang.org/x/crypto module was updated to v0.52.0 for security fixes.

  • securitygolang.org/x/sys v0.44.0

    The golang.org/x/sys module was updated to v0.44.0 for security fixes.

  • securitygolang.org/x/net v0.55.0

    The golang.org/x/net module was updated to v0.55.0 for security fixes.

  • securitygithub.com/sigstore/cosign/v3 v3.0.6

    The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.

  • securitygithub.com/sigstore/rekor v1.5.2

    The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.

  • securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0

    The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.

  • securitygithub.com/sigstore/sigstore-go v1.2.0

    The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.

  • securityCombined grpc, x/net, and x/text security updates

    Combined security updates were applied to grpc, x/net, and x/text.

  • securitygolang.org/x/net v0.56.0

    The golang.org/x/net module was updated to v0.56.0 for security fixes.

  • securitygolang.org/x/text v0.39.0

    The golang.org/x/text module was updated to v0.39.0 for security fixes.

  • securityVulnerable dependency updates

    Vulnerable dependencies were updated for security fixes.

  • securitygithub.com/sigstore/sigstore-go v1.2.1

    The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.

  • securitygolang.org/x/mod v0.40.0

    The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

  • breakingCrossplane CLI publication location and binary name

    Applies if you use the Crossplane CLI.

  • breakingspec.replicas behavior in DeploymentRuntimeConfig

    Applies if DeploymentRuntimeConfig configures spec.replicas.

  • breakingNarrowed composed resource garbage collection

    Applicability is not stated in the release notes.

  • + 1 more on the release page

Plan ahead (1)

  • deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)

    Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.

Source ↗
Kyvernov1.19.0SecurityAug 20, 2026
ACTION 7CHECK 6PLAN 1OTHER 160View full analysis

A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.

Action needed (7)

  • securityhighIntermediate certificate limits

    Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.

  • securityhighGo toolchain 1.26.3

    The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.

  • securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9

    CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.

  • securityUpdated golang.org/x/crypto and x/net dependencies

    The golang.org/x/crypto dependency was updated to v0.53.0 and x/net to v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.

  • securityPatched ORAS and sigstore vulnerabilities

    The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.

  • securityCodeQL vulnerability fixes

    Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.

  • securitycel-go v0.30.0

    cel-go was updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.

Check if affected (6)

  • breakingRequired --resource for the migrate command

    Applies when the migrate command runs.

  • breakingDefault userInfo groups and UID during background scans

    Applies when background scans run.

  • breakingexcludeBootstrapResources webhook flag

    Applies when you configure Fail webhooks.

  • + 3 more on the release page

Plan ahead (1)

  • deprecatedDeprecation notices for legacy kyverno.io policy types

    Applies when you use legacy kyverno.io policy types.

Source ↗
Backstagev1.54.0CI/CD & App DeliveryAug 18, 2026
ACTION 2CHECK 16PLAN 3OTHER 238View full analysis

A broad release with dependency updates, breaking changes to commands, authentication patterns, and connection APIs, plus new AWS connection support and updates across the catalog, scaffolder, search, and UI. It also includes Kubernetes plugin security fixes and an undisclosed security announcement.

Action needed (2)

  • breakingStrict TypeScript configuration schema validation

    Package preparation now validates TypeScript configuration schemas strictly before publishing.

  • breakingPortable configuration schemas for root connection types

    Connection types now use portable configuration schemas as the source of root connection types.

Check if affected (16)

  • securityKubernetes plugin security fixes

    Applies if you use the Kubernetes plugin.

  • breakingBackend connection APIs, removed from package exports

    Applies if you use connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, or AnyRootConnection.

  • breakingNode.js snapshots in generated backend Dockerfiles

    Applies if you configure generated backend Dockerfiles.

  • + 13 more on the release page

Plan ahead (3)

  • deprecatedThe plugin-web-library template, updated to toastApiRef

    Applies if you use the plugin-web-library template.

  • deprecatedZod v3 schemas, deprecated

    Applies if you depend on Zod v3 schemas.

  • deprecatedThe catalog.providers.backstageOpenapi.plugins option, deprecated

    Applies if you configure catalog.providers.backstageOpenapi.plugins.

Source ↗
Prometheusv3.14.0ObservabilityAug 18, 2026
ACTION 1CHECK 1PLAN 1OTHER 39View full analysis

A maintenance release with an API deprecation, operator-visible removals and default changes, new capabilities, performance improvements, and correctness fixes across discovery, PromQL, TSDB, and other components. No security advisories or explicitly described security vulnerabilities are included.

Action needed (1)

  • breakingDefault support for PromQL duration expressions

    Duration expressions are enabled by default in PromQL. The promql-duration-expr feature flag is now a no-op.

Check if affected (1)

  • breakingThe __meta_hetzner_datacenter label, removed

    Applies if you use hcloud targets.

Plan ahead (1)

  • deprecatedThe stats query parameter, deprecated for other valuesremoval date not announced

    Applies if you set stats to a value other than true or all.

Source ↗
Longhornv1.12.1Storage & DataAug 14, 2026
CHECK 6PLAN 1OTHER 46View full analysis

A release with breaking behavior for legacy V2 linked-clone volumes, a Kubernetes v1.25 minimum, and stronger default network controls, including expanded mTLS enforcement. It also adds V2 data engine capabilities and metrics while correcting defects across V2 operations, backups, expansion, and infrastructure.

Check if affected (6)

  • breakingInternal NetworkPolicy resources enabled by default

    Applies if a NetworkPolicy provider is available in the cluster.

  • breakingCross-namespace Prometheus scraper access through the Longhorn Manager network policy

    Applies if you use cross-namespace Prometheus scrapers.

  • breakingmTLS for all instance-manager gRPC services

    Applies if you configure the longhorn-grpc-tls secret.

  • + 3 more on the release page

Plan ahead (1)

  • deprecatedLegacy V2 linked-clone volumes deprecated

    Applies if you use V2 linked-clone volumes created in v1.12.0 or earlier.

Source ↗
containerdv2.2.7Kubernetes CoreAug 12, 2026
CHECK 3PLAN 1OTHER 5View full analysis

A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.

Check if affected (3)

  • breakingThe enable_experimental_restore_via_create default

    Applies if you use CreateContainer.

  • breakingThe ScrubLogs default on Windows

    Applies if you run on Windows.

  • breakingCheckpoint restore without CRIU

    Applies if you do not have CRIU installed.

Plan ahead (1)

  • deprecatedRestore in CreateContainer, deprecated

    Applies if you use CreateContainer.

Source ↗
containerdv2.3.4Kubernetes CoreAug 12, 2026
CHECK 3PLAN 1OTHER 11View full analysis

A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.

Check if affected (3)

  • breakingCheckpoint restore in CreateContainer disabled by default

    Applies if you set enable_experimental_restore_via_create.

  • breakingruntimeFeatures.UserNamespacesHostNetwork enabled by default

    Applies if you run CRI.

  • breakingLog scrubbing enabled by default on Windows

    Applies if you run Windows.

Plan ahead (1)

  • deprecatedCheckpoint restore in CreateContainer deprecated

    Applies if you use CreateContainer.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023