AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with bug fixes and dependency updates. The form-data update in /ui addresses CVE-2026-12143.
Action needed (1)
securityhighThe form-data dependency update for CVE-2026-12143
The form-data dependency is updated to version 4.0.6 in /ui to address CVE-2026-12143.
This release combines ordinary bug fixes with security-related updates. It also improves blob/HTTP synchronization, with no announced operator-facing removals, deprecations, or default changes.
Action needed (2)
securityThe google. module update to v1.82.1
The google. module is updated to v1.82.1 in core v0.16.1.
securityThe vulnerability-updates update
vulnerability-updates is updated in core v0.16.1.
A maintenance release with a bug-fix heading, a new server timeout setting, dependency updates, and security-related updates. The google. update requires upgrading.
Action needed (2)
securityThe google. module, updated to v1.82.1
The google. module is updated to v1.82.1 as a security-related dependency change.
securityThe vulnerability-updates dependency update
The release updates vulnerability-updates as a security-related dependency change.
flagd/v0. combines bug fixes with security dependency updates and a configurable sync-server capability. The security notes do not include advisory identifiers or flaw details, while the sync-server changes include server timeouts and configurable gRPC keepalive enforcement.
Action needed (3)
securitySecurity dependency updates
Security dependencies are updated in flagd/v0..
securityThe google. module update
The google. module is updated to v1. in flagd/v0..
securityVulnerability updates
Vulnerability updates are included in flagd/v0. as a security change.
A release with operator-facing authorization and credential-handling fixes, alongside new Helm, CUE, and workflow capabilities. It also adds validation improvements and dependency updates.
Check if affected (3)
securityExplicit authorization for vela-system definitions
Applies if you use vela-system definitions.
securityCredential redaction for Terraform module remote URLs
Applies if you configure Terraform module remote URLs.
breakingUndeclared parameter validation in application definitions
Applies if you use application definitions.
A maintenance release rebuilds the pack on Go 1.25.12 to address two disclosed standard library security issues. It also updates several dependencies and includes a newer default lifecycle version.
Check if affected (1)
securityhighGo 1.25.12 standard library rebuild for GO-2026-4970 and GO-2026-5856
Applies if you use 1..
This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.
Action needed (1)
securityGo 1.25.10 dependency update
Go is updated to 1. for CVE remediation in this release.
Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang. packages, with no specific advisory identifiers or vulnerability details in the note.
Action needed (3)
securityGo 1.25.10 update
Go is updated to 1. for CVE remediation in v1.9.6.
securitygolang. v0.52.0 update
golang. is updated to v0. for CVE remediation in v1.9.6.
securitygolang. v0.55.0 update
golang. is updated to v0. for CVE remediation in v1.9.6.
