AI-analyzed release notes for CNCF graduated and incubating projects.
Release v1.14.0 adds tracing and observability capabilities and broadens ResolutionRequest resolution support. It also includes correctness fixes, a Go security-related update, and shipped dependency updates.
Action needed (1)
securityGo 1. update
Go is updated to 1. in v1.14.0 for CVE remediation.
Flux v2.9.0 removes two deprecated API versions and adds CLI and controller capabilities across several Flux resources. It also changes supported Kubernetes versions, corrects defects, and updates project and third-party dependencies.
Check if affected (1)
breakingRemoval of deprecated Flux API versions
Applies if your CRDs use the image. or notification. APIs.
A maintenance release with a security fix for unbounded reads in the Terraform remote configuration loader and a correctness fix for CUE imports in status details. It also adds repository ownership metadata.
Check if affected (1)
securityUnbounded read prevention in the Terraform remote configuration loader
Applies if you use the Terraform remote configuration loader.
This release includes a security correction for an unbounded-read denial-of-service condition in the Terraform remote configuration loader. The fix is backported to release-1. and concerns deployments that use this loader.
Check if affected (1)
securityTerraform remote configuration loader DoS fix (GHSA-fmgp-q6jx-gg3x)
Applies if you use the Terraform remote configuration loader.
Backstage v1.52.1 is a maintenance release focused on operator-facing defect fixes. It addresses scheduler task state during trigger changes and a broken configuration schema in the Kubernetes React plugin.
Source ↗A maintenance release fixes the release pipeline by adding automated draft release support. It contains no other operator-facing product changes.
Source ↗A maintenance release updates k8s. from 0. to 0.. The remaining release material does not describe a distinct operator-facing change.
Tekton v1.3.6 contains dependency update batches, with no functional or security changes described. The release material also includes installation instructions and attestation or verification metadata.
Source ↗Nothing here needs operator attention. The release notes contain installation, attestation, and verification instructions, along with empty section headings, but no described product changes.
Source ↗A maintenance release with three dependency updates, including an update to k8s. from 0.33.12 to 0.33.13. Nothing else in the release requires operator attention.
This release focuses on builder configuration and registry issue documentation. It changes the lifecycle version included in builders, corrects the yank registry issue body, and updates the suggested Heroku builder image.
Source ↗OpenKruise v1.9.0 adds operator-facing capabilities, upgrades several APIs to v1beta1, and tightens validation for numerical maxUnavailable and maxSurge values. It also includes multiple correctness fixes, with no security advisories or vulnerabilities disclosed.
Check if affected (2)
breakingKruise APIs upgraded to v1beta1
Applies if your manifests use the listed Kruise APIs at v1alpha1.
breakingNumerical string values for maxUnavailable and maxSurge rejected
Applies if you configure numerical string values for maxUnavailable or maxSurge.
This release focuses on correctness fixes in Argo CD. All Argo CD container images are signed by cosign, and provenance is generated for container images and CLI binaries that meet SLSA Level 3 specifications. No security advisory is disclosed.
Source ↗Argo CD v3.3.12 is a maintenance release containing operator-relevant bug fixes. No security advisories or setup-breaking changes are disclosed.
Source ↗A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.
Action needed (2)
securityThe infinispan dependency upgrade
infinispan was upgraded from ^0. to ^0. to address known vulnerabilities.
breakingThe unused json-schema runtime dependency, removed
The unused json-schema runtime dependency has been removed.
Check if affected (7)
breakingThe catalog. setting, removed
Applies if you configure catalog..
breakingComboboxProps as a union type
Applies if you use ComboboxProps.
breakingThe default /kubernetes page, removed
Applies if you use /kubernetes.
Plan ahead (9)
deprecatedTop-level Combobox input state props, deprecated
Applies if you use plain-array options.
deprecatedPrevious tokens, deprecatedremoval date not announced
Applicability is not stated in the release notes.
deprecatedThe single-module runCliModule helper, deprecated
Applies if you use runCliModule.
A maintenance release with defect corrections and a behavior change affecting implicit resource settings for internal containers. No security advisories are disclosed.
Check if affected (1)
breakingDefault resource requirements for internal containers are removed
Applies if you do not set default-container-resource-requirements.
A maintenance release with several correctness fixes and multiple dependency updates. Resolver behavior is narrowed so that only StepActions, Tasks, and Pipelines can be resolved, which requires review for users of Tekton Resolvers.
Check if affected (1)
breakingTekton Resolver object restrictions
Applies if you use Tekton Resolvers.
Nothing here needs operator attention.
Source ↗A maintenance release with correctness fixes, a security-relevant dependency update, resolver compatibility constraints, metric behavior changes, and additional dependency upgrades. The changes include a restriction on the object types handled by Tekton Resolvers and an update to gRPC.
Action needed (1)
securitycriticalgoogle. updated to 1.79.3 for CVE-2026-33186
The google. dependency is updated from 1.77.0 to 1.79.3 to fix CVE-2026-33186, an authorization bypass caused by a missing leading slash in the :path header.
Check if affected (1)
breakingTekton Resolvers, limited to supported object types
Applies if you use the Resolver API.
Tekton v1.6.3 contains resolver validation and behavior corrections, along with fixes affecting cross-architecture execution and metrics. It also updates dependencies, including a gRPC change for CVE-2026-33186, so resolver users and dependency-sensitive deployments should review the release.
Action needed (1)
securitycriticalThe google. dependency fix for CVE-2026-33186
The google. dependency includes a fix for CVE-2026-33186 in v1.6.3.
Check if affected (1)
breakingTekton Resolver target restrictions
Applies if your ResolutionRequest objects use Tekton Resolvers.
A correctness-focused release fixes resolver behavior and updates dependencies. It also narrows the resolver input contract and changes pod metrics and labels.
Action needed (1)
breakingPod label removal
The pod label is removed in this release.
Check if affected (1)
breakingThe Resolver API resolution scope
Applies if you use custom resolvers and the Resolver API.
Nothing here needs operator attention. The release note contains installation and attestation information, with no described operator-facing changes.
Source ↗A maintenance release includes a fix for an empty userSelect value in the msgraph module, which caused all users to be dropped. No other operator action is indicated.
Core v0.16.0 changes disabled-flag evaluations from returning an error to succeeding with reason DISABLED; resolved values remain unchanged and still use the caller-provided default. The compatibility change affects consumers that inspect reason or errorCode, call flagd directly over gRPC or OFREP, or import core/pkg/model.
A behavior update changes how disabled flags are evaluated: they now resolve successfully with reason=DISABLED instead of returning a FLAG_DISABLED error. No other operator action is indicated.
