RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Aug 2026Clear ×
Backstagev1.54.0CI/CD & App DeliveryAug 18, 2026
ACTION 2CHECK 16PLAN 3OTHER 238View full analysis

A broad release with dependency updates, breaking changes to commands, authentication patterns, and connection APIs, plus new AWS connection support and updates across the catalog, scaffolder, search, and UI. It also includes Kubernetes plugin security fixes and an undisclosed security announcement.

Action needed (2)

  • breakingStrict TypeScript configuration schema validation

    Package preparation now validates TypeScript configuration schemas strictly before publishing.

  • breakingPortable configuration schemas for root connection types

    Connection types now use portable configuration schemas as the source of root connection types.

Check if affected (16)

  • securityKubernetes plugin security fixes

    Applies if you use the Kubernetes plugin.

  • breakingBackend connection APIs, removed from package exports

    Applies if you use connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, or AnyRootConnection.

  • breakingNode.js snapshots in generated backend Dockerfiles

    Applies if you configure generated backend Dockerfiles.

  • + 13 more on the release page

Plan ahead (3)

  • deprecatedThe plugin-web-library template, updated to toastApiRef

    Applies if you use the plugin-web-library template.

  • deprecatedZod v3 schemas, deprecated

    Applies if you depend on Zod v3 schemas.

  • deprecatedThe catalog.providers.backstageOpenapi.plugins option, deprecated

    Applies if you configure catalog.providers.backstageOpenapi.plugins.

Source ↗
OpenFeatureflagd-proxy/v0.9.8CI/CD & App DeliveryAug 14, 2026
ACTION 1OTHER 1View full analysis

A maintenance release for flagd-proxy resolves open Dependabot security alerts. The sync server also receives a gRPC keepalive enforcement policy update.

Action needed (1)

  • securityOpen Dependabot security alerts resolved

    Open Dependabot security alerts are resolved in flagd-proxy v0.9.8.

Source ↗
OpenFeatureflagd/v0.16.2CI/CD & App DeliveryAug 14, 2026
OTHER 4View full analysis

A maintenance release focused on bug fixes in eventing, eventstream connections, and evaluation metrics recording. The recorded fixes do not indicate any operator action beyond upgrading.

Source ↗
Argov3.5.1CI/CD & App DeliveryAug 12, 2026
ACTION 1OTHER 7View full analysis

This release contains routine correctness fixes and a security fix in the server. The security change concerns users of the SSD CLI.

Action needed (1)

  • securitySSD CLI secret-mask spoofing prevention

    The server prevents secret-mask spoofing in the SSD CLI. This fix ships in Argo CD v3.5.1.

Source ↗
Argov3.4.7CI/CD & App DeliveryAug 12, 2026
ACTION 1OTHER 4View full analysis

A maintenance release with correctness fixes, a server-side secret-mask spoofing fix, and a third-party dependency update. Ordinary fixes and the dependency update require no operator action, while upgrading addresses the security fix.

Action needed (1)

  • securitySSD CLI secret-mask spoofing prevention

    The server now prevents secret-mask spoofing in the SSD CLI. This fix ships in the 3.4 release line.

Source ↗
Argov3.3.14CI/CD & App DeliveryAug 12, 2026
ACTION 2CHECK 2OTHER 2View full analysis

A maintenance release with fixes for secret masking and pprof endpoint configuration, alongside dependency updates for two listed CVEs. The secret-handling fixes and dependency updates are addressed by upgrading, while the remaining defect fixes require no operator action.

Action needed (2)

  • securityhighThe /ui brace-expansion dependency update for CVE-2026-69152

    The /ui dependency brace-expansion is updated to 2.1.4 and 1.1.18 for CVE-2026-69152.

  • securitymediumThe DOMPurify dependency update for CVE-2026-49978

    The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.

Check if affected (2)

  • securitySSD CLI secret mask spoofing prevention

    Applies if you use SSD CLI.

  • securitySecret hiding in the last-applied-configuration annotation

    Applies if you configure last-applied-configuration.

Source ↗
OpenKruisev1.8.5CI/CD & App DeliveryAug 10, 2026
OTHER 2View full analysis

OpenKruise v1.8.5 corrects nodeimage TTL cleanup so setting completionPolicy.ttlSecondsAfterFinished does not delete the job itself. It adds the default-ttlseconds-for-always-nodeimage flag for kruise-controller-manager to control nodeimage data TTL.

Source ↗
Buildpacksv0.40.9CI/CD & App DeliveryAug 9, 2026
ACTION 3OTHER 1View full analysis

This release updates dependencies associated with published security advisories. Builders created with the pack CLI from this release contain lifecycle v0.21.0 by default.

Action needed (3)

  • securityhighThe github.com/go-git/go-git/v5 dependency update

    github.com/go-git/go-git/v5 updates from v5.19.1 to v5.19.2 in buildpacks v0.40.9. The release note cites GHSA-hc8v-wwc9-vgxm.

  • securitymediumThe go.opentelemetry.io/otel dependency update

    go.opentelemetry.io/otel updates from v1.43.0 to v1.44.0 in buildpacks v0.40.9. The release note cites GO-2026-5158 and CVE-2026-41178 for a baggage header that was not length-capped.

  • securityThe github.com/klauspost/compress dependency update

    github.com/klauspost/compress updates from v1.18.6 to v1.18.7 in buildpacks v0.40.9. The release note cites GO-2026-5841 and GHSA-259r-337f-4rfw for an out-of-bounds read in s2.

Source ↗
Fluxv2.9.4CI/CD & App DeliveryAug 7, 2026
CHECK 3OTHER 8View full analysis

A maintenance release with correctness fixes that narrow some existing configuration constraints. It also adds CLI repository migration support and updates dependencies; no explicit security advisory or vulnerability is disclosed.

Check if affected (3)

  • breakingThe image-automation-controller refspec constraint

    Applies if you configure refspecs.

  • breakingGCS static authentication limited to service account keys

    Applies if you configure GCS static authentication.

  • breakingThe allow-webhooks network policy restriction

    Applies if you configure allow-webhooks.

Source ↗
Microcks1.15.0CI/CD & App DeliveryAug 5, 2026
OTHER 16View full analysis

Version 1.15.0 adds authentication, TLS, GraphQL, configuration, and UI capabilities, alongside fixes for correctness defects. It also updates shipped container and frontend dependencies, with no disclosed security advisories or security-specific fixes.

Source ↗
Argov3.5.0CI/CD & App DeliveryAug 4, 2026
ACTION 3CHECK 1OTHER 286View full analysis

A maintenance release focused on operator-facing bug fixes, with additional feature and configuration work. It also includes dependency updates, including a UI dependency update for CVE-2026-41240.

Action needed (3)

  • securitymediumThe redoc/dompurify dependency update for CVE-2026-41240

    The UI dependency redoc/dompurify is bumped to v3.4.0 to fix CVE-2026-41240.

  • securityThe formidable dependency update

    The formidable dependency is updated to v2.1.3.

  • breakingThe auto-sync toggle removal from the app top bar

    The auto-sync toggle is removed from the app top bar.

Check if affected (1)

  • breakingThe theme default changed to auto

    Applies if theme is not configured.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023