AI-analyzed release notes for CNCF graduated and incubating projects.
A fractional bucketing update changes pseudorandom assignments without changing the API. Consistent assignments require all providers to be updated.
Check if affected (1)
breakingFractional pseudorandom bucketing assignments
Applies if you use providers.
This release focuses on operator correctness, with changes to status. handling, an option to disable status validation, and fixes for apply-once resource reconciliation and applied-resource tracking. It also updates the debug webhook script as setup tooling.
This is a patch release for Backstage with one new TablePagination API prop and two correctness fixes. The changes concern pagination labeling, relative link resolution, and entity relation cards.
This is a maintenance release for Argo CD focused on operator-relevant bug fixes. It addresses incorrect behavior in application normalization and cached installation ID handling.
Source ↗This maintenance release includes a security mitigation for CVE-2026-33186 in grpc-go. It also contains ordinary fixes to application behavior and the user interface.
Action needed (1)
securitycriticalgrpc-go CVE-2026-33186 mitigation
A mitigation for CVE-2026-33186 in grpc-go ships in the release-3. line.
Argo CD v3.1.13 focuses on release artifact provenance and maintenance, with a security mitigation, a UI correction, and a dependency update. Container images are signed, and qualifying container images and CLI binaries receive SLSA Level 3 provenance.
Action needed (1)
securitycriticalgrpc-go CVE-2026-33186 mitigation
The release includes a mitigation for CVE-2026-33186 in grpc-go for release-3.1.
Argo CD v3.3.5 is a maintenance release with six operator-relevant bug fixes and an update to the google. dependency from 1.77.0 to 1.79.3. No security advisories or security-specific fixes are disclosed.
This patch release corrects CIMD redirect URI matching for loopback addresses. No operator configuration change is indicated.
Source ↗This release contains API and template changes, new DevTools functionality, frontend behavior changes, and defect corrections. No security advisories or security-specific fixes are stated.
Check if affected (1)
breakingThe catalog entity page layout header is disabled
Applies if you use the catalog entity page in the new frontend system.
A breaking compatibility release changes defaults and removes or narrows support across the frontend, CLI, catalog, and integrations. It also introduces new frontend, catalog, scaffolder, CLI, and integration capabilities, while deprecated functionality remains in some areas and requires planning. The release contains no security fixes.
Check if affected (14)
breakingThe New Frontend System as the default for new apps
Applicability is not stated in the release notes.
breakingThe create-app frontend selection flag
Applies if you use the --next flag for create-app.
breakingDeprecated types and options
Applies if you use deprecated types and options.
Plan ahead (7)
deprecatedDeprecated variant, columns, and tableOptions props
Applies if you use the variant, columns, or tableOptions props.
deprecatedThe RelatedEntitiesCard component
Applies if you use RelatedEntitiesCard.
deprecatedThe CLI built-in set fallback
Applicability is not stated in the release notes.
Flux v2.8.3 fixes a helm-controller templating regression. The release also identifies helm-controller v1.5.3.
Source ↗Argo CD v3.3.4 includes signed container images, a fix that skips token refresh threshold parsing in unrelated components, and an otel-sdk dependency update. The release also contains CI-only work, headings, and installation examples without separately actionable operator impact.
This release updates builder-related behavior in the pack CLI, including the lifecycle version packaged by builders, lifecycle binary selection on amd64, and suggested builder options. It also adds ubi9, ubi10, and noble to the suggested builders.
Source ↗Flux v2.8.2 includes correctness fixes and dependency updates. It also fixes a disclosed TLS-handshake denial-of-service issue in the controller builds.
Action needed (1)
securitymediumCVE-2026-27138 TLS-handshake DoS fix
The TLS-handshake denial-of-service issue identified as CVE-2026-27138 is fixed by building all controllers with Go 1..
A security-focused maintenance release fixes undisclosed issues in two Backstage backend plugins. The affected plugins are @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.
Action needed (1)
securitySecurity fixes in two Backstage backend plugins
Security fixes ship in @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.
A maintenance release with a compatibility update for cluster version labels and several ordinary defect corrections. The compatibility update concerns Application Sets that fetch clusters based on Kubernetes version.
Check if affected (1)
breakingThe argocd. format, changed
Applies if argocd. and argocd. are configured.
Backstage v1.48.4 is a security-fix release affecting three Backstage packages. Operators using these packages are the audience for this update.
Check if affected (1)
securitySecurity fixes for three Backstage packages
Applies to users of @backstage/plugin-techdocs-node, @backstage/integration, or @backstage/plugin-scaffolder-backend.
Flux v2.8.1 is a maintenance release focused on operator-relevant defect fixes and updates to Flux dependencies and components. No security advisories are disclosed.
Source ↗Version v1.48.3 is a correctness-fix release for Backstage. It fixes MUI module resolution by correcting the @mui/material/styles shared dependency key and fixes entity page tab groups so they follow the configured ordering.
OpenKruise v1.8.3 includes a constraint change for probe host configuration. Existing configurations that rely on previously accepted host values may require changes.
Check if affected (1)
breakingThe probe host field, restricted
Applies if your probe configurations use the host field.
This release restricts the host field in probe configuration. The section heading carries no operator-facing change.
Check if affected (1)
breakingRestricted probe host field
Applies if you configure host.
Flux v2.8.0 expands capabilities across controllers, notifications, the CLI, and artifact handling while also including fixes and dependency updates. It removes the deprecated API versions v1beta2 and v2beta2 from CRDs and changes Kubernetes compatibility requirements, so users of those APIs or affected Kubernetes versions are the main audience.
Check if affected (1)
breakingThe Flux APIs v1beta2 and v2beta2, removed from CRDs
Applies if you use the Flux APIs v1beta2 or v2beta2 in CRDs.
Backstage v1.48.2 restores two scaffolder alpha API exports, changes search behavior on the first navigation, and updates a third-party dependency to fix a compatibility defect. The release concerns users of the scaffolder APIs, first-navigation search, or the affected API extraction tooling.
Source ↗This release fixes the client-side apply migration issue reported in versions 3. and 3.. No security advisories are disclosed.
Action needed (1)
breakingClient-side apply migration failure
The failed to perform client-side apply migration issue present in versions 3. and 3. is fixed in this release.
This release contains an operator-facing defect correction. No detailed change entry is available here.
Source ↗Argo CD v3.2.7 is a maintenance release with ordinary bug fixes and a Go dependency update. No security advisory or forced operator action is disclosed.
Source ↗Argo CD v3.3.1 is a maintenance release with correctness fixes and updates to its Kustomize dependency and Ubuntu base image. Operators of self-managing Argo CD installations should account for the documented upgrade prerequisite.
Source ↗This release includes an operator-relevant correctness fix for Application status handling. Removed components are properly cleared from status fields when they are removed from the specification.
Source ↗A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.
Check if affected (7)
breakingStable catalogProcessingExtensionPoint export
Applies if you use catalogProcessingExtensionPoint when providing custom processors and entity providers into the catalog.
breakingRejected CatalogApi and ErrorApi overrides
Applicability is not stated in the release notes.
breakingRemoved auth.
Applies if you configure auth..
Plan ahead (2)
deprecatedDeprecated IconComponent type
Applies if you use IconComponent.
deprecatedDeprecated items prop
Applies if you use the items prop.
This is a maintenance release with security fixes backported from v1.. The fixes affect operators using the v1. release line.
Action needed (1)
securityBackported security fixes from v1.
This release contains backported security fixes from v1..
A security-focused release with fixes for the TechDocs Node plugin. The release is relevant to deployments that use @backstage/plugin-techdocs-node.
Check if affected (1)
securitySecurity fixes for @backstage/plugin-techdocs-node
Applies if you use @backstage/plugin-techdocs-node.
Argo v3.3.0 is a substantial feature and maintenance release with changes across synchronization, health, hydration, diff and apply behavior, the UI, and resource operations. It also updates core dependencies and removes an app controller flag.
Action needed (3)
securityThe k8s. module, updated to v1.34.2
The k8s. module is updated to v1.34.2 in Argo v3.3.0.
securityHelm 3.19.4
Helm is updated to 3.19.4 in Argo v3.3.0.
securityRedis, updated to the latest stable release
Redis is updated to the latest stable release in Argo v3.3.0.
Check if affected (1)
breakingThe --self-heal-backoff-cooldown-seconds flag, removed
Applies if your app controller configuration uses --self-heal-backoff-cooldown-seconds.
Argo CD v3.2.6 is a maintenance release with operator-facing bug fixes and a dependency update. The remaining release-note entries are headings or documentation and release metadata rather than distinct operator-facing changes.
Source ↗Microcks 1.13.2 adds UI, configuration, tracing, and external data-handling capabilities. It also corrects chart calculations, MCP type reflection, PubSub topic handling, and the container image version.
Source ↗
