AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with correctness fixes and a security-related dependency update. The dependency update is recorded in the manifest and has no standalone operator impact.
Action needed (1)
securitySecurity updates for golang. and golang.
The dependency manifest updates golang. and golang. to include security updates.
A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.
Action needed (1)
securityhighGo 1. security fixes
The release is built with Go 1., including fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.
Check if affected (3)
securityplugin/acl autopath ACL checks
Applies if you use plugin/acl and autopath.
breakingplugin/forward default connection attempts
Applies if you use plugin/forward.
breakingplugin/hosts unsupported-type fallthrough
Applies if you use plugin/hosts.
A maintenance release with correctness fixes and dependency updates tied to GO advisories. The changes affect Helm users through both general fixes and updated Go dependencies.
Action needed (2)
securitymediumThe go. dependency upgrade for GO-2026-5158
go. was upgraded to v1.44.0 for advisory GO-2026-5158.
securityThe google. dependency upgrade for GO-2026-6061
google. was upgraded from 1.80.0 to 1.82.1 for advisory GO-2026-6061.
A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.
Check if affected (3)
breakingThe enable_experimental_restore_via_create default
Applies if you use CreateContainer.
breakingThe ScrubLogs default on Windows
Applies if you run on Windows.
breakingCheckpoint restore without CRIU
Applies if you do not have CRIU installed.
Plan ahead (1)
deprecatedRestore in CreateContainer, deprecated
Applies if you use CreateContainer.
A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.
Check if affected (3)
breakingCheckpoint restore in CreateContainer disabled by default
Applies if you set enable_experimental_restore_via_create.
breakingruntimeFeatures. enabled by default
Applies if you run CRI.
breakingLog scrubbing enabled by default on Windows
Applies if you run Windows.
Plan ahead (1)
deprecatedCheckpoint restore in CreateContainer deprecated
Applies if you use CreateContainer.
This release fixes user-namespace UID/GID restoration after CRI-O restart, reduces debug-log verbosity for List* RPC calls, and restores pre-1.34 handling of environment-variable values containing non-UTF-8 data. It also updates or removes dependencies listed in the dependency manifest.
CRI-O v1.34.11 includes a correctness fix that restores prior handling of environment-variable values containing non-UTF-8 data. No detailed change item is provided here.
Source ↗This cri-o release includes a fix for a disclosed security vulnerability alongside runtime behavior, monitoring configuration, metric, and dependency updates. It is most relevant to deployments affected by the HOME environment-variable issue or the related observability and CNI configuration changes.
Action needed (1)
securityhighCVE-2026-15809 HOME environment-variable injection fix
cri-o v1.36.3 fixes CVE-2026-15809. The vulnerability allowed a bypass of the CVE-2022-4318 fix, enabling /etc/passwd injection through newline characters in the HOME environment variable.
A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.
Action needed (3)
securityhighThe google. dependency update
The release updates google. to version 1. to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.
Check if affected (1)
securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.
A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.
Action needed (5)
securitycriticalThe golang. dependency update
The golang. dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.
securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8
An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3
The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.
securityhighThe google. dependency update
The google. dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default value
The default value for snapshotLimitByte is set to a reasonable value in this release.
A maintenance release with correctness and security fixes, timeout behavior changes, and dependency and toolchain updates. It also updates the build toolchain used to compile binaries.
Action needed (5)
securityhighWatch response authorization for key ranges
The watch authorization issue is fixed: a user with read permission on one key could no longer receive watch responses for every key starting from that key. The fix addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener
A tlsHandshakeTimeout is set for tlsListener. The change addresses GHSA-6vch-q96h-7gc3.
securityhighThe golang. dependency, updated to v0.56.0
The golang. dependency is updated to v0.56.0 to address GO-2026-5942.
securityhighThe golang. dependency, updated to v0.39.0
The golang. dependency is updated to v0.39.0 to address GO-2026-5970.
securityhighThe google. dependency, updated to 1.82.1
The google. dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
A maintenance release with dependency updates and correctness fixes across scheduling, kubelet behavior, server-side apply, and kubeadm. It also includes a Go 1.26.5 build update, with no disclosed security advisories.
Source ↗A maintenance release with fixes to kubeadm join and etcd learner promotion, reduced kubelet logging for missing optional annotations, and restored Cri-api JSON encoding compatibility. It also updates the build toolchain to Go 1.25.12.
Source ↗A maintenance release with kubeadm and kubelet behavior corrections, a changed kubeadm timeout default, and a deferred Kubelet deprecation removal. It also includes a toolchain dependency update and no identified security advisories.
Plan ahead (1)
deprecatedKubelet configurations flags deprecation removal timelineremoval planned in 1.38
Applies if you configure Kubelet's configurations flags.
An experimental feature release adds guest, CLI, template, VM-driver, and device capabilities. It also changes the Windows default driver and socket_vmnet access constraint, removes a host dependency, and updates nerdctl.
Check if affected (3)
breakingThe default VM driver, from wsl2 to qemu
Applies if you do not configure the VM driver.
breakingThe socket_vmnet access constraint
Applies if you use socket_vmnet.
breakingThe almalinux-kitten template, moved to experimental/
Applies if you use almalinux-kitten.
This release changes dependency composition and CoreDNS behavior. It adds a forward plugin directive and expands secondary-plugin zone support, while also addressing a non-64-bit build defect through a dependency adjustment.
A release with operator-visible behavior corrections, new capabilities, configuration changes, and updated defaults. The changes span CoreDNS core behavior and multiple plugins, with no security advisories or explicitly described vulnerabilities.
Action needed (1)
breakingGo TLS defaults in core
The core component uses Go TLS defaults in this release.
Check if affected (1)
breakingDefault truncate amount for bare truncate
Applies if you configure truncate.
A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.
Check if affected (2)
breakingThe CreateContainer constraint for stopped sandboxes
Applies if you use CreateContainer when the sandbox is not running.
breakingThe erofs default mkfs block size
Applies if you use erofs across platforms.
A maintenance release with CRI and image-distribution fixes. The CRI constraint on CreateContainer requests may require action, while the other fixes take effect through the upgrade.
Action needed (1)
breakingCreateContainer rejection for stopped sandboxes
The CRI now rejects CreateContainer requests when the sandbox is not running. This constraint ships in containerd v2.2.6.
containerd v2.0.11 fixes content storage pollution by limiting the fallback used during reference resolution. It also updates the Go toolchain to 1.26.5 and 1.25.12.
Source ↗containerd v1.7.34 fixes a CRI event-loss defect and updates the Go toolchain. It also upgrades several golang. dependencies.
This release includes a security-related dependency cleanup and a dependency update. The github. dependency moves from 1. to 1..
Action needed (1)
securityThe containerd v1 dependency, removed
The containerd v1 dependency is removed in Helm v3. to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.
Helm v4.2.3 is a maintenance release that updates the third-party dependency golang. from 0.53.0 to 0.54.0. The remaining release content concerns release navigation and a general upgrade recommendation.
A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang..
Action needed (1)
securityhighgolang. updated to v0.
The release updates golang. to v0. to resolve CVE-2026-46598, CVE-2026-39835, CVE-2026-39828, and CVE-2026-46597.
Check if affected (1)
securityCRL enforcement bypass on the gRPC listener, fixed
Applies if you configure --listen-client-http-urls.
k8gb v0.20.0 centers on ZoneDelegation-based DNS management, with TLSRoute and annotation support alongside changes to defaults and naming. The release also includes defect fixes and dependency updates, and no security advisories or vulnerabilities are identified.
Check if affected (4)
breakingThe Bootstrap service, removed
Applies if your configuration uses the Bootstrap service.
breakingThe dynamicZones setting, removed
Applies if your configuration uses dynamicZones.
breakingThe doFinalize default, set to false
Applies if you use doFinalize in ZoneDelegation finalization.
Lima v2.1.4 contains behavior fixes, FreeBSD template and general template updates, a nerdctl update from v2.3.3 to v2.3.4, and a change to the JSON network-list output. No security advisories or security-specific fixes are disclosed.
Source ↗CRI-O v1.35.5 includes an operator-facing correctness fix for container status ImageRef values after a CRI-O restart. It also updates CPU injection and gomaxprocs handling to account for workload partitioning and reduce potential Go scheduler throttling.
This release has no detailed changes available for display. The remaining release-note entry describes an operator-facing performance behavior update involving the gomaxprocs hook and CPU allocation.
CRI-O v1.34.10 is an operator-facing maintenance release with bug fixes in CPU allocation and container status reporting. It adjusts CPU handling to reduce scheduler throttling and preserves the ImageRef value across CRI-O restarts. No security advisories are identified.
A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.
Action needed (2)
securityhighgo. dependencies, updated to v1.
The go. and go. dependencies are updated from v1. to v1.. The updates address CVE-2026-29181 and CVE-2026-39883.
securityhighgolang., updated to v0.
The golang. dependency is updated to v0.. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.
Check if affected (1)
securityCRL enforcement bypass on the gRPC listener, fixed
Applies if --listen-client-http-urls is configured.
A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.
Action needed (1)
securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go. and go. were updated from v1. to v1.. The updates address CVE-2026-29181 and CVE-2026-39883.
Check if affected (1)
securityCRL enforcement with --listen-client-http-urls
Applies if --listen-client-http-urls is configured.
Helm v3.21.2 is a patch release that updates its Kubernetes client-library dependency set to v1.36. The release concerns compatibility with the expected Kubernetes v1.36 libraries, including client-go and related components.
A maintenance release that changes several defaults, updates dependencies, and fixes multiple security vulnerabilities. It also includes a fallback to scp for remote sources and destinations in auto mode.
Check if affected (5)
securitycriticalcontainerd v2.3.2 security fixes
Applies if you use containerd.
securityhighCVE-2026-53657 and GHSA-2j9v-p4xj-cjw2 guest agent socket fix
Applies if you run a QEMU VM that uses the guest agent socket.
breakingcontainerd. default on non-Linux guests
Applies if you run non-Linux guests.
containerd v2.1.9 includes security fixes alongside checkpoint-restore and image-label behavior changes, plus updates to bundled runc and the Go toolchain. The security fixes require the v2.1.9 release, while the other changes matter when their affected behavior is in use.
Action needed (5)
securitycriticalCVE-2026-53488 security fix
The CVE-2026-53488 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-xhf5-7wjv-pqxp.
securityhighCVE-2026-53492 security fix
The CVE-2026-53492 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-33vj-92qq-66hc.
securityhighCVE-2026-53489 security fix
The CVE-2026-53489 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-rgh6-rfwx-v388.
securitymediumCVE-2026-50195 security fix
The CVE-2026-50195 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-cvxm-645q-p574.
securitymediumCVE-2026-47262 security fix
The CVE-2026-47262 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-jpcc-p29g-p8mq.
containerd v1.7.33 includes security updates for containerd and go-jose, along with runtime and toolchain dependency updates. It also changes file-read bounds and image-config label propagation.
Action needed (2)
securitycriticalcontainerd security updates for CVE-2026-53488 and CVE-2026-47262
containerd ships security updates associated with CVE-2026-53488 and CVE-2026-47262. The release also includes GHSA-jpcc-p29g-p8mq and GHSA-xhf5-7wjv-pqxp.
securityhighgo-jose/go-jose/v3 updated to v3.0.5
go-jose/go-jose/v3 is updated to v3.0.5 to fix GHSA-78h2-9frx-2jm8 and CVE-2026-34986.
This release includes containerd security changes, behavior changes, and updates to the bundled runc binary and Go toolchain. The security advisories and runtime updates concern deployments that use the affected container runtime components.
Action needed (1)
securitycriticalcontainerd security fixes, including CVE-2026-53488
The containerd change is associated with CVE-2026-53488, CVE-2026-47262, GHSA-jpcc-p29g-p8mq, and GHSA-xhf5-7wjv-pqxp.
containerd v2.3.2 is a maintenance release with disclosed security fixes, correctness and behavior changes, and dependency and toolchain updates. The security fixes are the main concern for operators, while the other changes matter where the affected behavior is in use.
Action needed (1)
securitycriticalThe containerd security fixes
containerd v2.3.2 includes a security fix identified as CVE-2026-50195 and associated with CVE-2026-47262, CVE-2026-53488, CVE-2026-53489, CVE-2026-53492, GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, and GHSA-xhf5-7wjv-pqxp.
A maintenance release with disclosed security fixes, dependency and toolchain updates, and changes to checkpoint and image-processing behavior. User-database reads are bounded in openUserFile, which may reject inputs that previously worked.
Action needed (2)
securitycriticalSecurity fixes for five disclosed CVEs
The release includes fixes for CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262, along with the associated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, and GHSA-xhf5-7wjv-pqxp advisories.
breakingBounded openUserFile user-database reads
User-database file reads in openUserFile are now bounded, so inputs that previously worked may be rejected.
This release includes an operator-facing correctness fix in Helm. The remaining release-note material does not describe additional included changes.
Source ↗Helm v4.2.1 is a maintenance release with correctness fixes and dependency updates. It includes an update to golang. that addresses GO-2026-5026.
Action needed (1)
securitycriticalThe golang. dependency update for GO-2026-5026
Helm v4.2.1 updates golang. to v0.55.0 to address GO-2026-5026.
