Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jul 2026Clear ×

etcdv3.7.1Kubernetes CoreJul 23, 2026

ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

securityhighThe google.golang.org/grpc dependency update
The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.

Source ↗

etcdv3.6.14Kubernetes CoreJul 23, 2026

ACTION 5OTHER 5View full analysis

A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.

Action needed (5)

securitycriticalThe golang.org/x/net dependency update
The golang.org/x/net dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.
securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8
An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3
The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.
securityhighThe google.golang.org/grpc dependency update
The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default value
The default value for snapshotLimitByte is set to a reasonable value in this release.

Source ↗

Limav2.2.0Kubernetes CoreJul 21, 2026

CHECK 3OTHER 18View full analysis

An experimental feature release adds guest, CLI, template, VM-driver, and device capabilities. It also changes the Windows default driver and socket_vmnet access constraint, removes a host dependency, and updates nerdctl.

Check if affected (3)

breakingThe default VM driver, from wsl2 to qemu
Applies if you do not configure the VM driver.
breakingThe socket_vmnet access constraint
Applies if you use socket_vmnet.
breakingThe almalinux-kitten template, moved to experimental/
Applies if you use almalinux-kitten.

Source ↗

CoreDNSv1.14.5Kubernetes CoreJul 10, 2026

ACTION 1CHECK 1OTHER 30View full analysis

A release with operator-visible behavior corrections, new capabilities, configuration changes, and updated defaults. The changes span CoreDNS core behavior and multiple plugins, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

breakingGo TLS defaults in core
The core component uses Go TLS defaults in this release.

Check if affected (1)

breakingDefault truncate amount for bare truncate
Applies if you configure truncate.

Source ↗

containerdv2.3.3Kubernetes CoreJul 10, 2026

CHECK 2OTHER 7View full analysis

A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.

Check if affected (2)

breakingThe CreateContainer constraint for stopped sandboxes
Applies if you use CreateContainer when the sandbox is not running.
breakingThe erofs default mkfs block size
Applies if you use erofs across platforms.

Source ↗

containerdv2.2.6Kubernetes CoreJul 9, 2026

ACTION 1OTHER 3View full analysis

A maintenance release with CRI and image-distribution fixes. The CRI constraint on CreateContainer requests may require action, while the other fixes take effect through the upgrade.

Action needed (1)

breakingCreateContainer rejection for stopped sandboxes
The CRI now rejects CreateContainer requests when the sandbox is not running. This constraint ships in containerd v2.2.6.

Source ↗

k8gbv0.20.0Kubernetes CoreJul 3, 2026

CHECK 4OTHER 49View full analysis

k8gb v0.20.0 centers on ZoneDelegation-based DNS management, with TLSRoute and annotation support alongside changes to defaults and naming. The release also includes defect fixes and dependency updates, and no security advisories or vulnerabilities are identified.

Check if affected (4)

breakingThe Bootstrap service, removed
Applies if your configuration uses the Bootstrap service.
breakingThe dynamicZones setting, removed
Applies if your configuration uses dynamicZones.
breakingThe doFinalize default, set to false
Applies if you use doFinalize in ZoneDelegation finalization.
+ 1 more on the release page

Source ↗

Browse by month