AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with correctness fixes and a security-related dependency update. The dependency update is recorded in the manifest and has no standalone operator impact.
Action needed (1)
securitySecurity updates for golang. and golang.
The dependency manifest updates golang. and golang. to include security updates.
A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.
Action needed (1)
securityhighGo 1. security fixes
The release is built with Go 1., including fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.
Check if affected (3)
securityplugin/acl autopath ACL checks
Applies if you use plugin/acl and autopath.
breakingplugin/forward default connection attempts
Applies if you use plugin/forward.
breakingplugin/hosts unsupported-type fallthrough
Applies if you use plugin/hosts.
A maintenance release with correctness fixes and dependency updates tied to GO advisories. The changes affect Helm users through both general fixes and updated Go dependencies.
Action needed (2)
securitymediumThe go. dependency upgrade for GO-2026-5158
go. was upgraded to v1.44.0 for advisory GO-2026-5158.
securityThe google. dependency upgrade for GO-2026-6061
google. was upgraded from 1.80.0 to 1.82.1 for advisory GO-2026-6061.
This cri-o release includes a fix for a disclosed security vulnerability alongside runtime behavior, monitoring configuration, metric, and dependency updates. It is most relevant to deployments affected by the HOME environment-variable issue or the related observability and CNI configuration changes.
Action needed (1)
securityhighCVE-2026-15809 HOME environment-variable injection fix
cri-o v1.36.3 fixes CVE-2026-15809. The vulnerability allowed a bypass of the CVE-2022-4318 fix, enabling /etc/passwd injection through newline characters in the HOME environment variable.
A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.
Action needed (3)
securityhighThe google. dependency update
The release updates google. to version 1. to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.
Check if affected (1)
securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.
A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.
Action needed (5)
securitycriticalThe golang. dependency update
The golang. dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.
securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8
An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3
The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.
securityhighThe google. dependency update
The google. dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default value
The default value for snapshotLimitByte is set to a reasonable value in this release.
A maintenance release with correctness and security fixes, timeout behavior changes, and dependency and toolchain updates. It also updates the build toolchain used to compile binaries.
Action needed (5)
securityhighWatch response authorization for key ranges
The watch authorization issue is fixed: a user with read permission on one key could no longer receive watch responses for every key starting from that key. The fix addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener
A tlsHandshakeTimeout is set for tlsListener. The change addresses GHSA-6vch-q96h-7gc3.
securityhighThe golang. dependency, updated to v0.56.0
The golang. dependency is updated to v0.56.0 to address GO-2026-5942.
securityhighThe golang. dependency, updated to v0.39.0
The golang. dependency is updated to v0.39.0 to address GO-2026-5970.
securityhighThe google. dependency, updated to 1.82.1
The google. dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
This release includes a security-related dependency cleanup and a dependency update. The github. dependency moves from 1. to 1..
Action needed (1)
securityThe containerd v1 dependency, removed
The containerd v1 dependency is removed in Helm v3. to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.
A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang..
Action needed (1)
securityhighgolang. updated to v0.
The release updates golang. to v0. to resolve CVE-2026-46598, CVE-2026-39835, CVE-2026-39828, and CVE-2026-46597.
Check if affected (1)
securityCRL enforcement bypass on the gRPC listener, fixed
Applies if you configure --listen-client-http-urls.
A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.
Action needed (2)
securityhighgo. dependencies, updated to v1.
The go. and go. dependencies are updated from v1. to v1.. The updates address CVE-2026-29181 and CVE-2026-39883.
securityhighgolang., updated to v0.
The golang. dependency is updated to v0.. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.
Check if affected (1)
securityCRL enforcement bypass on the gRPC listener, fixed
Applies if --listen-client-http-urls is configured.
A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.
Action needed (1)
securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go. and go. were updated from v1. to v1.. The updates address CVE-2026-29181 and CVE-2026-39883.
Check if affected (1)
securityCRL enforcement with --listen-client-http-urls
Applies if --listen-client-http-urls is configured.
A maintenance release that changes several defaults, updates dependencies, and fixes multiple security vulnerabilities. It also includes a fallback to scp for remote sources and destinations in auto mode.
Check if affected (5)
securitycriticalcontainerd v2.3.2 security fixes
Applies if you use containerd.
securityhighCVE-2026-53657 and GHSA-2j9v-p4xj-cjw2 guest agent socket fix
Applies if you run a QEMU VM that uses the guest agent socket.
breakingcontainerd. default on non-Linux guests
Applies if you run non-Linux guests.
containerd v2.1.9 includes security fixes alongside checkpoint-restore and image-label behavior changes, plus updates to bundled runc and the Go toolchain. The security fixes require the v2.1.9 release, while the other changes matter when their affected behavior is in use.
Action needed (5)
securitycriticalCVE-2026-53488 security fix
The CVE-2026-53488 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-xhf5-7wjv-pqxp.
securityhighCVE-2026-53492 security fix
The CVE-2026-53492 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-33vj-92qq-66hc.
securityhighCVE-2026-53489 security fix
The CVE-2026-53489 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-rgh6-rfwx-v388.
securitymediumCVE-2026-50195 security fix
The CVE-2026-50195 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-cvxm-645q-p574.
securitymediumCVE-2026-47262 security fix
The CVE-2026-47262 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-jpcc-p29g-p8mq.
containerd v1.7.33 includes security updates for containerd and go-jose, along with runtime and toolchain dependency updates. It also changes file-read bounds and image-config label propagation.
Action needed (2)
securitycriticalcontainerd security updates for CVE-2026-53488 and CVE-2026-47262
containerd ships security updates associated with CVE-2026-53488 and CVE-2026-47262. The release also includes GHSA-jpcc-p29g-p8mq and GHSA-xhf5-7wjv-pqxp.
securityhighgo-jose/go-jose/v3 updated to v3.0.5
go-jose/go-jose/v3 is updated to v3.0.5 to fix GHSA-78h2-9frx-2jm8 and CVE-2026-34986.
This release includes containerd security changes, behavior changes, and updates to the bundled runc binary and Go toolchain. The security advisories and runtime updates concern deployments that use the affected container runtime components.
Action needed (1)
securitycriticalcontainerd security fixes, including CVE-2026-53488
The containerd change is associated with CVE-2026-53488, CVE-2026-47262, GHSA-jpcc-p29g-p8mq, and GHSA-xhf5-7wjv-pqxp.
containerd v2.3.2 is a maintenance release with disclosed security fixes, correctness and behavior changes, and dependency and toolchain updates. The security fixes are the main concern for operators, while the other changes matter where the affected behavior is in use.
Action needed (1)
securitycriticalThe containerd security fixes
containerd v2.3.2 includes a security fix identified as CVE-2026-50195 and associated with CVE-2026-47262, CVE-2026-53488, CVE-2026-53489, CVE-2026-53492, GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, and GHSA-xhf5-7wjv-pqxp.
A maintenance release with disclosed security fixes, dependency and toolchain updates, and changes to checkpoint and image-processing behavior. User-database reads are bounded in openUserFile, which may reject inputs that previously worked.
Action needed (2)
securitycriticalSecurity fixes for five disclosed CVEs
The release includes fixes for CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262, along with the associated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, and GHSA-xhf5-7wjv-pqxp advisories.
breakingBounded openUserFile user-database reads
User-database file reads in openUserFile are now bounded, so inputs that previously worked may be rejected.
Helm v4.2.1 is a maintenance release with correctness fixes and dependency updates. It includes an update to golang. that addresses GO-2026-5026.
Action needed (1)
securitycriticalThe golang. dependency update for GO-2026-5026
Helm v4.2.1 updates golang. to v0.55.0 to address GO-2026-5026.
Helm v3.21.1 includes dependency and toolchain updates alongside fixes for correctness issues. The disclosed dependency update affects releases using golang..
Action needed (1)
securitycriticalThe golang. dependency, updated for GO-2026-5026
Helm v3.21.1 bumps golang. to v0. to address GO-2026-5026.
containerd v2.1.8 includes a disclosed security correction identified by CVE-2026-46680 and GHSA-fqw6-gf59-qr4w. The release also contains operator-facing runtime and snapshotter changes in its broader changelog.
Action needed (1)
securityhighCVE-2026-46680 security correction
containerd v2.1.8 includes a correction for CVE-2026-46680, associated with GHSA-fqw6-gf59-qr4w.
A maintenance release with correctness fixes and dependency updates. The golang. update addresses GO-2026-5026.
Action needed (1)
securitycriticalThe golang. dependency update for GO-2026-5026
The golang. dependency is updated to v0. to address GO-2026-5026.
A maintenance release with security updates, including a dependency update tied to an advisory. It also includes compatibility and runtime changes across storage, policy, sandbox, validation, and toolchain areas.
Action needed (2)
securityhighCVE-2026-46680 security update
The release records CVE-2026-46680, also identified as GHSA-fqw6-gf59-qr4w, as a security update in containerd.
securityhighgo-jose/go-jose updated to v4.
The go-jose/go-jose dependency was updated to v4. to fix GHSA-78h2-9frx-2jm8, also identified as CVE-2026-34986.
A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.
Action needed (1)
securityhighThe CVE-2026-46680 security fix
A security fix for CVE-2026-46680, also identified as GHSA-fqw6-gf59-qr4w, ships in this release.
Check if affected (1)
breakingThe default seccomp socket policy
Applies if you use seccomp.
containerd v1.7.32 includes a disclosed security advisory alongside correctness and compatibility fixes. The release concerns users assessing security exposure or changes in runtime and configuration behavior.
Action needed (1)
securityhighCVE-2026-46680 security fix
containerd v1.7.32 includes a fix associated with CVE-2026-46680 and GHSA-fqw6-gf59-qr4w.
A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.
Action needed (1)
securityhighCVE-2026-46680 correction
The fix for CVE-2026-46680 ships in this release.
Check if affected (1)
breakingThe overlayfs "rebase" capability, disabled in user namespaces
Applies if you use overlayfs and run in a user namespace.
Plan ahead (1)
deprecatedTask fields in Runc options, deprecated
Applies if you configure task fields in Runc options.
Helm v3.21.0 is a maintenance release with dependency updates and fixes to chart and OCI handling. It also includes a security fix in the opentelemetry packages.
Action needed (1)
securityThe opentelemetry packages, upgraded for CVE patches
Helm v3.21.0 upgrades the opentelemetry packages to patch CVEs.
A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.
Action needed (1)
securityhighgo. update for GO-2026-4394
Helm v4.2.0 updates go. to v1.40.0 for GO-2026-4394.
Check if affected (1)
securityPlugin version path traversal fix
Applies if you use the Plugin extension.
Plan ahead (1)
deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated
Applies if you use --hide-notes or --render-subchart-notes.
CRI-O v1.36.0 is a substantive operator-facing feature and maintenance release with runtime and operational changes. It also includes a security update to spdystream and a broad dependency refresh.
Action needed (1)
securityhighThe spdystream dependency update for CVE-2026-35469
CRI-O v1.36.0 updates the spdystream dependency to fix CVE-2026-35469.
A maintenance release that adds a runtime metric and a GOMAXPROCS configuration field, fixes two runtime defects, and reverts CNI monitoring after node bootstrapping regressions. It also updates the spdystream dependency to address CVE-2026-35469.
Action needed (2)
securityhighThe spdystream dependency update for CVE-2026-35469
The spdystream dependency is updated to address CVE-2026-35469. The update ships in this release.
breakingCRI-O CNI monitoring, reverted
CRI-O reverts CNI monitoring because it caused node bootstrapping regressions. The change ships in this release.
CRI-O v1.34.8 includes a security-relevant dependency update and adds operator-facing observability and configuration capabilities. The dependency update is the release change that requires upgrading, while the other additions concern optional setup or informational use.
Action needed (1)
securityhighCVE-2026-35469 fix in the spdystream dependency
CRI-O v1.34.8 updates the spdystream dependency to fix CVE-2026-35469.
CRI-O v1.33.12 includes a security fix for a disclosed vulnerability in the spdystream dependency. It also adds the min_injected_gomaxprocs configuration field for controlling the floor of injected GOMAXPROCS values.
Action needed (1)
securityhighCVE-2026-35469 fix in the spdystream dependency
CVE-2026-35469 is fixed by updating the spdystream dependency in CRI-O v1.33.12.
A maintenance release with a correctness fix, an RBAC authorization bypass fix, and a security-related dependency update for GO-2026-4962. It also records Go 1. as the toolchain used to build the binaries.
Action needed (1)
securitymediumgolang. update for GO-2026-4962
The release updates golang. to v0. to resolve GO-2026-4962.
Check if affected (1)
securityRBAC authorization bypass in nested Put requests
Applies if you use RBAC.
A maintenance release with a security fix for an RBAC authorization bypass in transaction handling. It also includes an ordinary correctness fix and a Go toolchain dependency update.
Action needed (1)
securityRBAC authorization bypass in nested etcd transactions
The release fixes an RBAC authorization bypass that allowed read access through PrevKv or lease attachment in Put requests nested in etcd transactions. The fix ships in this release.
A security maintenance release fixes an RBAC authorization bypass. It also updates the Go toolchain used to compile binaries to go 1..
Check if affected (1)
securityRBAC authorization bypass fix
Applies if you use RBAC.
A maintenance release that adds operator-facing options and transport, plugin, and protocol support while correcting defects. It is built with Go 1., which contains fixes for disclosed CVEs; other changes concern operators using the affected features or behaviors.
Action needed (1)
securitycriticalGo 1. build with security fixes
The release is built with Go 1., which includes security fixes for CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.
Check if affected (1)
breakingOversized DoH GET query parameter rejection
Applies if you use DoH.
containerd v2.2.3 includes a disclosed security-related update to spdystream, alongside correctness, runtime, extraction, and dependency/toolchain changes. The recorded advisory is CVE-2026-35469.
Action needed (1)
securityhighspdystream dependency update for CVE-2026-35469
The spdystream dependency is updated in containerd v2.2.3 in connection with CVE-2026-35469.
containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.
Action needed (1)
securityhighThe spdystream update for CVE-2026-35469
The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.
Check if affected (1)
securityCredential sanitization before gRPC returns
Applies if you use pod events through the Container Runtime Interface (CRI).
A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.
Action needed (2)
securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2
The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.
securityhighgithub. v0.5.1 update
The release updates github. to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Check if affected (1)
securityCredential sanitization before gRPC returns
Applies if pod events are used.
containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.
Action needed (1)
securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Check if affected (1)
securitySanitized gRPC errors in pod events
Applies if you use pod events.
A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.
Check if affected (1)
securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.
