AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with correctness fixes and a security-related dependency update. The dependency update is recorded in the manifest and has no standalone operator impact.
Action needed (1)
securitySecurity updates for golang. and golang.
The dependency manifest updates golang. and golang. to include security updates.
A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.
Action needed (1)
securityhighGo 1. security fixes
The release is built with Go 1., including fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.
Check if affected (3)
securityplugin/acl autopath ACL checks
Applies if you use plugin/acl and autopath.
breakingplugin/forward default connection attempts
Applies if you use plugin/forward.
breakingplugin/hosts unsupported-type fallthrough
Applies if you use plugin/hosts.
A maintenance release with correctness fixes and dependency updates tied to GO advisories. The changes affect Helm users through both general fixes and updated Go dependencies.
Action needed (2)
securitymediumThe go. dependency upgrade for GO-2026-5158
go. was upgraded to v1.44.0 for advisory GO-2026-5158.
securityThe google. dependency upgrade for GO-2026-6061
google. was upgraded from 1.80.0 to 1.82.1 for advisory GO-2026-6061.
A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.
Check if affected (3)
breakingThe enable_experimental_restore_via_create default
Applies if you use CreateContainer.
breakingThe ScrubLogs default on Windows
Applies if you run on Windows.
breakingCheckpoint restore without CRIU
Applies if you do not have CRIU installed.
Plan ahead (1)
deprecatedRestore in CreateContainer, deprecated
Applies if you use CreateContainer.
A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.
Check if affected (3)
breakingCheckpoint restore in CreateContainer disabled by default
Applies if you set enable_experimental_restore_via_create.
breakingruntimeFeatures. enabled by default
Applies if you run CRI.
breakingLog scrubbing enabled by default on Windows
Applies if you run Windows.
Plan ahead (1)
deprecatedCheckpoint restore in CreateContainer deprecated
Applies if you use CreateContainer.
This release fixes user-namespace UID/GID restoration after CRI-O restart, reduces debug-log verbosity for List* RPC calls, and restores pre-1.34 handling of environment-variable values containing non-UTF-8 data. It also updates or removes dependencies listed in the dependency manifest.
CRI-O v1.34.11 includes a correctness fix that restores prior handling of environment-variable values containing non-UTF-8 data. No detailed change item is provided here.
Source ↗This cri-o release includes a fix for a disclosed security vulnerability alongside runtime behavior, monitoring configuration, metric, and dependency updates. It is most relevant to deployments affected by the HOME environment-variable issue or the related observability and CNI configuration changes.
Action needed (1)
securityhighCVE-2026-15809 HOME environment-variable injection fix
cri-o v1.36.3 fixes CVE-2026-15809. The vulnerability allowed a bypass of the CVE-2022-4318 fix, enabling /etc/passwd injection through newline characters in the HOME environment variable.
