AI-analyzed release notes for CNCF graduated and incubating projects.
A feature release adds JetStream, leafnode, configuration, and protocol capabilities alongside fixes. Operator attention is needed for the narrowed MQTT retained-message subject constraint and ACL updates when domain-aware acknowledgements and flow control are enabled; the Go toolchain version also changes.
Check if affected (1)
breakingThe retained-message subject constraint
Applies if you use retained messages.
A release that removes older CRD API versions, changes defaults and configuration locations, and adds Kafka and HTTP Bridge capabilities. Monitoring configurations and standalone Topic Operator setups may require updates.
Action needed (2)
breakingThe UseConnectBuildWithBuildah feature gate, enabled by default
The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default.
breakingThe /metrics endpoint, moved to the HTTP management interface
The /metrics endpoint is no longer available on the regular HTTP interface, which uses port 8080 by default. It is now available on the HTTP management interface on port 8081.
Check if affected (4)
breakingOlder CRD API versions, removed
Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.
breakingThe Open Policy Agent (OPA) authorizer plugin, no longer bundled
Applies if you use the Open Policy Agent (OPA) authorizer plugin.
breakingLegacy TLS environment variables, ignored
Applies if you set any of STRIMZI_TLS_ENABLED, STRIMZI_TLS_AUTH_ENABLED, STRIMZI_PUBLIC_CA, STRIMZI_TRUSTSTORE_LOCATION, STRIMZI_TRUSTSTORE_PASSWORD, STRIMZI_KEYSTORE_LOCATION, or STRIMZI_KEYSTORE_PASSWORD.
A maintenance release with a security fix, correctness fixes, a performance improvement, and dependency and toolchain manifest updates. Most changes take effect through the release itself without additional operator action.
Action needed (1)
securityBearer JWT disclosure fix in /connz
The /connz monitoring endpoint no longer discloses bearer JWTs. The fix ships in the NATS monitoring endpoint.
A maintenance release updates the Go toolchain and corrects NATS server defects. It includes fixes for bearer credential disclosure through monitoring and for redaction of route and cluster URL secrets.
Check if affected (2)
securityThe /connz endpoint no longer discloses bearer JWTs
Applies if you use the /connz monitoring endpoint.
securityMonitoring redaction of route and cluster URL secrets
Applies if you pass route and cluster URL secrets as command line arguments.
This Linkerd edge release contains correctness fixes, proxy and proxy-init/CNI updates, and dependency version changes. No security advisories or security-specific flaws are disclosed.
Source ↗A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.
Action needed (1)
securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.
Check if affected (6)
securityURL encoding for query_parameter_mutations values
Applies if you configure query_parameter_mutations.
securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
breakingExplicit max_early_data_bytes configuration
Applies if you configure upstream_connect_mode with a value other than IMMEDIATE and do not configure max_early_data_bytes.
Plan ahead (1)
deprecatedThe enforce_rsa_key_usage option, deprecatedremoval date not announced
Applies if you configure enforce_rsa_key_usage.
A release with a fix for Lua code injection, a required Envoy version change, and an Envoy dependency update. It is tested against Kubernetes 1.32 through 1.34.
Check if affected (2)
securityhighCVE-2026-41246 fix for cookieRewritePolicies[].
Applies if you use HTTPProxy resources.
breakingEnvoy 1.35.0 minimum version
Applies if you depend on Envoy.
Contour v1.32.5 fixes a Lua code injection vulnerability and upgrades Envoy to v1.34.14. The release also includes an informational Kubernetes compatibility update.
Action needed (1)
securityhighCVE-2026-41246 Lua code injection vulnerability fixed
This release fixes CVE-2026-41246 and GHSA-x4mj-7f9g-29h4, a Lua code injection vulnerability affecting cookieRewritePolicies[]..
This release fixes a Lua code injection vulnerability in Contour's Cookie Rewriting feature and updates Envoy to v1.. It is tested against Kubernetes 1.30 through 1.32.
Check if affected (1)
securityhighLua code injection fix for CVE-2026-41246
Applies if you configure cookieRewritePolicies[]..
Cilium v1.19.3 combines operator-relevant bug fixes with configuration and CLI additions, along with dependency and image updates. The release is relevant to deployments using the affected functionality and to users tracking dependency changes.
Action needed (1)
securityThe github. module update
The github. module is updated to v4.1.4 in the v1.19.3 release. The update is marked as security-related.
Cilium v1.18.9 contains correctness fixes and dependency updates. It also includes security-related changes, including an injection-prevention fix and a security-tagged module update.
Action needed (2)
securityRegex dollar-sign escaping for injection prevention
Regex handling now escapes the $ character to prevent injection. The fix ships in Cilium v1.18.9.
securityThe github. dependency update
The github. module is updated to v4.1.4 in Cilium v1.18.9. The release note marks this dependency update as security-related.
Cilium v1.17.15 is a maintenance release with bug fixes, dependency and image updates, EKS API server hardening, and BPF behavior changes. No security advisory or explicit vulnerability is disclosed.
Source ↗Linkerd edge-26.4.3 adds a proxy environment override annotation and updates the bundled proxy and several dependencies. No disclosed security advisories are listed for this release.
Source ↗A maintenance release with a dependency and toolchain update, configuration constraint changes, performance improvements, and correctness fixes. It also fixes an ACL permission bypass along with issues affecting leaf connections, streams, storage, and client authentication.
Check if affected (3)
securityQueue subscription enforcement of ACL deny patterns
Applies if you use queue subscriptions and configure non-queue ACL deny patterns.
breakingThe no_auth_user configuration field, restricted to client connections
Applies if you configure no_auth_user.
breakingDuplicate INFO permission updates for solicited leaf connections
Applies if you use solicited leaf connections.
This release updates the Go toolchain and corrects authorization, leafnode, and WebSocket behavior. Configuration rules for no_auth_user and duplicate leaf permission updates are narrower, so affected existing setups may require review.
Check if affected (2)
breakingThe no_auth_user connection scope restriction
Applies if you configure no_auth_user.
breakingThe INFO permission update restriction
Applies if you use solicited leaf connections.
A maintenance release adds Helm v4 server-side apply support and includes numerous correctness fixes. The WASM decompression size-limit change affects inputs that were previously accepted and may require operator review.
Action needed (1)
breakingThe gzip decompression size limit for WASM binaries
A size limit is now enforced on gzip-decompressed WASM binaries fetched over HTTP.
Istio 1.28.6 is a maintenance release with operator-facing additions and defect corrections. It includes updates related to Helm integration, authentication controls, Gateway API handling, ambient networking, and runtime behavior.
Source ↗A maintenance release with fixes for listener-removal crashes, incomplete request and response bodies, and request hangs during internal redirects. Docker release images are also updated.
Source ↗A maintenance release fixes incomplete request and response bodies in dynamic module filter chains and prevents request hangs when internal redirect buffers overflow. It also updates and fixes the Docker release images.
Source ↗A maintenance release includes a correction to the Docker release images. Nothing else here needs operator attention.
Source ↗This release contains an operator-facing correction to the Docker release images. No individual change details are available beyond that release-note heading.
Source ↗A maintenance release with routine dependency updates and the Linkerd proxy updated to v2.348.0. The release notes contain no explicit security advisories or security claims.
Source ↗A maintenance release contains fixes for control-plane and networking behavior, including startup compatibility, policy matching, Gateway API routing, and intermittent proxy error logs. Operators using these areas may see changes in behavior.
Source ↗This Linkerd release includes proxy correctness fixes, operator-visible configuration changes, and added multicluster resources. It also updates dependencies and component versions, with no security advisories or explicitly described vulnerabilities.
Source ↗
