Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Strimzi0.51.0Networking & MessagingMar 6, 2026

ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.
breakingThe ServerSideApplyPhase1 feature gate default
The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

breakingKubernetes version support
Applies if you use Kubernetes 1.27, 1.28, or 1.29.
breakingKafka 4.0.0 and 4.0.1 support
Applies if you use Kafka 4.0.0 or 4.0.1.

Plan ahead (1)

deprecatedThe ingress listener type deprecation
Applies if you configure the ingress listener type.

Contourv1.33.2Networking & MessagingFeb 20, 2026

OTHER 4View full analysis

Contour v1.33.2 includes compatibility updates, a container resource adjustment, a correction to the HTTPProxy CRD schema, and a Go toolchain update. No individual release changes are provided for display here.

Contourv1.32.3Networking & MessagingFeb 20, 2026

OTHER 3View full analysis

Contour v1.32.3 updates the Go dependency, corrects an HTTPProxy CRD schema defect, and documents the Kubernetes versions tested with the release. No individual change details are available here.

Contourv1.31.4Networking & MessagingFeb 20, 2026

OTHER 3View full analysis

Contour v1.31.4 updates the Go toolchain to v1.24.13 and corrects an HTTPProxy status schema defect that affected load balancer status updates. It is tested against Kubernetes 1.30 through 1.32, and no security advisories are disclosed.

gRPCv1.78.1Networking & MessagingFeb 20, 2026

View full analysis

This release contains no recorded changes for gRPC. The available release notes do not identify any project changes that affect users of gRPC v1.78.1.

Strimzi0.50.1Networking & MessagingFeb 19, 2026

ACTION 1PLAN 1OTHER 12View full analysis

A maintenance release with two security fixes and a deprecated KafkaUser API field that requires migration. It also includes API conversion fixes, broker certificate output changes, and dependency and container image updates.

Action needed (1)

securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
The release includes security fixes for CVE-2026-27133 and CVE-2026-27134.

Plan ahead (1)

deprecatedThe .spec.authorization.acls[]operation field is deprecated
Applies if you configure .spec.authorization.acls[]operation.

Linkerdedge-26.2.1Networking & MessagingFeb 17, 2026

OTHER 20View full analysis

This release focuses on dependency and component upgrades. It adds no new operator capabilities or stated security changes, and it requires no setup changes beyond upgrading.

Ciliumv1.19.1Networking & MessagingFeb 17, 2026

OTHER 18View full analysis

Cilium v1.19.1 contains routine bug fixes, performance improvements, and dependency and image updates. The available release information does not identify security advisories or explicitly described security flaws.

Istio1.28.4Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 7View full analysis

A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.

Action needed (1)

securityhighCVE-2025-61732 cgo comment parsing flaw
This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Check if affected (4)

securitycriticalCVE-2025-68121 TLS session resumption validation
Applies if you use Config.Clone with mutations or Config.GetConfigForClient.
securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
securityResource annotation validation against container injection
Applies if you configure resource annotations.
+ 1 more on the release page

Istio1.27.7Networking & MessagingFeb 16, 2026

ACTION 2View full analysis

A security release addressing two vulnerabilities in cgo comment parsing and crypto/tls session resumption. The fixes are relevant to deployments using the affected Go functionality.

Action needed (2)

securitycriticalCVE-2025-68121 session resumption vulnerability correction
CVE-2025-68121 corrects a crypto/tls session resumption flaw that could let resumed handshakes succeed after ClientCAs or RootCAs changed between the initial and resumed handshake.
securityhighCVE-2025-61732 code-smuggling vulnerability correction
CVE-2025-61732 addresses a discrepancy in Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Istio1.29.0Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 18View full analysis

This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.

Action needed (1)

breakingAutomatic GOMEMLIMIT setting for istiod
istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

breakingDefault iptables reconciliation
Applies when the istio-cni DaemonSet is upgraded.
breakingDefault debug endpoint authorization
Applies to debug endpoints on port 15014.
breakingDefault HTTP compression for Envoy metrics
Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.
+ 1 more on the release page

Ciliumv1.18.7Networking & MessagingFeb 13, 2026

ACTION 1OTHER 27View full analysis

A maintenance release combining an operator-facing configuration adjustment with bug fixes and routine dependency and image refreshes. No security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingExclusion of topology.kubernetes.io labels from security labels by default
The default security-label handling in this release excludes topology.kubernetes.io labels from security labels.

Ciliumv1.17.13Networking & MessagingFeb 13, 2026

OTHER 17View full analysis

This release is focused on dependency and container image maintenance, including a runtime dependency addition and updated installation image digests. No security issues or operator configuration changes are disclosed.

Istio1.27.6Networking & MessagingFeb 10, 2026

ACTION 1CHECK 2OTHER 2View full analysis

This release includes security safeguards for gateway resource creation and pod specification rendering, along with stricter authorization for debug endpoints. It also adds a Helm configuration field and corrects a TLS configuration mapping.

Action needed (1)

securityResource annotation validation
Resource annotation validation now rejects newline and control characters that could inject containers into pod specifications through template rendering.

Check if affected (2)

securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
breakingNamespace-based authorization for debug endpoints
Applies if you use debug endpoints on port 15014.

gRPCv1.78.0Networking & MessagingFeb 4, 2026

OTHER 6View full analysis

This release contains fixes for protobuf compiler fallback behavior, an asyncio.run() shutdown hang, and Ruby 4 compatibility. It also updates the Python build system and setuptools minimum version, and adds debug-level details for ExecuteBatchError logging.

Ciliumv1.19.0Networking & MessagingFeb 4, 2026

ACTION 15CHECK 30PLAN 7OTHER 436View full analysis

A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.

Action needed (15)

securityThe github.com/containerd/containerd dependency, updated
The github.com/containerd/containerd module is updated to v1.7.29.
securityThe github.com/go-viper/mapstructure/v2 dependency, updated
The github.com/go-viper/mapstructure/v2 module is updated to v2.4.0.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker module is updated to v28.3.3+incompatible.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto module is updated to v0.45.0.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.4
The helm.sh/helm/v3 module is updated to v3.18.4.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.5
The helm.sh/helm/v3 module is updated to v3.18.5.
breakingThe plpmtud default, set to blackhole
The default plpmtud mode is now blackhole (blackhole-detected).
breakingThe AddressScopeMax default, set to 254
The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.
breakingThe tls authMode default, set to migration
tls authMode is set to migration by default.
breakingThe CNI deletion timeout, reduced to 1.5 seconds
The CNI deletion timeout is reduced to 1.5 seconds.
breakingThe policy-default-local-cluster default
policy-default-local-cluster is now set by default.
breakingHost firewall bypass, disabled by default
Host firewall bypass is disabled by default.
breakingFQDN match pattern sanitization
FQDN match pattern sanitization is refactored and tightened.
breakingEncrypted traffic forwarding via cilium_host, removed
Forwarding encrypted traffic via cilium_host has been removed.
breakingCNI configuration in the container image, removed
The CNI configuration is no longer installed in the container image.

Check if affected (30)

breakingLocal-cluster default for network policy selectors
Applies if you do not set cluster in network policy selectors.
breakingThe CiliumBGPPeeringPolicy v1 API, removed
Applies if you use CiliumBGPPeeringPolicy.
breakingMutual Authentication, disabled by default
Applies if you enable Mutual Authentication.
+ 27 more on the release page

Plan ahead (7)

deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced
Applies if you use --enable-ipsec-encrypted-overlay.
deprecatedKafka match fields and ToRequires and FromRequires, deprecated
Applies if you use ToRequires or FromRequires.
deprecatedTLS certificate and key Helm values, deprecated
Applies if you pass TLS certificates or keys in Helm values.
+ 4 more on the release page

Linkerdedge-26.1.4Networking & MessagingJan 29, 2026

OTHER 16View full analysis

This release adds proxy support for the P256+SHA512 and P384+SHA512 cryptographic signature algorithms. It also updates the proxy and several build and development dependencies. No security advisory or explicitly exploitable vulnerability is disclosed.

NATSv2.12.4Networking & MessagingJan 27, 2026

OTHER 32View full analysis

NATS v2.12.4 is a maintenance release focused on correctness across JetStream, configuration, storage, clustering, and consumer behavior. It also updates the Go toolchain and adds TLS certificate expiry information to the varz monitoring endpoint; no security advisories or explicitly described security flaws are included.

NATSv2.11.12Networking & MessagingJan 27, 2026

OTHER 65View full analysis

NATS v2.11.12 is a maintenance release with WebSocket and monitoring configuration and output additions, along with JetStream and MQTT behavior and performance improvements. It also corrects a broad range of correctness issues; no security advisories or explicitly described security vulnerabilities are identified.

Linkerdedge-26.1.3Networking & MessagingJan 23, 2026

OTHER 21View full analysis

This release adds the inbound_http_statuses_total and inbound_grpc_statuses_total metrics for inbound HTTP and gRPC traffic. It also updates multiple dependencies and the proxy component to version v2.337.0; no security advisories or security-specific fixes are disclosed.

Istio1.28.3Networking & MessagingJan 20, 2026

OTHER 4View full analysis

Istio 1.28.3 is a maintenance release focused on Helm configuration and runtime correctness. It adds a service selector customization for revision-based migrations and addresses issues in ambient and pod-management paths.

Strimzi0.50.0Networking & MessagingJan 18, 2026

CHECK 1OTHER 1View full analysis

Strimzi 0.50.0 includes Java 21 adoption for the operators, with compatibility exceptions for several modules. It also changes connector plugin version configuration, so existing settings that use the rejected option are affected.

Check if affected (1)

breakingThe connector.plugin.version option, forbidden in connector configurations
Applies if you use connector.plugin.version in KafkaConnect or KafkaMirrorMaker2 connector configuration.

Linkerdedge-26.1.2Networking & MessagingJan 14, 2026

OTHER 5View full analysis

This release combines dependency and component version updates with a correctness fix in the policy controller's resource watches. The fix logs resources that cannot be deserialized and skips those events so the watch continues.

Ciliumv1.18.6Networking & MessagingJan 13, 2026

ACTION 1OTHER 21View full analysis

A maintenance release with fixes for networking, policy, proxy, gateway API, and endpoint handling, plus dependency, image, and OCI publishing updates. The Cilium Preflight check no longer includes Envoy Configmaps.

Action needed (1)

breakingCilium Preflight check no longer includes Envoy Configmaps
The Cilium Preflight check no longer includes Envoy Configmaps. This change ships in v1.18.6.

Envoyv1.37.0Networking & MessagingJan 13, 2026

ACTION 1CHECK 2PLAN 1OTHER 30View full analysis

This release adds dynamic-module, filter, routing, observability, and certificate capabilities, along with fixes and performance improvements across HTTP, networking, and protocol handling. It also changes HTTP reset behavior, removes runtime guards and legacy code paths, and deprecates the OpenTelemetry access log common_config field.

Action needed (1)

breakingRuntime guards and legacy code paths removed
Multiple runtime guards and legacy code paths are removed in this release.

Check if affected (2)

breakingDefault HTTP reset code changed
Applicability is not stated in the release notes.
breakingDefault upstream protocol error reset handling changed
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedOpenTelemetry access log common_config field deprecated
Applies if you configure common_config.

Linkerdedge-26.1.1Networking & MessagingJan 9, 2026

OTHER 10View full analysis

Linkerd edge-26.1.1 contains dependency, toolchain, CI action, and proxy version updates. No security advisories or operator-facing functional changes are disclosed.

Container Network Interface (CNI)v1.3.0Networking & MessagingApr 7, 2025

OTHER 1View full analysis

CNI v1.3.0 adds an opt-in way to load chained plugin configurations from per-network subdirectories. Existing inline plugin configuration behavior remains supported, so the change concerns setups that choose folder-based loading.

CloudEvents[email protected]Networking & MessagingJun 17, 2024

OTHER 11View full analysis

CESQL v1.0.0 is a specification-focused release for operator-facing expression behavior. It clarifies evaluation, typing, built-in and user-defined functions, and error handling, including defined return values in fail-fast cases.

CloudEvents[email protected]Networking & MessagingFeb 6, 2022

CHECK 1OTHER 9View full analysis

This CloudEvents release updates protocol and binding behavior, including clarifications to headers, formats, and extensions. The header rename concerns integrations that use the Webhook header.

Check if affected (1)

breakingThe Webhook-Request-Origin header, renamed to Webhook-Allowed-Origin
Applies if you use Webhook headers in CloudEvents HTTP bindings.

CloudEvents[email protected]Networking & MessagingDec 12, 2020

OTHER 9View full analysis

This release updates CloudEvents protocol formats, bindings, extensions, and normative definitions. The recorded release scope includes both new protocol support and clarifications to existing specifications.

CloudEvents[email protected]Networking & MessagingOct 24, 2019

OTHER 5View full analysis

CloudEvents 1.0 updates specification coverage and terminology. The release adds a CouchDB adapter specification and adjusts constraints and definitions in existing protocol specifications.

← NewerMar 6, 2026 – Oct 24, 2019

Browse by month