Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Crossplanev1.20.12Orchestration & ManagementYesterdayAug 21, 2026

ACTION 5OTHER 3View full analysis

A maintenance release with security-related dependency and toolchain updates, along with routine dependency and runtime version changes. No advisory identifiers are stated.

Action needed (5)

securityVulnerable dependency fixes
Vulnerable dependencies were updated in the release-1.20 branch.
securityVulnerable dependency updates
Vulnerable dependencies were updated in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module update
The github.com/go-git/go-git/v5 module was updated to version v5.19.2 in the release-1.20 branch.
securityThe golang.org/x/mod module update
The golang.org/x/mod module was updated to version v0.40.0 in the release-1.20 branch.
securityThe Go toolchain version 1.25.13
The Go toolchain was updated to version 1.25.13 in the release-1.20 branch.

Source ↗

Crossplanev2.2.5Orchestration & ManagementYesterdayAug 21, 2026

ACTION 1OTHER 2View full analysis

A maintenance release corrects binary checksum generation and deletion-protection indexing, and updates dependencies for upstream CVE fixes. The changes affect release verification, webhook deletion checks, and the dependency set shipped with the release.

Action needed (1)

securityDependency security updates
The release updates cel-go, golang.org/x/mod, sigstore-go, and go-git, along with a combined set of vulnerable dependency updates, to pick up upstream CVE fixes. It also bumps crossplane-runtime to v2.2.4, which carries its own security dependency updates.

Source ↗

Crossplanev2.3.5Orchestration & ManagementYesterdayAug 21, 2026

ACTION 4OTHER 4View full analysis

A maintenance release corrects binary checksum handling and the Usage index key, alongside updates to security-sensitive and build dependencies. The dependency changes require the new release, with no operator configuration migration stated.

Action needed (4)

securityThe golang.org/x/mod dependency update
The release updates golang.org/x/mod as a security-related dependency change.
securityThe github.com/sigstore/sigstore-go dependency, updated to v1.2.1
The release updates github.com/sigstore/sigstore-go to v1.2.1 as a security-related dependency change.
securityThe github.com/google/cel-go dependency, updated to v0.30.0
The release updates github.com/google/cel-go to v0.30.0 as a security-related dependency change.
securityThe crossplane-runtime dependency, bumped to v2.3.4
The release bumps crossplane-runtime to v2.3.4 as a security-related dependency change.

Source ↗

Crossplanev2.4.0Orchestration & ManagementAug 20, 2026

ACTION 15CHECK 4PLAN 1OTHER 33View full analysis

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

securityGo version and dependency security updates
Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.
securityGo 1.25.10
Go was updated to 1.25.10 to fix standard library CVEs.
securitygolang.org/x/crypto v0.52.0
The golang.org/x/crypto module was updated to v0.52.0 for security fixes.
securitygolang.org/x/sys v0.44.0
The golang.org/x/sys module was updated to v0.44.0 for security fixes.
securitygolang.org/x/net v0.55.0
The golang.org/x/net module was updated to v0.55.0 for security fixes.
securitygithub.com/sigstore/cosign/v3 v3.0.6
The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.
securitygithub.com/sigstore/rekor v1.5.2
The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.
securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0
The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.0
The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.
securityCombined grpc, x/net, and x/text security updates
Combined security updates were applied to grpc, x/net, and x/text.
securitygolang.org/x/net v0.56.0
The golang.org/x/net module was updated to v0.56.0 for security fixes.
securitygolang.org/x/text v0.39.0
The golang.org/x/text module was updated to v0.39.0 for security fixes.
securityVulnerable dependency updates
Vulnerable dependencies were updated for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.1
The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.
securitygolang.org/x/mod v0.40.0
The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

breakingCrossplane CLI publication location and binary name
Applies if you use the Crossplane CLI.
breakingspec.replicas behavior in DeploymentRuntimeConfig
Applies if DeploymentRuntimeConfig configures spec.replicas.
breakingNarrowed composed resource garbage collection
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (1)

deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)
Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.

Source ↗

Daprv1.16.19Orchestration & ManagementAug 15, 2026

OTHER 1View full analysis

A maintenance release with an operator-relevant correctness fix. The remaining note concerns SPIFFE SVID authentication context passed to operation calls.

Source ↗

Daprv1.18.3Orchestration & ManagementAug 14, 2026

OTHER 21View full analysis

A maintenance release with operator-facing correctness fixes, runtime behavior changes, a new configuration flag, and cron parser updates backed by a dependency change. It contains no security advisories or explicitly described vulnerabilities.

Source ↗

wasmCloudv2.7.0Orchestration & ManagementAug 11, 2026

ACTION 1OTHER 19View full analysis

wasmCloud v2.7.0 adds runtime, networking, plugin, TLS, and chart capabilities while correcting runtime and Helm/chart defects. It also changes defaults and updates dependencies.

Action needed (1)

breakingDefault-enabled implements and maps
implements and maps are enabled by default in wasmCloud v2.7.0.

Source ↗

Daprv1.17.12Orchestration & ManagementAug 6, 2026

ACTION 1OTHER 1View full analysis

This release contains a security-related build toolchain update and an input-binding startup fix. The probe timeout is configurable for applications with slow startup.

Action needed (1)

securityThe Go toolchain version, updated to 1.26.5
The Go version used to build Dapr is updated from 1.26.4 to 1.26.5 across the runtime, build tooling, and container images.

Source ↗

Karmadav1.18.2Orchestration & ManagementJul 31, 2026

ACTION 2CHECK 8PLAN 4OTHER 65View full analysis

A broad operator-impacting maintenance release with security-related base image updates, API and configuration changes, scheduling capabilities, and deprecations and removals. Operators should review changed defaults and constraints and account for migration work affecting their configurations, APIs, and metrics.

Action needed (2)

securityThe alpine base image update
The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns.
securityThe alpine base image update
The alpine base image is updated from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (8)

breakingThe cluster lease duration flags, removed
Applies if you configure either --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
breakingThe Estimator metric label value, removed
Applies if you use either estimating_plugin_execution_duration_seconds or estimating_plugin_extension_point_duration_seconds.
breakingThe Etcd.Local.InitImage configuration field, removed
Applies if you configure Etcd.Local.InitImage.
+ 5 more on the release page

Plan ahead (4)

deprecatedThe ReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ReplicaRequirements.resourceRequest.
deprecatedThe ComponentReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ComponentReplicaRequirements.resourceRequest.
deprecatedThe NodeClaim.nodeAffinity field deprecationdeprecated since v1.18.0
Applies if you use NodeClaim.nodeAffinity.
+ 1 more on the release page

Source ↗

Karmadav1.17.5Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 82View full analysis

A mixed maintenance and feature release with workload-affinity and anti-affinity support, encryption-at-rest capabilities, bug fixes, and updates to dependencies and default images. It also changes operational defaults and validation while deprecating or removing configuration flags and fields, so compatibility and configuration changes are part of the release.

Action needed (1)

breakingControllerPriorityQueue promotion to beta and default enablement
ControllerPriorityQueue is promoted to beta and enabled by default.

Check if affected (4)

breakingThe --etcd-init-image flag, removed from karmadactl init
Applies if you use the --etcd-init-image flag.
breakingnamespace validation for spec.resourceSelectors
Applies if you use PropagationPolicy or OverridePolicy.
breakingDistinct GroupByLabelKey values in WorkloadAffinity
Applies if you configure WorkloadAffinity.
+ 1 more on the release page

Plan ahead (2)

deprecatedEtcd.Local.InitImage deprecationdeprecated since v1.17.0 · removal date not announced
Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.
deprecatedDeprecation of cluster lease flagsdeprecated since v1.17.0 · removal date not announced
Applies if you use --cluster-lease-duration or --cluster-lease-renew-interval-fraction.

Source ↗

Karmadav1.16.8Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 104View full analysis

A mixed maintenance and feature release with bug fixes, new APIs and capabilities, performance and instrumentation improvements, dependency updates, and deprecated field removals. Operators should review the removed fields and the updated dependency, while the release also adds multi-component scheduling, configurable initialization, eviction queue support, and new workload interpreters.

Action needed (1)

securitymediumThe github.com/vektra/mockery dependency update
The github.com/vektra/mockery dependency was bumped to v3.5.5 to address security concerns identified by GO-2025-3900.

Check if affected (4)

breakingThe external etcd fields CAData, CertData, and KeyData, removed
Applies if you configure CAData, CertData, or KeyData.
breakingThe init command's default component images
Applies if you run the init command.
breakingA 32s default timeout for the member cluster client
Applies if you use the member cluster client.
+ 1 more on the release page

Plan ahead (2)

deprecatedThe --etcd-init-image flag, deprecatedremoval date not announced
Applies if you use --etcd-init-image.
breakingThe Prometheus metric labels cluster and cluster_name, replaced by member_clusterremoval planned in 1.18
Applies if you use the cluster or cluster_name metric labels.

Source ↗

KEDAv2.20.2Orchestration & ManagementJul 31, 2026

OTHER 13View full analysis

KEDA v2.20.2 contains a new ScaledObject condition alongside correctness, validation, and performance fixes. The release also addresses operator stability and scaler behavior, with no disclosed security advisories or setup changes.

Source ↗

KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github.com/moby/spdystream dependency, updated
The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

breakingStricter network interface binding admission
Applies if you configure network interface bindings.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
+ 6 more on the release page

Plan ahead (2)

deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗

Volcanov1.15.1Orchestration & ManagementJul 30, 2026

ACTION 1OTHER 16View full analysis

Volcano v1.15.1 is a maintenance release with a dependency update, configuration-format compatibility changes, and correctness fixes. It also includes implementation-only changes with no operator-facing impact.

Action needed (1)

securityThe golang.org/x/crypto dependency, upgraded
Volcano v1.15.1 upgrades golang.org/x/crypto from v0.49.0 to v0.53.0, incorporating upstream SSH security fixes released in v0.52.0.

Source ↗

Volcanov1.14.4Orchestration & ManagementJul 30, 2026

OTHER 7View full analysis

Volcano v1.14.4 is a bug-fix release covering scheduler behavior, nil-pointer panics, job dependency readiness, allocation flow, and Ascend vNPU configuration and resource handling. No security advisories or security-specific flaws are identified.

Source ↗

wasmCloudv2.6.1Orchestration & ManagementJul 29, 2026

OTHER 2View full analysis

Release v2.6.1 renames two operator-facing identifiers. Existing references may need updating to match the new names.

Source ↗

Knativeknative-v1.23.0Orchestration & ManagementJul 29, 2026

OTHER 5View full analysis

Knative v1.23.0 expands platform support with generic ephemeral volumes, startup-probe validation, and IPv6 handling for autoscaler and activator behavior. It also corrects WebSocket hijack state tracking, with no security advisories or operator actions identified.

Source ↗

wasmCloudv2.6.0Orchestration & ManagementJul 28, 2026

ACTION 1OTHER 36View full analysis

A feature and maintenance release that adds runtime, plugin, service, component, and pooling capabilities while changing the default NATS behavior. It also includes dependency updates and fixes for runtime and observability defects.

Action needed (1)

breakingThe NATS consumer-group default
NATS now uses consumer groups by default in the release.

Source ↗

Crossplanev2.3.4Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 5View full analysis

This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.

Action needed (7)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.3.4 updates the github.com/sigstore/rekor module to v1.5.2 for security fixes.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.3.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6 for security fixes.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.3.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0 for security fixes.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.3.4 updates the github.com/sigstore/sigstore-go module to v1.2.0 for security fixes.
securityCombined security dependency updates
Crossplane v2.3.4 includes combined security updates for grpc, golang.org/x/net, and golang.org/x/text.
securityThe golang.org/x/text module update to v0.39.0
Crossplane v2.3.4 updates the golang.org/x/text module to v0.39.0 for security fixes.
securityThe golang.org/x/net module update to v0.56.0
Crossplane v2.3.4 updates the golang.org/x/net module to v0.56.0 for security fixes.

Source ↗

Crossplanev2.2.4Orchestration & ManagementJul 23, 2026

ACTION 5OTHER 2View full analysis

Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.

Action needed (5)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.2.4 updates the github.com/sigstore/rekor module to v1.5.2.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.2.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.2.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.2.4 updates the github.com/sigstore/sigstore-go module to v1.2.0.
securityCombined grpc, x/net, and x/text dependency updates
Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.

Source ↗

Crossplanev2.1.8Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 1View full analysis

Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.

Action needed (7)

securityThe github.com/sigstore/rekor module at v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in Crossplane v2.1.8.
securityThe github.com/sigstore/timestamp-authority/v2 module at v2.1.0
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.1.0 in Crossplane v2.1.8.
securityThe github.com/sigstore/cosign/v2 module at v2.6.3
The github.com/sigstore/cosign/v2 module is updated to v2.6.3 in Crossplane v2.1.8.
securityThe Go toolchain at 1.25.12
The Go toolchain is updated to 1.25.12 in Crossplane v2.1.8.
securityThe github.com/sigstore/sigstore-go module at v1.2.0
The github.com/sigstore/sigstore-go module is updated to v1.2.0 in Crossplane v2.1.8.
securityCombined grpc, x/net, and x/text dependency updates
Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.
securityThe golang.org/x/text module at v0.39.0
The golang.org/x/text module is updated to v0.39.0 in Crossplane v2.1.8.

Source ↗

Crossplanev1.20.11Orchestration & ManagementJul 23, 2026

ACTION 4OTHER 1View full analysis

A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.

Action needed (4)

securityThe github.com/sigstore/rekor module, updated to v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in the release-1.20 line.
securityThe Go toolchain, updated to 1.25.12
The Go toolchain is updated to 1.25.12 in the release-1.20 line.
securityThe alpine Docker tag, updated to v3.24
The alpine Docker tag is updated to v3.24 in the release-1.20 line.
securitySecurity updates for grpc, x/net, and x/text
Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.

Source ↗

Daprv1.18.2Orchestration & ManagementJul 21, 2026

ACTION 3OTHER 18View full analysis

A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.

Action needed (3)

securitymediumgithub.com/go-chi/chi/v5 updated for CVE-2025-69725
github.com/go-chi/chi/v5 is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo.mongodb.org/mongo-driver and github.com/dapr/components-contrib updates
go.mongodb.org/mongo-driver is updated to v1.17.7, and the github.com/dapr/components-contrib dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.

Source ↗

wasmCloudv2.5.2Orchestration & ManagementJul 10, 2026

OTHER 5View full analysis

wasmCloud v2.5.2 adds asynchronous PostgreSQL support and WIT and wkg configuration resolution. It also improves HTTP recognition and default capability backend handling, while including dependency and internal tooling updates.

Source ↗

Daprv1.16.17Orchestration & ManagementJul 10, 2026

OTHER 1View full analysis

Dapr v1.16.17 fixes Scheduler handling for actor reminder and job names and actor IDs that were accepted at the API edge but rejected by stricter DNS-1123 validation. It also corrects the related validation error and actor metadata handling, with no operator action required beyond upgrading.

Source ↗

wasmCloudv2.5.1Orchestration & ManagementJul 2, 2026

OTHER 1View full analysis

This release adds the endpointslices/restricted virtual resource to RBAC. No further operator-facing details are specified.

Source ↗

wasmCloudv2.5.0Orchestration & ManagementJun 30, 2026

ACTION 1CHECK 1OTHER 21View full analysis

Version v2.5.0 adds runtime and WIT/API capabilities and includes correctness and dependency updates. The release also enables wasip3 by default and includes a quinn-proto fix for RUSTSEC-2026-0185.

Action needed (1)

securityhighThe quinn-proto security fix
The quinn-proto dependency fix ships in wasmCloud v2.5.0 and addresses RUSTSEC-2026-0185.

Check if affected (1)

breakingDefault wasip3 enablement with wasmtime 46
Applies if your workloads use wasip3.

Source ↗

Karmadav1.18.1Orchestration & ManagementJun 30, 2026

ACTION 1OTHER 1View full analysis

This release updates the Alpine base image and fixes a Helm chart TLS certificate issue. The Helm fix applies to deployments that use a custom namespace, while the base image change addresses security concerns.

Action needed (1)

securityThe alpine base image, upgraded
The alpine base image is promoted from alpine:3.23.4 to alpine:3.24.1 to address security concerns.

Source ↗

Karmadav1.17.4Orchestration & ManagementJun 30, 2026

ACTION 1OTHER 1View full analysis

Karmada v1.17.4 updates its Alpine base image to address security concerns. The release also fixes a Helm chart TLS certificate SAN mismatch when deploying to a custom namespace.

Action needed (1)

securityThe alpine base image, updated to alpine:3.24.1
The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns. The update ships in Karmada v1.17.4.

Source ↗

Karmadav1.16.7Orchestration & ManagementJun 30, 2026

ACTION 1OTHER 1View full analysis

Karmada v1.16.7 updates its Alpine base image for security concerns and includes a Helm chart fix for TLS certificate SANs in custom namespaces. The release affects deployments that use the updated image or the affected Helm chart configuration.

Action needed (1)

securityThe alpine base image, updated
The base image alpine is promoted from alpine:3.23.4 to alpine:3.24.1 to address security concerns.

Source ↗

Volcanov1.14.3Orchestration & ManagementJun 27, 2026

OTHER 10View full analysis

Volcano v1.14.3 is a bug-fix release for operator-relevant scheduling, resource accounting, pod metadata, status handling, and scheduler snapshots. The recorded release data contains no individual change entries to display.

Source ↗

Operator Frameworkv1.42.3Orchestration & ManagementJun 26, 2026

OTHER 18View full analysis

This release primarily updates dependencies and base images, including the Ansible operator plugin version. No security advisories or explicitly described vulnerabilities are included.

Source ↗

Crossplanev2.3.3Orchestration & ManagementJun 22, 2026

ACTION 2OTHER 1View full analysis

Crossplane v2.3.3 is a maintenance release with security fixes delivered through dependency and toolchain updates. It also corrects namespace handling for injected resource references in crossplane render, so rendered output matches reconciler behavior for cluster-scoped XRs.

Action needed (2)

securityPackage signature verification TOCTOU fix, GHSA-mf7q-r4rv-jv94
The package signature verification TOCTOU flaw identified by GHSA-mf7q-r4rv-jv94 is fixed through the crossplane-runtime v2.3.3 dependency bump. The affected code moved from crossplane to crossplane-runtime during the v2.3 milestone, so this fix ships through that dependency in Crossplane v2.3.3.
securityGo 1.25.11, golang.org/x/net, and golang.org/x/sys updates
The release-2.3 branch bumps Go to 1.25.11 and updates golang.org/x/net and golang.org/x/sys for CVE-related security fixes.

Source ↗

Crossplanev2.2.3Orchestration & ManagementJun 22, 2026

ACTION 1OTHER 3View full analysis

This release includes a security fix for package signature verification and updates to dependencies. It concerns deployments affected by the disclosed package-signature-verification flaw or by the updated dependency versions.

Action needed (1)

securitycriticalPackage signature verification TOCTOU fix, GHSA-wfqx-gjrf-g28r
Crossplane v2.2.3 fixes the package signature verification TOCTOU issue identified by GHSA-wfqx-gjrf-g28r.

Source ↗

Crossplanev2.1.7Orchestration & ManagementJun 22, 2026

ACTION 3OTHER 1View full analysis

Crossplane v2.1.7 is a maintenance release with dependency and Go toolchain updates. The changes affect the software components shipped with this release.

Action needed (3)

securityThe github.com/quic-go/quic-go module update
The github.com/quic-go/quic-go module is updated to v0.59.1 in Crossplane v2.1.7.
securityThe golang.org/x/net module update
The golang.org/x/net module is updated to v0.55.0 in Crossplane v2.1.7.
securityThe Go toolchain at 1.25.11
The Go toolchain is bumped to 1.25.11 in Crossplane v2.1.7.

Source ↗

Crossplanev1.20.10Orchestration & ManagementJun 22, 2026

ACTION 2OTHER 2View full analysis

A dependency maintenance release with security updates to the Go toolchain and MongoDB driver, alongside routine dependency bumps. Cosign and Docker remediation items were not applied and remain limitations.

Action needed (2)

securityhighThe Go toolchain, updated to 1.25.11
The Go toolchain is updated to 1.25.11, the latest Go 1.25 security patch. The change addresses CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityThe go.mongodb.org/mongo-driver module, updated to v1.17.7
The go.mongodb.org/mongo-driver module is updated to v1.17.7 with a security update.

Source ↗

wasmCloudv2.4.0Orchestration & ManagementJun 17, 2026

ACTION 1CHECK 1OTHER 11View full analysis

wasmCloud v2.4.0 adds operator capabilities and configuration options while correcting runtime and tooling behavior. It also changes supported platform behavior and updates dependencies associated with Rust security advisories, so platform-specific users and deployments using the affected crates are most directly concerned.

Action needed (1)

securityThe postgres crates, updated for Rust security advisories
The postgres crates are updated for RUSTSEC-2026-0178, RUSTSEC-2026-1079, and RUSTSEC-2026-0180. This dependency update ships in wasmCloud v2.4.0.

Check if affected (1)

breakingwebgpu disabled for s390
Applicability is not stated in the release notes.

Source ↗

KubeVirtv1.8.4Orchestration & ManagementJun 16, 2026

ACTION 1OTHER 3View full analysis

KubeVirt v1.8.4 adds observability coverage, changes node-labeller CPU feature handling, and fixes a virt-handler resource leak. It also updates a dependency to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Action needed (1)

securityhighThe github.com/moby/spdystream dependency, upgraded for CVE-2026-35469
github.com/moby/spdystream is upgraded from v0.5.0 to v0.5.1 in KubeVirt v1.8.4 to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Source ↗

Daprv1.18.1Orchestration & ManagementJun 16, 2026

OTHER 4View full analysis

Dapr v1.18.1 is a bug-fix release covering workflow timer cleanup, sidecar shutdown and restart behavior, ContinueAsNew completion handling, operator resynchronization, and Helm CRD schema alignment. No security advisories or security flaws are identified.

Source ↗

Daprv1.17.10Orchestration & ManagementJun 15, 2026

View full analysis

This release corrects a resiliency retry defect in pubsub publish operations. Configured status-code matching is honored when publish errors carry gRPC status codes.

Source ↗

Aug 21, 2026 – Jun 15, 2026Older →

Browse by month