Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: KubeVirtClear ×

KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github.com/moby/spdystream dependency, updated
The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

breakingStricter network interface binding admission
Applies if you configure network interface bindings.
Admission now rejects interfaces with no binding or multiple bindings instead of allowing them to fail silently at runtime.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
The Template feature gate has graduated to Beta and is enabled by default. Virt-template components are deployed automatically unless explicitly disabled.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
The ephemeral hotplug volume metric and alert have been removed.
+ 6 more on the release page

Plan ahead (2)

deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
cgroup v1 support is deprecated, with removal planned for the next release.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.
Multiple recording rules are deprecated in favor of new names to comply with recording rule naming conventions. The kubevirt_vm_created_total recording rule and kubevirt_vm_created_by_pod_total metric are deprecated completely.

Source ↗

KubeVirtv1.8.2Orchestration & ManagementApr 20, 2026

ACTION 1OTHER 11View full analysis

A correctness-focused release also changes backend volume naming and removes permissions from the kubevirt.io:edit RBAC role. The RBAC change requires operator attention.

Action needed (1)

breakingThe kubevirt.io:edit RBAC role, with vnc and screenshot permissions removed
The vnc and screenshot permissions are removed from the kubevirt.io:edit RBAC role in this release.

Source ↗

KubeVirtv1.8.0Orchestration & ManagementMar 24, 2026

CHECK 7PLAN 4OTHER 98View full analysis

A broad operator-facing feature and maintenance release with API and behavior changes, dependency updates, deprecations, and removals. Monitoring and configuration changes include recording-rule and feature-gate updates, alongside scheduling and security-related behavior changes; no security advisories are reported.

Check if affected (7)

breakingNetwork attachment definition get permissions in the virt-controller ClusterRole, removed
Applicability is not stated in the release notes.
Network attachment definition get permissions are removed from the virt-controller ClusterRole when conditioned by a feature gate.
breakingStop requests for paused VMIs, rejected
Applies if you run paused VMIs.
Stop requests for paused VMIs are rejected.
breakingThe EnableVirtioFsConfigVolumes feature, graduated to GA
Applies if you use the EnableVirtioFsConfigVolumes feature gate.
The EnableVirtioFsConfigVolumes feature has graduated to GA and no longer requires its associated feature gate to be enabled.
+ 4 more on the release page

Plan ahead (4)

deprecatedThe DisableMDEVConfiguration feature gate, deprecatedremoval date not announced
Applies if you use the DisableMDEVConfiguration feature gate.
The DisableMDEVConfiguration feature gate is deprecated ahead of removal in a future release.
deprecatedThe kubevirt_vmi_migration_data_total_bytes metric, deprecated
Applies if you use the kubevirt_vmi_migration_data_total_bytes metric.
The kubevirt_vmi_migration_data_total_bytes metric is deprecated in favor of kubevirt_vmi_migration_data_bytes_total.
deprecatedThe MultiArchitecture feature gate, deprecated
Applies if you use the MultiArchitecture feature gate.
The MultiArchitecture feature gate is deprecated.
+ 1 more on the release page

Source ↗

KubeVirtv1.7.2Orchestration & ManagementMar 16, 2026

ACTION 1OTHER 7View full analysis

A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.

Action needed (1)

breakingThe QuiesceFailed indication replaced by QuiesceTimeout
The QuiesceFailed indication was replaced with QuiesceTimeout.

Source ↗

KubeVirtv1.6.4Orchestration & ManagementMar 16, 2026

ACTION 1CHECK 2OTHER 16View full analysis

A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.

Action needed (1)

securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.

Check if affected (2)

breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
The release replaces the QuiesceFailed indication with QuiesceTimeout and adds a 60-second Velero pre-backup hook timeout to better handle Windows VSS limitations.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.
The release aligns the DefaultVirtWebhookClient{QPS,Burst} values with DefaultVirtWebhookClient{QPS,Burst} to help avoid saturating the webhook client during mass eviction events.

Source ↗

Browse by month