Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×

Daprv1.16.12Orchestration & ManagementMar 30, 2026

ACTION 1CHECK 2OTHER 4View full analysis

A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency and CVE-2026-33186 resolution
The affected google.golang.org/grpc dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.

Check if affected (2)

breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
breakingStructural validation for .jsonschema topics
Applies if you configure .jsonschema.

Source ↗

Daprv1.17.3Orchestration & ManagementMar 26, 2026

ACTION 2OTHER 12View full analysis

Dapr v1.17.3 is a maintenance release with two dependency upgrades that resolve reported CVEs. It also includes correctness fixes for actor and service responses, placement dissemination, reconnect behavior, Scheduler participation, metrics, and Windows sidecar startup.

Action needed (2)

securitycriticalThe google.golang.org/grpc dependency, updated for CVE-2026-33186
The google.golang.org/grpc dependency is upgraded in this release to resolve CVE-2026-33186.
securitymediumThe golang.org/x/image dependency, updated for CVE-2026-33809
This release upgrades golang.org/x/image from v0.25.0 to v0.38.0, resolving CVE-2026-33809.

Source ↗

Daprv1.16.11Orchestration & ManagementMar 26, 2026

ACTION 1OTHER 4View full analysis

This release updates the Go toolchain and corrects Scheduler and container defects. The recorded Scheduler and Windows fixes require only an upgrade, with no operator configuration changes stated.

Action needed (1)

securityThe Go version, updated to 1.25.8
Dapr v1.16.11 updates the Go toolchain from 1.25.7 to 1.25.8.

Source ↗

wasmCloudv2.0.0Orchestration & ManagementMar 22, 2026

ACTION 2OTHER 8View full analysis

wasmCloud v2.0.0 adds operator-facing capabilities, changes CRD locations, updates dependencies, and fixes runtime and CLI behavior. The dependency update addresses the disclosed advisory RUSTSEC-2026-0007.

Action needed (2)

securitymediumLock file update for RUSTSEC-2026-0007
wasmCloud v2.0.0 updates the lock file to address RUSTSEC-2026-0007.
breakingCRD location moved from templates/crds to /crds
wasmCloud v2.0.0 moves CRDs from templates/crds to /crds.

Source ↗

Daprv1.17.2Orchestration & ManagementMar 19, 2026

ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os.FileInfo root boundaries
os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.

Source ↗

KubeVirtv1.6.4Orchestration & ManagementMar 16, 2026

ACTION 1CHECK 2OTHER 16View full analysis

A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.

Action needed (1)

securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.

Check if affected (2)

breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.

Source ↗

Operator Frameworkv1.42.1Orchestration & ManagementMar 9, 2026

ACTION 1OTHER 7View full analysis

This release focuses on dependency maintenance, including a security-related Go update, along with a grace-period behavior change. No operator setup changes are explicitly required beyond upgrading to obtain the security fix.

Action needed (1)

securityGo dependency updates for CVE remediation
The release updates go and its dependencies to address CVEs. The change ships in operator-framework v1.42.1.

Source ↗

Daprv1.16.10Orchestration & ManagementMar 6, 2026

ACTION 1OTHER 4View full analysis

This release corrects Avro publishing and WASM component registration defects, improves Avro publishing performance, and updates the Go and OpenTelemetry SDK dependencies. The Go update includes security fixes, while the OpenTelemetry update is presented without a disclosed security issue.

Action needed (1)

securityThe Go 1.25.7 update
Go 1.25.7 ships security fixes for the go command and crypto/tls package, plus compiler and crypto/x509 bug fixes.

Source ↗

Browse by month