Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

May 2026Clear ×

Karmadav1.18.0Orchestration & ManagementMay 30, 2026

ACTION 1CHECK 9OTHER 35View full analysis

A feature and maintenance release that adds overflow scheduling and scheduling overcommit protection, along with API, default, constraint, metric, and flag changes. It also includes a security-related alpine base-image update and numerous defect corrections.

Action needed (1)

securityThe alpine base image update
The alpine base image has changed from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (9)

breakingThe overflowAffinities field
Applies if you configure overflowAffinities.
breakingStricter clusterTolerations operator validation
Applies if you set spec.placement.clusterTolerations with Lt or Gt.
breakingThe operator's default verbosity level
Applies if you run the operator.
+ 6 more on the release page

Source ↗

Daprv1.17.8Orchestration & ManagementMay 28, 2026

CHECK 1OTHER 1View full analysis

A maintenance release corrects a workflow retentioner defect and constrains forwarded-host handling during Sentry OIDC discovery. The discovery change affects deployments that use Sentry OIDC.

Check if affected (1)

securityConstrained X-Forwarded-Host use during Sentry OIDC discovery
Applies if you use Sentry OIDC.

Source ↗

Crossplanev2.3.1Orchestration & ManagementMay 22, 2026

ACTION 1CHECK 13OTHER 1View full analysis

A maintenance release includes dependency updates and security fixes in golang.org/x/crypto. The fixes cover SSH, SSH agent, and known-hosts behavior.

Action needed (1)

securitygolang.org/x/crypto updated to v0.52.0
The release updates the golang.org/x/crypto module to v0.52.0.

Check if affected (13)

securitycriticalUnenforced invoking key constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
securitycriticalDropped invoking agent constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
securitycriticalServer deadlock on unexpected responses in golang.org/x/crypto/ssh
Applies if you use golang.org/x/crypto/ssh.
+ 10 more on the release page

Source ↗

Crossplanev1.20.8Orchestration & ManagementMay 22, 2026

ACTION 7OTHER 1View full analysis

Crossplane v1.20.8 is a dependency and toolchain maintenance release. It updates several modules and the Go version, with the recorded dependency changes addressing security fixes, and also bumps crossplane-runtime to v1.20.8.

Action needed (7)

securityThe github.com/docker/cli module, updated to v29.2.0+incompatible
The github.com/docker/cli module is updated to v29.2.0+incompatible in the release-1.20 branch.
securityThe golang.org/x/net module, updated to v0.53.0
The golang.org/x/net module is updated to v0.53.0 in the release-1.20 branch.
securityThe github.com/in-toto/in-toto-golang module, updated to v0.11.0
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module, updated to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in the release-1.20 branch.
securityThe Go toolchain, updated to 1.25.10
Go is updated to 1.25.10 to fix standard-library CVEs in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module, updated to v5.19.1
The github.com/go-git/go-git/v5 module is updated again, to v5.19.1, in the release-1.20 branch.
securityThe golang.org/x/crypto module, updated to v0.52.0
The golang.org/x/crypto module is updated to v0.52.0 in the release-1.20 branch.

Source ↗

Crossplanev2.1.6Orchestration & ManagementMay 22, 2026

ACTION 6CHECK 1OTHER 1View full analysis

A security-focused maintenance release updates Go and several dependencies, including a fix for an HTTP/2 transport infinite-loop vulnerability. The Go and dependency version increases require upgrading; no configuration migration or deprecation is announced.

Action needed (6)

securityThe go.opentelemetry.io/otel module update
The go.opentelemetry.io/otel module is updated to v1.41.0 in this release.
securityThe github.com/in-toto/in-toto-golang module update
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in this release.
securityThe github.com/go-git/go-git/v5 module update to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in this release.
securityGo 1.25.10
Go is updated to 1.25.10 to fix standard library CVEs.
securityThe github.com/go-git/go-git/v5 module update to v5.19.1
The github.com/go-git/go-git/v5 module is updated to v5.19.1 in this release.
securityThe golang.org/x/crypto module update
The golang.org/x/crypto module is updated to v0.52.0 in this release.

Check if affected (1)

securityhighThe golang.org/x/net HTTP/2 transport infinite loop
Applicability is not stated in the release notes.

Source ↗

Crossplanev2.2.2Orchestration & ManagementMay 22, 2026

ACTION 5OTHER 1View full analysis

Crossplane v2.2.2 is a dependency and toolchain maintenance release with security-focused updates. It concerns deployments and builds that rely on the updated Go toolchain and modules.

Action needed (5)

securitygithub.com/in-toto/in-toto-golang updated to v0.11.0
Crossplane v2.2.2 updates the github.com/in-toto/in-toto-golang module to v0.11.0. The update ships in the release-2.2 line.
securitygithub.com/go-git/go-git/v5 updated to v5.19.0
Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.0. The update ships in the release-2.2 line.
securityGo 1.25.10 update for standard-library CVEs
Crossplane v2.2.2 updates Go to 1.25.10 to fix standard-library CVEs. The toolchain update ships in the release-2.2 line.
securitygithub.com/go-git/go-git/v5 updated to v5.19.1
Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.1. The update ships in the release-2.2 line.
securitygolang.org/x/crypto updated to v0.52.0
Crossplane v2.2.2 updates the golang.org/x/crypto module to v0.52.0. The update ships in the release-2.2 line.

Source ↗

Crossplanev2.3.0Orchestration & ManagementMay 21, 2026

ACTION 14CHECK 3OTHER 20View full analysis

Crossplane v2.3.0 combines breaking API naming and path changes with new operator capabilities and correctness fixes. It also updates several Go dependencies and the Go toolchain, which matters to API consumers and builds that depend on the affected packages.

Action needed (14)

securityThe github.com/cloudflare/circl dependency, updated to v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3 in Crossplane v2.3.0.
securityThe google.golang.org/grpc dependency, updated to v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in Crossplane v2.3.0.
securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency, updated to v1.43.0
The go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module is updated to v1.43.0 in Crossplane v2.3.0.
securityThe github.com/go-git/go-git/v5 dependency, updated to v5.17.1
The github.com/go-git/go-git/v5 module is updated to v5.17.1 in Crossplane v2.3.0.
securityThe github.com/go-jose/go-jose/v4 dependency, updated to v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Crossplane v2.3.0.
securityThe github.com/sigstore/cosign/v3 dependency, updated to v3.0.5
The github.com/sigstore/cosign/v3 module is updated to v3.0.5 in Crossplane v2.3.0.
securityThe github.com/docker/cli dependency, updated to v29.2.0+incompatible
The github.com/docker/cli module is updated to v29.2.0+incompatible in Crossplane v2.3.0.
securityThe github.com/sigstore/timestamp-authority/v2 dependency, updated to v2.0.6
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.0.6 in Crossplane v2.3.0.
securityThe Go toolchain, updated to 1.25.9
The Go toolchain is updated to 1.25.9 in Crossplane v2.3.0.
securityThe github.com/moby/spdystream dependency, updated to v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1 in Crossplane v2.3.0.
securityThe github.com/go-git/go-git/v5 dependency, updated to v5.18.0
The github.com/go-git/go-git/v5 module is updated to v5.18.0 in Crossplane v2.3.0.
securityThe github.com/in-toto/in-toto-golang dependency, updated to v0.11.0
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in Crossplane v2.3.0.
securityThe golang.org/x/net dependency, updated to v0.53.0
The golang.org/x/net module is updated to v0.53.0 in Crossplane v2.3.0.
securityThe Go toolchain, updated to 1.25.10
The Go toolchain is updated to 1.25.10 in Crossplane v2.3.0 to fix standard library CVEs.

Check if affected (3)

breakingThe Crossplane API dependency path, renamed
Applies if you build external consumers of Crossplane APIs.
breakingThe common API package, moved
Applies if you use the common APIs from crossplane-runtime.
breakingThe v1.Resource* types, renamed
Applies if you use the old v1.Resource* types.

Source ↗

Volcanov1.12.4Orchestration & ManagementMay 9, 2026

CHECK 1OTHER 2View full analysis

A maintenance release with a security fix for a disclosed denial-of-service vulnerability in the webhook server, plus ordinary scheduling bug fixes. The vulnerability affects webhook servers that accept unbounded HTTP request bodies.

Check if affected (1)

securitymediumCVE-2026-44247 in the Volcano webhook server
Applies if the Volcano webhook server runs.

Source ↗

Volcanov1.13.3Orchestration & ManagementMay 9, 2026

CHECK 1OTHER 4View full analysis

Volcano v1.13.3 includes a security fix for a denial-of-service vulnerability in the webhook server. It also contains other defect corrections.

Check if affected (1)

securitymediumCVE-2026-44247 in the Volcano webhook server
Applies if a pod can access the Volcano webhook endpoint over the network.

Source ↗

Volcanov1.14.2Orchestration & ManagementMay 9, 2026

CHECK 1OTHER 17View full analysis

A maintenance release fixes a disclosed webhook denial-of-service vulnerability and corrects scheduler, queue, and event-handling defects. It also updates the Kubernetes version used by the webhook-manager image.

Check if affected (1)

securitymediumCVE-2026-44247: Webhook server request body handling
Applies if the Volcano webhook server runs.

Source ↗

Browse by month