Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jul 2026Clear ×

Karmadav1.18.2Orchestration & ManagementJul 31, 2026

ACTION 2CHECK 8PLAN 4OTHER 65View full analysis

A broad operator-impacting maintenance release with security-related base image updates, API and configuration changes, scheduling capabilities, and deprecations and removals. Operators should review changed defaults and constraints and account for migration work affecting their configurations, APIs, and metrics.

Action needed (2)

securityThe alpine base image update
The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns.
securityThe alpine base image update
The alpine base image is updated from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (8)

breakingThe cluster lease duration flags, removed
Applies if you configure either --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
breakingThe Estimator metric label value, removed
Applies if you use either estimating_plugin_execution_duration_seconds or estimating_plugin_extension_point_duration_seconds.
breakingThe Etcd.Local.InitImage configuration field, removed
Applies if you configure Etcd.Local.InitImage.
+ 5 more on the release page

Plan ahead (4)

deprecatedThe ReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ReplicaRequirements.resourceRequest.
deprecatedThe ComponentReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ComponentReplicaRequirements.resourceRequest.
deprecatedThe NodeClaim.nodeAffinity field deprecationdeprecated since v1.18.0
Applies if you use NodeClaim.nodeAffinity.
+ 1 more on the release page

Source ↗

Karmadav1.16.8Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 104View full analysis

A mixed maintenance and feature release with bug fixes, new APIs and capabilities, performance and instrumentation improvements, dependency updates, and deprecated field removals. Operators should review the removed fields and the updated dependency, while the release also adds multi-component scheduling, configurable initialization, eviction queue support, and new workload interpreters.

Action needed (1)

securitymediumThe github.com/vektra/mockery dependency update
The github.com/vektra/mockery dependency was bumped to v3.5.5 to address security concerns identified by GO-2025-3900.

Check if affected (4)

breakingThe external etcd fields CAData, CertData, and KeyData, removed
Applies if you configure CAData, CertData, or KeyData.
breakingThe init command's default component images
Applies if you run the init command.
breakingA 32s default timeout for the member cluster client
Applies if you use the member cluster client.
+ 1 more on the release page

Plan ahead (2)

deprecatedThe --etcd-init-image flag, deprecatedremoval date not announced
Applies if you use --etcd-init-image.
breakingThe Prometheus metric labels cluster and cluster_name, replaced by member_clusterremoval planned in 1.18
Applies if you use the cluster or cluster_name metric labels.

Source ↗

KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github.com/moby/spdystream dependency, updated
The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

breakingStricter network interface binding admission
Applies if you configure network interface bindings.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
+ 6 more on the release page

Plan ahead (2)

deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Source ↗

Volcanov1.15.1Orchestration & ManagementJul 30, 2026

ACTION 1OTHER 16View full analysis

Volcano v1.15.1 is a maintenance release with a dependency update, configuration-format compatibility changes, and correctness fixes. It also includes implementation-only changes with no operator-facing impact.

Action needed (1)

securityThe golang.org/x/crypto dependency, upgraded
Volcano v1.15.1 upgrades golang.org/x/crypto from v0.49.0 to v0.53.0, incorporating upstream SSH security fixes released in v0.52.0.

Source ↗

Crossplanev2.3.4Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 5View full analysis

This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.

Action needed (7)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.3.4 updates the github.com/sigstore/rekor module to v1.5.2 for security fixes.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.3.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6 for security fixes.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.3.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0 for security fixes.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.3.4 updates the github.com/sigstore/sigstore-go module to v1.2.0 for security fixes.
securityCombined security dependency updates
Crossplane v2.3.4 includes combined security updates for grpc, golang.org/x/net, and golang.org/x/text.
securityThe golang.org/x/text module update to v0.39.0
Crossplane v2.3.4 updates the golang.org/x/text module to v0.39.0 for security fixes.
securityThe golang.org/x/net module update to v0.56.0
Crossplane v2.3.4 updates the golang.org/x/net module to v0.56.0 for security fixes.

Source ↗

Crossplanev2.2.4Orchestration & ManagementJul 23, 2026

ACTION 5OTHER 2View full analysis

Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.

Action needed (5)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.2.4 updates the github.com/sigstore/rekor module to v1.5.2.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.2.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.2.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.2.4 updates the github.com/sigstore/sigstore-go module to v1.2.0.
securityCombined grpc, x/net, and x/text dependency updates
Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.

Source ↗

Crossplanev2.1.8Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 1View full analysis

Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.

Action needed (7)

securityThe github.com/sigstore/rekor module at v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in Crossplane v2.1.8.
securityThe github.com/sigstore/timestamp-authority/v2 module at v2.1.0
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.1.0 in Crossplane v2.1.8.
securityThe github.com/sigstore/cosign/v2 module at v2.6.3
The github.com/sigstore/cosign/v2 module is updated to v2.6.3 in Crossplane v2.1.8.
securityThe Go toolchain at 1.25.12
The Go toolchain is updated to 1.25.12 in Crossplane v2.1.8.
securityThe github.com/sigstore/sigstore-go module at v1.2.0
The github.com/sigstore/sigstore-go module is updated to v1.2.0 in Crossplane v2.1.8.
securityCombined grpc, x/net, and x/text dependency updates
Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.
securityThe golang.org/x/text module at v0.39.0
The golang.org/x/text module is updated to v0.39.0 in Crossplane v2.1.8.

Source ↗

Crossplanev1.20.11Orchestration & ManagementJul 23, 2026

ACTION 4OTHER 1View full analysis

A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.

Action needed (4)

securityThe github.com/sigstore/rekor module, updated to v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in the release-1.20 line.
securityThe Go toolchain, updated to 1.25.12
The Go toolchain is updated to 1.25.12 in the release-1.20 line.
securityThe alpine Docker tag, updated to v3.24
The alpine Docker tag is updated to v3.24 in the release-1.20 line.
securitySecurity updates for grpc, x/net, and x/text
Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.

Source ↗

Daprv1.18.2Orchestration & ManagementJul 21, 2026

ACTION 3OTHER 18View full analysis

A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.

Action needed (3)

securitymediumgithub.com/go-chi/chi/v5 updated for CVE-2025-69725
github.com/go-chi/chi/v5 is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo.mongodb.org/mongo-driver and github.com/dapr/components-contrib updates
go.mongodb.org/mongo-driver is updated to v1.17.7, and the github.com/dapr/components-contrib dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.

Source ↗

Browse by month