Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jul 2026Clear ×

Karmadav1.18.2Orchestration & ManagementJul 31, 2026

ACTION 2CHECK 8PLAN 4OTHER 65View full analysis

A broad operator-impacting maintenance release with security-related base image updates, API and configuration changes, scheduling capabilities, and deprecations and removals. Operators should review changed defaults and constraints and account for migration work affecting their configurations, APIs, and metrics.

Action needed (2)

securityThe alpine base image update
The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns.
securityThe alpine base image update
The alpine base image is updated from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (8)

breakingThe cluster lease duration flags, removed
Applies if you configure either --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
breakingThe Estimator metric label value, removed
Applies if you use either estimating_plugin_execution_duration_seconds or estimating_plugin_extension_point_duration_seconds.
breakingThe Etcd.Local.InitImage configuration field, removed
Applies if you configure Etcd.Local.InitImage.
+ 5 more on the release page

Plan ahead (4)

deprecatedThe ReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ReplicaRequirements.resourceRequest.
deprecatedThe ComponentReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ComponentReplicaRequirements.resourceRequest.
deprecatedThe NodeClaim.nodeAffinity field deprecationdeprecated since v1.18.0
Applies if you use NodeClaim.nodeAffinity.
+ 1 more on the release page

Karmadav1.17.5Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 82View full analysis

A mixed maintenance and feature release with workload-affinity and anti-affinity support, encryption-at-rest capabilities, bug fixes, and updates to dependencies and default images. It also changes operational defaults and validation while deprecating or removing configuration flags and fields, so compatibility and configuration changes are part of the release.

Action needed (1)

breakingControllerPriorityQueue promotion to beta and default enablement
ControllerPriorityQueue is promoted to beta and enabled by default.

Check if affected (4)

breakingThe --etcd-init-image flag, removed from karmadactl init
Applies if you use the --etcd-init-image flag.
breakingnamespace validation for spec.resourceSelectors
Applies if you use PropagationPolicy or OverridePolicy.
breakingDistinct GroupByLabelKey values in WorkloadAffinity
Applies if you configure WorkloadAffinity.
+ 1 more on the release page

Plan ahead (2)

deprecatedEtcd.Local.InitImage deprecationdeprecated since v1.17.0 · removal date not announced
Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.
deprecatedDeprecation of cluster lease flagsdeprecated since v1.17.0 · removal date not announced
Applies if you use --cluster-lease-duration or --cluster-lease-renew-interval-fraction.

Karmadav1.16.8Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 104View full analysis

A mixed maintenance and feature release with bug fixes, new APIs and capabilities, performance and instrumentation improvements, dependency updates, and deprecated field removals. Operators should review the removed fields and the updated dependency, while the release also adds multi-component scheduling, configurable initialization, eviction queue support, and new workload interpreters.

Action needed (1)

securitymediumThe github.com/vektra/mockery dependency update
The github.com/vektra/mockery dependency was bumped to v3.5.5 to address security concerns identified by GO-2025-3900.

Check if affected (4)

breakingThe external etcd fields CAData, CertData, and KeyData, removed
Applies if you configure CAData, CertData, or KeyData.
breakingThe init command's default component images
Applies if you run the init command.
breakingA 32s default timeout for the member cluster client
Applies if you use the member cluster client.
+ 1 more on the release page

Plan ahead (2)

deprecatedThe --etcd-init-image flag, deprecatedremoval date not announced
Applies if you use --etcd-init-image.
breakingThe Prometheus metric labels cluster and cluster_name, replaced by member_clusterremoval planned in 1.18
Applies if you use the cluster or cluster_name metric labels.

KEDAv2.20.2Orchestration & ManagementJul 31, 2026

OTHER 13View full analysis

KEDA v2.20.2 contains a new ScaledObject condition alongside correctness, validation, and performance fixes. The release also addresses operator stability and scaler behavior, with no disclosed security advisories or setup changes.

KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github.com/moby/spdystream dependency, updated
The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

breakingStricter network interface binding admission
Applies if you configure network interface bindings.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
+ 6 more on the release page

Plan ahead (2)

deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

Volcanov1.15.1Orchestration & ManagementJul 30, 2026

ACTION 1OTHER 16View full analysis

A maintenance release with an updated cryptography dependency that incorporates upstream SSH security fixes. It also expands configuration-format support and includes scheduler correctness fixes.

Action needed (1)

securityThe golang.org/x/crypto dependency, upgraded
The golang.org/x/crypto dependency is upgraded from v0.49.0 to v0.53.0 in the v1.15.1 release branch. The update incorporates upstream SSH security fixes released in v0.52.0.

Volcanov1.14.4Orchestration & ManagementJul 30, 2026

OTHER 7View full analysis

Volcano v1.14.4 is a bug-fix release covering scheduler behavior, nil-pointer panics, job dependency readiness, allocation flow, and Ascend vNPU configuration and resource handling. No security advisories or security-specific flaws are identified.

wasmCloudv2.6.1Orchestration & ManagementJul 29, 2026

OTHER 2View full analysis

Release v2.6.1 renames two operator-facing identifiers. Existing references may need updating to match the new names.

Knativeknative-v1.23.0Orchestration & ManagementJul 29, 2026

OTHER 5View full analysis

Knative v1.23.0 expands platform support with generic ephemeral volumes, startup-probe validation, and IPv6 handling for autoscaler and activator behavior. It also corrects WebSocket hijack state tracking, with no security advisories or operator actions identified.

wasmCloudv2.6.0Orchestration & ManagementJul 28, 2026

ACTION 1OTHER 36View full analysis

A feature and maintenance release that adds runtime, plugin, service, component, and pooling capabilities while changing the default NATS behavior. It also includes dependency updates and fixes for runtime and observability defects.

Action needed (1)

breakingThe NATS consumer-group default
NATS now uses consumer groups by default in the release.

Crossplanev2.3.4Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 5View full analysis

This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.

Action needed (7)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.3.4 updates the github.com/sigstore/rekor module to v1.5.2 for security fixes.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.3.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6 for security fixes.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.3.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0 for security fixes.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.3.4 updates the github.com/sigstore/sigstore-go module to v1.2.0 for security fixes.
securityCombined security dependency updates
Crossplane v2.3.4 includes combined security updates for grpc, golang.org/x/net, and golang.org/x/text.
securityThe golang.org/x/text module update to v0.39.0
Crossplane v2.3.4 updates the golang.org/x/text module to v0.39.0 for security fixes.
securityThe golang.org/x/net module update to v0.56.0
Crossplane v2.3.4 updates the golang.org/x/net module to v0.56.0 for security fixes.

Crossplanev2.2.4Orchestration & ManagementJul 23, 2026

ACTION 5OTHER 2View full analysis

Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.

Action needed (5)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.2.4 updates the github.com/sigstore/rekor module to v1.5.2.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.2.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.2.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.2.4 updates the github.com/sigstore/sigstore-go module to v1.2.0.
securityCombined grpc, x/net, and x/text dependency updates
Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.

Crossplanev2.1.8Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 1View full analysis

Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.

Action needed (7)

securityThe github.com/sigstore/rekor module at v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in Crossplane v2.1.8.
securityThe github.com/sigstore/timestamp-authority/v2 module at v2.1.0
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.1.0 in Crossplane v2.1.8.
securityThe github.com/sigstore/cosign/v2 module at v2.6.3
The github.com/sigstore/cosign/v2 module is updated to v2.6.3 in Crossplane v2.1.8.
securityThe Go toolchain at 1.25.12
The Go toolchain is updated to 1.25.12 in Crossplane v2.1.8.
securityThe github.com/sigstore/sigstore-go module at v1.2.0
The github.com/sigstore/sigstore-go module is updated to v1.2.0 in Crossplane v2.1.8.
securityCombined grpc, x/net, and x/text dependency updates
Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.
securityThe golang.org/x/text module at v0.39.0
The golang.org/x/text module is updated to v0.39.0 in Crossplane v2.1.8.

Crossplanev1.20.11Orchestration & ManagementJul 23, 2026

ACTION 4OTHER 1View full analysis

A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.

Action needed (4)

securityThe github.com/sigstore/rekor module, updated to v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in the release-1.20 line.
securityThe Go toolchain, updated to 1.25.12
The Go toolchain is updated to 1.25.12 in the release-1.20 line.
securityThe alpine Docker tag, updated to v3.24
The alpine Docker tag is updated to v3.24 in the release-1.20 line.
securitySecurity updates for grpc, x/net, and x/text
Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.

Daprv1.18.2Orchestration & ManagementJul 21, 2026

ACTION 3OTHER 18View full analysis

A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.

Action needed (3)

securitymediumgithub.com/go-chi/chi/v5 updated for CVE-2025-69725
github.com/go-chi/chi/v5 is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo.mongodb.org/mongo-driver and github.com/dapr/components-contrib updates
go.mongodb.org/mongo-driver is updated to v1.17.7, and the github.com/dapr/components-contrib dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.

wasmCloudv2.5.2Orchestration & ManagementJul 10, 2026

OTHER 5View full analysis

wasmCloud v2.5.2 adds asynchronous PostgreSQL support and WIT and wkg configuration resolution. It also improves HTTP recognition and default capability backend handling, while including dependency and internal tooling updates.

Daprv1.16.17Orchestration & ManagementJul 10, 2026

OTHER 1View full analysis

Dapr v1.16.17 fixes Scheduler handling for actor reminder and job names and actor IDs that were accepted at the API edge but rejected by stricter DNS-1123 validation. It also corrects the related validation error and actor metadata handling, with no operator action required beyond upgrading.

wasmCloudv2.5.1Orchestration & ManagementJul 2, 2026

OTHER 1View full analysis

Adds the endpointslices/restricted virtual resource to RBAC. Other listed material does not establish an additional operator-facing change.

Browse by month