AI-analyzed release notes for CNCF graduated and incubating projects.
OPA v1.16.0 adds URI built-ins, Data API metadata support, testing and WASM capabilities, along with broader Rego and schema support. It also changes formatting, logging, server, TLS, socket, storage, and dependency behavior, but includes a shutdown regression, so users should skip v1.16.0 and upgrade directly to v1.16.1.
Action needed (1)
breakingHTML index page query form removed
OPA v1.16.0 drops the HTML index page query form.
A substantial feature and maintenance release with new operator capabilities plus configuration, Helm, and CLI improvements. It also includes defect, output, dependency, and security fixes, including remediation for several CVE-related issues.
Action needed (4)
securityhighIntermediate certificate limit for CVE-2026-32280
Intermediate certificates are limited to mitigate CVE-2026-32280 in this release.
securityhighGo toolchain upgraded to 1. for CVE-2026-32283
The Go toolchain is upgraded to 1. to fix CVE-2026-32283.
securitymediumgo-tuf/v2 upgraded to v2. for CVE-2026-24686
go-tuf/v2 is upgraded to v2. to fix CVE-2026-24686.
securityStandard library CVE fixes
Standard library CVEs are fixed in this release.
Check if affected (2)
breakingRestricted ConfigMap access for namespaced policies
Applies if you use namespaced policies.
breakingFinalizers and uninstall workarounds removed
Applies if uninstall runs.
A security-fix release with fixes for multiple CVEs and updates to affected dependencies. It also changes the default HTTP behavior and restricts configmap access for namespaced policies.
Action needed (12)
securitycriticalCVE-2025-68121 fix
This release fixes CVE-2025-68121.
securitycriticalCVE-2026-33186 fix
This release fixes CVE-2026-33186.
securityhighCVE-2026-24051 fix
This release fixes CVE-2026-24051 in the 1.16 release line.
securityhighThe github. dependency update
The github. dependency is updated to resolve CVE-2025-15558.
securityhighCVE-2025-66564 fix
This release resolves CVE-2025-66564.
securitymediumThe sigstore/rekor dependency update to v1.
The sigstore/rekor dependency is updated to v1. to fix CVE-2026-23831.
securitymediumThe go-tuf/v2 dependency update to v2.
The go-tuf/v2 dependency is updated to v2. to address CVE-2026-23992.
securitymediumCVE-2026-22772 fix
This release fixes CVE-2026-22772.
securitymediumThe go-tuf/v2 dependency update to v2.
The go-tuf/v2 dependency is updated to v2. to patch CVE-2026-24686.
securitylowCVE-2026-1229 fix
This release fixes CVE-2026-1229 in the 1.16 release line.
securitylowCVE-2026-26958 fix
This release fixes CVE-2026-26958.
securityStandard library CVE fixes
This release fixes standard library CVEs.
Check if affected (3)
securitycriticalHTTP disabled by default in namespaced policies
Applies if you configure namespaced policies.
securityCVE fixes for go < 1.
Applies if you depend on go < 1..
breakingRestricted configmap access for namespaced policies
Applies if you configure namespaced policies.
A maintenance release with multiple correctness fixes and security fixes, including changes for several CVEs and standard library CVEs. Operators should account for the changed HTTP default and narrower configmap access in addition to the security fixes.
Action needed (6)
securitycriticalCVE-2026-33186 correction
The release fixes CVE-2026-33186.
securityhighCVE-2026-24051 correction
The release fixes CVE-2026-24051 in the 1.17 release line.
securityhighCVE-2026-34986 correction
The release fixes CVE-2026-34986.
securitylowCVE-2026-1229 correction
The release fixes CVE-2026-1229.
securityCVES 2026-15558 correction
The release includes the CVES 2026-15558 fix for 1.17.
securityGo version update
The Go version was bumped to fix standard library CVEs.
Check if affected (2)
securitycriticalHTTP default for namespaced policies
Applies if you configure namespaced policies.
breakingConfigmap access for namespaced policies
Applies if you configure namespaced policies.
A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.
Action needed (6)
securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.
Check if affected (7)
securityWorkflows admin permission boundaries
Applies if you use Workflows.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
Plan ahead (1)
deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.
This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.
Action needed (1)
securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.
Check if affected (1)
breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
Plan ahead (2)
deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
