Releases

Action needed (6)

• securityACME server response body limit

  ACME server response bodies are capped at 16 MiB to prevent unbounded-body denial-of-service conditions.

• securityChallenge.status.reason response disclosure fix

  The ACME HTTP-01 self-check no longer copies the fetched response body into Challenge.status.reason. This prevents internal response contents reached through redirects from being disclosed.

• securityGo 1.26.6

  The release upgrades Go to 1.26.6, which includes security fixes in the Go command and several standard library packages.

• securitygoogle.golang.org/grpc v1.83.2

  The release updates google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities.

• securitygolang.org/x/crypto v0.56.0

  The release updates golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities.

• breakingValidation for converted AdmissionReview requests

  Validation now also applies to equivalent-converted AdmissionReview requests on non-v1 API versions. These requests could previously bypass validation.

Action needed (2)

• securitycriticalGo and x/net updates for CVE-2026-39821

  The release updates Go to 1.26.6 and x/net to resolve CVE-2026-39821.

• securityhighGo update for CVE-2026-56853

  The release updates Go to address CVE-2026-56853.

Check if affected (3)

• breakingThe Status field, replaced by State

  Applies if you configure Status.

• breakingThe SCM basic auth method, replaced by an Entra ID bearer token

  Applies if you use SCM basic auth.

• breakingThe cloud-run label mutation fields, restricted to the schema

  Applies if you use cloud-run.

Action needed (2)

• securityGo dependency security vulnerabilities

  Dependabot fixes security vulnerabilities in Go dependencies shipped with the release.

• securitygosec SAST findings

  The release remediates gosec SAST findings in the Go codebase.