AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with a Ceph security advisory, a disabled Rook manager module, and clearer CephX fallback errors. Users of Ceph are advised to upgrade, while CephX key fallback failures now report the actual error.
Check if affected (2)
securityCeph CVE-2025–30156 upgrade advisory
Applies if you depend on Ceph.
breakingThe rook mgr module, disabled
Applies if you enable the rook mgr module.
A maintenance release with a security-driven Ceph upgrade recommendation and a disabled Rook manager module. It also adds or changes CephCluster and CephX error-reporting behavior.
Action needed (1)
breakingThe Rook manager module, disabled
The Rook manager module is disabled in this release.
Check if affected (1)
securityCeph upgrade recommendation for CVE-2025-30156
Applies if you use Ceph.
A maintenance release with security guidance for CVE-2025–30156 and updates across Ceph authentication, core behavior, Multus networking, and the Ceph base image. The release also includes a workaround for a Ceph authentication rotation race.
Action needed (1)
securityCVE-2025–30156 upgrade guidance
Rook users are advised to upgrade to Rook v1. or v1. with Ceph v20. or v19. in response to CVE-2025–30156.
A security-focused release with an advisory requiring Rook and Ceph upgrades. It also adds support for the new cephx key type, changes external version validation to ignore Ceph commit IDs, and fixes monitor registration in the v1 failover path.
Check if affected (1)
securityCeph CVE-2025–30156 advisory
Applies if you use Ceph.
A release with breaking behavior for legacy V2 linked-clone volumes, a Kubernetes v1.25 minimum, and stronger default network controls, including expanded mTLS enforcement. It also adds V2 data engine capabilities and metrics while correcting defects across V2 operations, backups, expansion, and infrastructure.
Check if affected (6)
breakingInternal NetworkPolicy resources enabled by default
Applies if a NetworkPolicy provider is available in the cluster.
breakingCross-namespace Prometheus scraper access through the Longhorn Manager network policy
Applies if you use cross-namespace Prometheus scrapers.
breakingmTLS for all instance-manager gRPC services
Applies if you configure the longhorn-grpc-tls secret.
Plan ahead (1)
deprecatedLegacy V2 linked-clone volumes deprecated
Applies if you use V2 linked-clone volumes created in v1.12.0 or earlier.
A maintenance release with operator-facing behavior changes, compatibility improvements, and defect corrections. No security advisories or explicitly security-related fixes are mentioned.
Source ↗A feature and maintenance release with expanded metadata, migration, storage-pool, learner, self-healing, proximity-read, and RocksDB capabilities. Operators need to follow the stated upgrade order and prerequisites; the release also contains corrective fixes, with no security advisories or explicit security flaws disclosed.
Source ↗A maintenance release with improvements to Helm charts, custom resource support, networking, monitoring, and storage behavior. It also includes correctness fixes across scheduling, reconciliation, endpoint handling, account deletion, and logging.
Source ↗v1.19.8 is a maintenance release with a security-related dependency update and behavioral improvements. The recorded dependency change updates the vulnerable go text package from v0.37 to a newer version.
Action needed (1)
securityThe go text package, updated from v0.37
The go text package is updated from v0.37 to the latest version because v0.37 has a vulnerability. This dependency update ships in v1.19.8.
Dragonfly v2.5.1 adds scheduler and statistics capabilities while correcting runtime and scheduling behavior. It also updates dependencies and changes digest validation to reject non-hex encoded values; no security advisories or explicitly described vulnerabilities are present.
Source ↗A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.
Action needed (1)
securityThird-party dependency upgrades for TiKV 8.5
TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.
Check if affected (1)
breakingInvalid max_ts updates rejected by default
Applies if you do not set storage..
Rook v1.20.2 includes dependency updates, behavioral changes, and fixes across Ceph, CSI, core, security, and storage operations. The release also tightens the manager NetworkPolicy to ingress-only; no vulnerability or advisory is disclosed.
Source ↗A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.
Action needed (1)
securityToken and blob-mount source validation
Blob-mount source projects are validated, and tokens without iat are rejected.
Check if affected (2)
breakingThe bundled PostgreSQL version, upgraded
Applies if you use PostgreSQL.
breakingThe cache backend, changed from redis to valkey
Applies if you use redis.
Longhorn v1.11.3 is a maintenance release with multiple correctness fixes and new metrics for LONGHORN_DISTRO. It requires Kubernetes v1.34 or later because the CSI external provisioner was upgraded to v6.3.0.
v2.5.0 adds operator-facing capabilities and changes download and proxy behavior. Deprecated API surface is removed and correctness issues are fixed; no security advisory is disclosed.
Action needed (1)
breakingHealth checks consolidated to /healthy
Health checks are consolidated to the /healthy endpoint in v2.5.0.
Check if affected (1)
breakingDeprecated V1 preheat API endpoints removed
Applies if you use the deprecated V1 preheat API endpoints.
Dragonfly v2.4.4 contains scheduler defect fixes and dependency version updates. The release does not identify a security advisory or an explicitly exploitable vulnerability.
Source ↗A bug-fix release with two security fixes, along with routine correctness fixes and Go toolchain dependency updates. The security changes affect users of the static grpc auth plugin or twopcz handler; the release also updates Go to go1. and go1..
Check if affected (2)
securityConstant-time password comparison in the static grpc auth plugin
Applies if you use the static grpc auth plugin.
securityEscaping of reflected form values in the twopcz handler
Applies if you use the twopcz handler.
Vitess v23.0.5 is a maintenance release with numerous bug corrections across core components, along with Go dependency updates. It also includes changes to authentication timing and reflected form escaping.
Source ↗A release with operator-facing configuration and behavior changes, including a new default and cleanup of stale resources. It also includes dependency and feature updates, with no security advisory disclosed.
Check if affected (2)
breakingStale MDS and RGW pdbs removed
Applies if you configure MDS and RGW pdbs.
breakingcsi-addons disabled by default
Applies if you enable csi-addons.
This release updates the default Ceph version and changes operational handling for Helm ownership, stale PDB cleanup, OSD device classes, and post-upgrade releases. It contains no disclosed security advisories.
Check if affected (2)
breakingDefault Ceph version 19.2.4
Applies if you use Ceph.
breakingStale MDS and RGW PDB cleanup
Applicability is not stated in the release notes.
A breaking release for CSI configuration also changes unused CRUSH rule handling and supported Kubernetes versions. It adds storage and object-store capabilities, including SSE-S3 with Vault Agent authentication, object-store account management, and encrypted OSD disk expansion.
Check if affected (2)
breakingCeph CSI operator for driver settings
Applies if you configure CSI driver settings.
breakingROOK_DELETE_UNUSED_CRUSH_RULES default
Applies if the Ceph mgr is running.
A broad maintenance and feature release combines bug fixes with new capabilities, configuration options, and platform support. It also changes defaults, tightens operational constraints, and removes V2 Backing Images.
Check if affected (5)
breakingV2 Backing Images removal
Applies if you use V2 Backing Images.
breakingThe data-engine-cpu-mask default, changed
Applies if you do not configure data-engine-cpu-mask.
breakingLive migration constraint for older CLI API versions
Applies if you use an engine image with a CLI API version older than 12.
This release includes a security-related dependency update in CI. The change affects builds that use golang..
Action needed (1)
securitycriticalThe golang. dependency, updated to v0.
CI updates golang. from its previous version to v0. to fix GO-2026-5026.
Rook v1.18.11 changes OSD installation and liveness probe behavior, corrects CSI priority-class handling, and updates a third-party dependency. No security issue is disclosed.
Source ↗Harbor v2.14.4 contains fixes to session and integration behavior, along with updates to its dependency and toolchain versions and base image. No security advisories or explicitly described vulnerabilities are present.
Source ↗A maintenance release with a correctness fix that reverts a VTOrc flag addition. It also updates planner handling for merged DML IN and NOT IN subqueries.
Check if affected (1)
breakingThe VTOrc cell-watch flag, reverted
Applies if VTOrc runs.
A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.
Action needed (2)
breakingUnqualified * rejection after commas in SELECT lists
vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.
breakingBare * restriction in the sqlparser grammar
sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.
Check if affected (1)
breakingEmergencyReparentShard replication-stop error validation
Applies if you use EmergencyReparentShard.
Harbor v2.15.1 is a maintenance release with defect corrections, behavior changes, and dependency and base-image updates. It also updates photon packages to fix CVEs.
Action needed (1)
securityphoton packages CVE fixes
The photon packages are updated to fix CVEs in Harbor v2.15.1.
Longhorn v1.11.2 contains operator-relevant defect fixes, a new setting for controlling CSIStorageCapacity reporting, and an optimization that reduces cluster-wide memory use by longhorn-manager Pod informer caching. Installation and upgrade requirements are prerequisites rather than release changes.
Source ↗A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.
Action needed (3)
securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.
Check if affected (12)
securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
Plan ahead (4)
deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
Rook v1.19.5 includes operational behavior changes, defect corrections, a dependency update, and new CSI configuration support. The release note also mentions security and deployment-related changes, but no explicit vulnerability or advisory is disclosed.
Source ↗This release combines an operator defect correction with changes to operator capabilities, configuration, and dependency or image versions. It contains no security advisories or explicitly described security fixes.
Action needed (1)
breakingThe default COSI sidecar image version, updated
The default version of the COSI sidecar image is updated in the COSI component.
TiKV v8.5.6 adds auto-compaction configuration and changes compaction and cleanup behavior. It also corrects several issues affecting reads, transactions, memory use, indexes, and cluster operations. No security-specific fixes or advisories are identified.
Source ↗Rook v1.19.3 contains operational behavior changes, dependency updates, and new configuration capabilities. The release note also includes changes to storage, exporter, object store, and CSI components, but no explicit security advisories or security flaws are disclosed.
Source ↗A maintenance release with an RBAC grant removal, behavioral fixes, and new CephNFS API fields. It also updates exporter and OSD handling, including log collection, reconciliation, cancellation, encrypted OSD key rotation, and container selection.
Check if affected (1)
breakingThe nodes/proxy RBAC grant, removed
Applies if you use nodes/proxy.
A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.
Action needed (2)
securityBearer token validation
Harbor rejects bearer tokens issued before project creation.
breakingPort 9443 removed from the webhook event check
Port 9443 is removed from the Harbor IP used for webhook event checks.
Check if affected (2)
breakingThe pull-through cache is replaced by proxy cache
Applies if you use pull-through cache in Harbor.
breakingGCR replication removal
Applies if you use GCR replication in Harbor.
Longhorn v1.11.1 is a maintenance release with operator-relevant correctness fixes, CSI and V2 engine improvements, and compatibility changes. No security advisories or explicitly security-related flaws are disclosed.
Source ↗Dragonfly v2.4.3 is a dependency maintenance release with updates to five third-party dependencies and d7y.. No security advisory or operator-facing behavior change is described.
Bearer tokens issued before project creation are rejected. The release also updates dependencies and components and removes payload data from the configuration audit log.
Action needed (1)
securityRejection of bearer tokens issued before project creation
The security enforcement rejects bearer tokens issued before project creation.
This release updates base images, dependencies, and Trivy components, and changes the audit-log payload. It also rejects bearer tokens issued before project creation.
Action needed (1)
securityBearer tokens issued before project creation rejected
The security fix rejects bearer tokens issued before project creation.
