Releases

Cilium v1.19.6 is a routine patch fixing multiple regressions in ClusterMesh affinity handling and host firewall configuration, along with policy and gateway-api issues. A minor gateway-api telemetry feature and dependency updates are included.

• breakingClusterMesh affinity annotation traffic blackhole fixed

  When using the service.cilium.io/affinity: "none" annotation in ClusterMesh, all remote backends were incorrectly dropped if no local endpoints exist, causing a traffic blackhole. The fix ships in v1.19.6 and matters if ClusterMesh services rely on this annotation to manage traffic distribution across clusters.

• breakingHost firewall disabled-state configuration sync fixed

  Disabling hostFirewall.enabled via Helm (toggling from true to false) left the host firewall in the live ConfigMap in enabled state, causing the firewall rules to remain active despite the configuration change. The fix ships in v1.19.6 and applies when toggling the host firewall setting.

Istio v1.29.6 is a routine patch addressing ambient mesh bugs in pilot-agent drain counting, ztunnel CNI deadlock, Istiod memory accumulation, and east-west gateway RBAC filtering. Auto-registered WorkloadEntry resources gain HBONE capability, though existing entries require the networking.istio.io/tunnel=http label to activate encrypted tunneling.

• breakingAuto-registered WorkloadEntry resources require label addition for HBONE tunneling

  WorkloadEntry resources created through auto-registration before upgrading to v1.29.6 continue to use plaintext tunneling until they re-register or the networking.istio.io/tunnel=http label is manually added to their existing WorkloadEntry. This is a transitional state affecting ambient mesh deployments that do not rebuild their auto-registered workload entries.

Istio 1.30.3 is a routine patch focused on bug fixes and scalability improvements for ambient mode. No CVEs. One operator-visible change: auto-registered workloads in ambient mode fall back to plaintext HBONE until re-registered or explicitly labeled; deployments relying on HBONE encryption for such workloads may need to take action.

• breakingPlaintext HBONE fallback for pre-registered workloads in ambient mode

  Workloads auto-registered with Istio before upgrading to 1.30.3 continue to be reached over plaintext HBONE until they either re-register or the operator adds the networking.istio.io/tunnel=http label to their existing WorkloadEntry resource. This applies in ambient mode when workloads were registered prior to this release.

KubeEdge v1.23.1 is a minor patch with one operator-facing breaking change: device status is now read from a new DeviceStatus CRD rather than the Device CRD status field. The release also adds Windows support, device anomaly detection, optimizes edge-to-cloud queries, and refactors the database backend to GORM.

• breakingDevice status moved to DeviceStatus CRD

  Device status is now stored in a separate DeviceStatus CRD instead of in the Device CRD's status field. Code that reads device status must be updated to query the DeviceStatus CRD. Backward compatibility with older CRD versions is maintained, but the status field in Device is no longer the source of truth.

KubeEdge v1.21.2 is a feature release combining v1.21.1 fixes with new capabilities: v1alpha2 node job APIs now default (v1alpha1 deprecated), ConfigUpdateJob CRD for cloud-driven config updates, and closed-loop flow control for node groups. Operators must prepare for four breaking changes: node jobs are disabled by default in EdgeCore, keadm upgrade no longer auto-backs up, v1alpha1 node job APIs are unmaintained, and keadm upgrade business flags are hidden.

• breakingNodeUpgradeJob/ImagePrePullJob default to v1alpha2; v1alpha1 deprecated

  v1alpha2 is now the default for NodeUpgradeJob and ImagePrePullJob. The v1alpha1 versions remain supported with backward-compatible CRDs but will be unmaintained starting now and removed after v1.23. To continue using v1alpha1, set the feature gates in ControllerManager and CloudCore.

• breakingNode job module disabled by default in EdgeCore

  The node job Beehive module in EdgeCore is now disabled by default. Existing deployments relying on NodeUpgradeJob or ImagePrePullJob must enable the module in edgecore.yaml or node jobs will not run.

• breakingkeadm upgrade no longer backs up automatically

  The keadm upgrade command no longer automatically backs up the cluster state. Manual backup via the separate backup command is now required before upgrades.

• breakingkeadm upgrade business-related flags deprecated

  Flags related to business logic in the keadm upgrade command are hidden and will be removed after v1.23. Any workflows depending on these flags must be refactored.

Envoy v1.39.0 is a major release combining several breaking behavior changes (mandatory keyUsage enforcement, disabled DLB balancer, stricter TLS inspector validation, changed OTel sampling behavior) with a large batch of roughly 20 medium-severity CVE fixes spanning HTTP/2, HTTP/3, ext_authz, ext_proc, OAuth2, DNS, and several other subsystems. It also ships extensive non-actionable feature and performance work, including dynamic-modules extension points and a new streaming JSON parser for AI protocols.

• securityBroad CVE batch fixed across core protocol and extension code

  This release fixes roughly 20 CVEs across HTTP/2, HTTP/3, ext_authz, ext_proc, gRPC stats, internal redirects, OAuth2, DNS, JSON parsing, PROXY protocol, formatters, StatsD, TLS SAN handling, and Zstd decompression, all rated medium by the notes. Notable ones include HTTP/2 cookie-based header-limit bypass (CVE-2026-47774), HTTP/3 QPACK blocked-decoding DoS (GHSA-p7c7-7c47-pwch), and Zstd decompression memory exhaustion (CVE-2026-48044). The fixes ship in v1.39.0.

• securityOAuth2 cookie encryption moves to AES-256-GCM (opt-in migration)

  OAuth2 adds AES-256-GCM cookie encryption to address CVE-2026-47775, replacing the older CBC-based scheme. Migration is opt-in: enable oauth2_use_gcm_encryption, monitor the oauth_legacy_cbc_decrypt metric, then disable oauth2_legacy_cbc_decrypt_compat once legacy decryption is no longer observed.

• breakingCertificate keyUsage enforcement is now mandatory

  Envoy now always enforces the certificate keyUsage extension; the enforce_rsa_key_usage field is deprecated and ignored. This applies unconditionally starting in v1.39.0, so certificates that previously relied on lax enforcement may now fail validation.

• breakingDLB connection balancer disabled in all builds

  The Intel DLB connection balancer (envoy.network.connection_balance.dlb) is disabled in all builds because of a broken source archive. This applies wherever that extension is configured.

• breakingTLS inspector now rejects out-of-range client TLS versions

  The TLS inspector now validates that client TLS versions fall between 1.0 and 1.3, rejecting anything outside that range. The check is unconditional in v1.39.0 but can be reverted with envoy.reloadable_features.tls_inspector_enforce_client_tls_version.

• breakingOTel tracing now defers to Envoy's own sampling decision

  The OpenTelemetry tracer now honors Envoy's own request-entry sampling decision, including overall_sampling, even when a propagated trace context or configured sampler requests sampling. This applies to deployments relying on downstream or context-based sampling overriding Envoy's local config, and may reduce the volume of exported spans.

Backstage v1.53.0 is a feature release with seven breaking changes across auth, CLI, and API layers. The SSE MCP transport, proxy agent bootstrap, and OpenAPI testing CLI commands are removed; OAuth redirect validation is tightened to reject wildcards crossing host-path boundaries and embedded credentials; config-loader enforces strict type checking; and EntityContextMenuItemBlueprint changes output structure. Optic is replaced by oasdiff for OpenAPI tooling. Numerous bugfixes address TechDocs, Scaffolder, and catalog issues; new features include breadcrumbs framework, user settings storage, and extended auth/database options. No security fixes are included.

• breakingSSE MCP transport removed

  The Server-Sent Events (SSE) transport for MCP actions has been removed from @backstage/plugin-mcp-actions-backend. If your deployment uses the SSE transport, switch to the Streamable HTTP endpoint or update your MCP configuration.

• breakingStricter config-loader type validation

  Config-loader now validates imported types in TypeScript configuration schemas instead of treating them as unconstrained. Invalid imports will cause schema loading to fail. Review your configuration schemas for unresolved or missing type imports.

• breakingTighter OAuth redirect URI and CIMD allowlist matching

  Wildcard patterns in OAuth redirect URIs are now constrained: patterns must include an explicit protocol, wildcards no longer match across host and path boundaries, and embedded credentials are always rejected. Patterns like http://localhost:* now match only the root path; use http://localhost:*/* to allow any path. Update your auth configuration to match this stricter syntax.

• breakingEntityContextMenuItemBlueprint output type change

  The EntityContextMenuItemBlueprint API now outputs menu item data instead of a rendered MUI element; the icon type is now IconElement. Update any code that depends on the catalog entity context menu to use the new data structure.

• breakingLegacy proxy agent bootstrap removed

  The bootstrapEnvProxyAgents export has been removed from @backstage/cli-common, along with global-agent and undici dependencies. If you rely on this export, use Node's native NODE_USE_ENV_PROXY environment variable instead.

• breakingOpenAPI CLI commands and wrapInOpenApiTestServer removed

  The package schema openapi init and repo schema openapi test CLI commands have been removed. Runtime OpenAPI validation is still available via wrapServer from @backstage/backend-openapi-utils/testUtils. The wrapInOpenApiTestServer function has also been removed; use wrapServer instead.

• breakingOpenAPI tooling switched from Optic to oasdiff

  Optic (@useoptic/optic and @useoptic/openapi-utilities) has been replaced with oasdiff in @backstage/repo-tools for OpenAPI breaking change detection. Update any tooling or CI/CD pipelines that reference Optic.