Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jan 2026Clear ×

Longhornv1.11.0Storage & DataJan 29, 2026

ACTION 1CHECK 7PLAN 2OTHER 134View full analysis

A substantial feature and maintenance release with V2 Data Engine changes, new capabilities, dependency updates, numerous fixes, and hotfix image replacements. It also deprecates V2 Backing Image functionality and includes a fix for an SPDK v25.05 CVE issue without a disclosed advisory identifier.

Action needed (1)

securityThe SPDK v25.05 CVE issue fix
The CVE issue in SPDK v25.05 is fixed in this release.

Check if affected (7)

breakingThe longhornio/longhorn-instance-manager:v1.11.0 image replacement
Applies if you use longhornio/longhorn-instance-manager:v1.11.0.
breakingThe longhornio/longhorn-manager:v1.11.0 image replacement
Applies if you use longhornio/longhorn-manager:v1.11.0.
breakingBackupstore-related settings removal
Applies if you configure backupstore related settings.
+ 4 more on the release page

Plan ahead (2)

deprecatedBacking Image for the V2 Data Engine deprecationremoval planned in v1.12.0
Applies if you use Backing Image and the V2 Data Engine.
deprecatedV2 Backing Image Feature deprecation
Applies if you use the V2 Backing Image Feature.

OpenFGAv1.11.3SecurityJan 28, 2026

ACTION 2OTHER 9View full analysis

This release adds configuration and observability capabilities while changing throttling and metric behavior. It also fixes correctness defects, including a described improper policy enforcement issue.

Action needed (2)

securitymediumThe CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9 policy enforcement fix
The release fixes improper policy enforcement associated with CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9.
breakingThe custom grpc_code metric label, removed
The custom grpc_prometheus fork is replaced with go-grpc-middleware's provider, and the custom grpc_code label is removed from the metric.

Knativeknative-v1.19.9Orchestration & ManagementJan 28, 2026

CHECK 1OTHER 1View full analysis

A release with a breaking observability change that replaces OpenCensus support with OpenTelemetry. It also fixes sub-second precision in metric reporting.

Check if affected (1)

breakingOpenCensus support removed in favor of OpenTelemetry
Applies if you use OpenCensus.

Falco0.43.0SecurityJan 28, 2026

CHECK 2PLAN 4OTHER 16View full analysis

A maintenance release that removes source-config-path output from release builds, deprecates several userspace interfaces, and rotates the package-signing key. It also includes correctness fixes, dependency updates, and an image-size reduction.

Check if affected (2)

breakingSource config path output in release builds
Applies if you use debug builds.
breakingGPG signing key for DEB/RPM packages, rotated
Applies if you use DEB/RPM packages.

Plan ahead (4)

deprecatedThe --gvisor-generate-config CLI option, deprecated
Applies if you use --gvisor-generate-config.
deprecatedThe legacy eBPF probe, deprecated
Applies if you use the legacy eBPF probe.
deprecatedThe gVisor engine, deprecated
Applies if you use the gVisor engine.
+ 1 more on the release page

Longhornv1.10.2Storage & DataJan 28, 2026

CHECK 2OTHER 23View full analysis

A maintenance release includes a hotfixed operator image, a security-relevant DNS query correction, and fixes across volume, replica, CSI, and management paths. It also adds namespace inheritance for longhorn-share-manager in FastFailover mode.

Check if affected (2)

securityThe instance-manager DNS query behavior
Applies if you do not use a hard or solid state disk.
breakingThe backing-image-manager:v1.10.2 image, replaced with backing-image-manager:v1.10.2-hotfix-1
Applies if you use backing-image-manager:v1.10.2.

Knativeknative-v1.21.0Orchestration & ManagementJan 27, 2026

CHECK 3OTHER 16View full analysis

A focused operator-facing release combining feature, compatibility, metrics, and defect fixes. The broader changelog is largely dependency housekeeping rather than additional operational changes.

Check if affected (3)

breakingThe kn.queueproxy.app.duration metric, renamed
Applies if you use kn.queueproxy.app.duration.
breakingThe kn.queueproxy.depth metric, renamed
Applies if you use kn.queueproxy.depth.
breakingService traffic ownership validation
Applicability is not stated in the release notes.

Confidential Containersv0.18.0SecurityJan 23, 2026

CHECK 2PLAN 2OTHER 17View full analysis

A release that removes or deprecates several operator-facing components while adding capabilities and changing supported formats and behavior. It also updates shipped platform components, including Trustee, image-rs, guest kernels, and OVMF.

Check if affected (2)

breakingProcess-based confidential computing via enclave-cc, removed
Applies if you use enclave-cc.
breakingExperimental Secure Comms mode, removed from the Cloud API Adaptor
Applies if you configure Secure Comms mode.

Plan ahead (2)

breakingThe CoCo operator, deprecated, with Helm chart installation
Applies if you use the CoCo operator.
deprecatedpacker guest images, deprecated in favor of mkosiremoval date not announced
Applies if you use packer images.

Dragonflyv2.4.1Storage & DataJan 23, 2026

CHECK 2View full analysis

A maintenance release that removes deprecated preheat API endpoints and fixes unauthenticated access to the Dragonfly manager job API. Both changes affect users of the corresponding APIs.

Check if affected (2)

securityDragonfly manager job API unauthenticated access fix
Applies if you use Dragonfly manager job API.
breakingDeprecated preheat API endpoints removed
Applies if you use deprecated preheat API endpoints.

Helmv3.20.0Kubernetes CoreJan 21, 2026

ACTION 1OTHER 44View full analysis

A maintenance release with dependency and toolchain updates, several defect corrections, and a new repository timeout flag. The pkg/registry login option for passing TLS configuration in memory has been removed.

Action needed (1)

breakingThe pkg/registry in-memory TLS configuration login option, removed
The pkg/registry login option for passing TLS configuration in memory is reverted and does not ship in this release.

Rookv1.19.0Storage & DataJan 20, 2026

CHECK 4OTHER 7View full analysis

A breaking release changes supported Kubernetes versions and configuration behavior and removes automatic CSI client creation in external mode. It also adds storage features, reconciliation improvements, and operational changes including experimental NVMe-oF support, block volume statistics, encryption settings, and improved fencing and logging.

Check if affected (4)

breakingSupported Kubernetes versions
Applies if you run Kubernetes v1.30 through v1.35.
breakingactiveStandby behavior in the CephFilesystem CRD
Applies if activeStandby is set to false.
breakingCeph image settings in the rook-ceph-cluster chart
Applies if you use the rook-ceph-cluster chart.
+ 1 more on the release page

Strimzi0.50.0Networking & MessagingJan 18, 2026

CHECK 1OTHER 1View full analysis

Strimzi 0.50.0 includes Java 21 adoption for the operators, with compatibility exceptions for several modules. It also changes connector plugin version configuration, so existing settings that use the rejected option are affected.

Check if affected (1)

breakingThe connector.plugin.version option, forbidden in connector configurations
Applies if you use connector.plugin.version in KafkaConnect or KafkaMirrorMaker2 connector configuration.

Ciliumv1.18.6Networking & MessagingJan 13, 2026

ACTION 1OTHER 21View full analysis

A maintenance release with fixes for networking, policy, proxy, gateway API, and endpoint handling, plus dependency, image, and OCI publishing updates. The Cilium Preflight check no longer includes Envoy Configmaps.

Action needed (1)

breakingCilium Preflight check no longer includes Envoy Configmaps
The Cilium Preflight check no longer includes Envoy Configmaps. This change ships in v1.18.6.

Envoyv1.37.0Networking & MessagingJan 13, 2026

ACTION 1CHECK 2PLAN 1OTHER 30View full analysis

This release adds dynamic-module, filter, routing, observability, and certificate capabilities, along with fixes and performance improvements across HTTP, networking, and protocol handling. It also changes HTTP reset behavior, removes runtime guards and legacy code paths, and deprecates the OpenTelemetry access log common_config field.

Action needed (1)

breakingRuntime guards and legacy code paths removed
Multiple runtime guards and legacy code paths are removed in this release.

Check if affected (2)

breakingDefault HTTP reset code changed
Applicability is not stated in the release notes.
breakingDefault upstream protocol error reset handling changed
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedOpenTelemetry access log common_config field deprecated
Applies if you configure common_config.

CoreDNSv1.14.0Kubernetes CoreJan 8, 2026

ACTION 1OTHER 7View full analysis

A maintenance release with a new regex length constraint, correctness fixes, and plugin capability and behavior changes. It does not disclose a security advisory or explicitly exploitable vulnerability.

Action needed (1)

breakingThe core regex length limit
core adds a length limit for regular expressions.

Prometheusv3.9.0ObservabilityJan 7, 2026

ACTION 1CHECK 1OTHER 34View full analysis

This release updates histogram collection and TSDB behavior while adding capabilities across the API, PromQL, storage, and UI. It also includes fixes for query handling, storage validation, receivers, and interface behavior.

Action needed (1)

breakingA 10,000-set limit for the TSDB status endpoint
The TSDB status endpoint now limits responses to a maximum of 10,000 sets of statistics.

Check if affected (1)

breakingThe native-histogram feature flag has no effect
Applies if you set scrape_native_histograms to collect Native Histogram samples from exporters.

Keycloak26.5.0SecurityJan 6, 2026

CHECK 2PLAN 1OTHER 247View full analysis

A substantial feature and maintenance release adds operator capabilities including workflows, JWT authorization grants, organization invitations, OpenTelemetry export, and Windows services. It also updates Quarkus and fixes correctness issues, while changing supported database versions and addressing a vulnerability in brute force detection settings.

Check if affected (2)

securityBrute force detection settings vulnerability, corrected
Applies if you configure brute force detection settings.
breakingPostgreSQL 13.x support removal
Applies if you depend on PostgreSQL 13.x.

Plan ahead (1)

deprecatedFine-Grained Admin Permissions v1, deprecated
Applies if you enable admin/fine-grained-permissions.

Jaegerv2.14.0ObservabilityJan 2, 2026

CHECK 9OTHER 20View full analysis

A release focused on removing legacy v1 components and storage interfaces, while changing configuration and UI defaults. It also adds or expands experimental storage capabilities and includes fixes for storage behavior and dependency API changes.

Check if affected (9)

breakingRemaining v1 utilities published as v2.x.x versions
Applies if you use v1 utilities.
breakingThe UI theme selector, enabled by default
Applies if you use the UI.
breakingThe storage/v1/grpc interface, removed
Applies if you use storage/v1/grpc.
+ 6 more on the release page

Browse by month