AI-analyzed release notes for CNCF graduated and incubating projects.
A substantial operator-facing release with new capabilities, behavior changes, a compatibility constraint, and a deprecation. It is the first annual LTS release under a Kubernetes-aligned cadence, with support planned for at least two years.
Action needed (1)
breakingPlugin names disallow commas
OCI hook adjustments accumulate owners, and commas are disallowed in plugin names in this release.
Plan ahead (1)
deprecatedThe shim. API, deprecated
Applies if you use shim..
OPA v1.16.0 adds URI built-ins, Data API metadata support, testing and WASM capabilities, along with broader Rego and schema support. It also changes formatting, logging, server, TLS, socket, storage, and dependency behavior, but includes a shutdown regression, so users should skip v1.16.0 and upgrade directly to v1.16.1.
Action needed (1)
breakingHTML index page query form removed
OPA v1.16.0 drops the HTML index page query form.
A feature release adds JetStream, leafnode, configuration, and protocol capabilities alongside fixes. Operator attention is needed for the narrowed MQTT retained-message subject constraint and ACL updates when domain-aware acknowledgements and flow control are enabled; the Go toolchain version also changes.
Check if affected (1)
breakingThe retained-message subject constraint
Applies if you use retained messages.
A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.
Action needed (3)
securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.
Check if affected (12)
securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
Plan ahead (4)
deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
This release adds and changes API and runtime capabilities, removes a sandbox metadata field, and updates a dependency. No security advisories or vulnerabilities are disclosed.
Check if affected (1)
breakingThe Container sandbox metadata field, removed
Applies if you use Container in API specs.
A release with operator-facing fixes, new capabilities, API and configuration changes, and dependency updates. It also includes fixes for CVE-2026-32597 in PyJWT and CVE-2026-30922 in pyasn1.
Action needed (3)
securityhighCVE-2026-32597 PyJWT validation fix
PyJWT crit header validation was fixed for CVE-2026-32597.
securityhighCVE-2026-30922 pyasn1 fix
The pyasn1 dependency was updated to address CVE-2026-30922 and its denial-of-service vulnerability.
breakingRequired MaxReplicas field
MaxReplicas is now required and must use the int32 type.
Check if affected (2)
breakingRemoval of the scheduler cert-hash restart annotation
Applies if you configure cert-hash.
breakingPYTHONPATH blocked by ISVC and ServingRuntime webhooks
Applies if you configure PYTHONPATH.
A substantial feature and maintenance release with new operator capabilities plus configuration, Helm, and CLI improvements. It also includes defect, output, dependency, and security fixes, including remediation for several CVE-related issues.
Action needed (4)
securityhighIntermediate certificate limit for CVE-2026-32280
Intermediate certificates are limited to mitigate CVE-2026-32280 in this release.
securityhighGo toolchain upgraded to 1. for CVE-2026-32283
The Go toolchain is upgraded to 1. to fix CVE-2026-32283.
securitymediumgo-tuf/v2 upgraded to v2. for CVE-2026-24686
go-tuf/v2 is upgraded to v2. to fix CVE-2026-24686.
securityStandard library CVE fixes
Standard library CVEs are fixed in this release.
Check if affected (2)
breakingRestricted ConfigMap access for namespaced policies
Applies if you use namespaced policies.
breakingFinalizers and uninstall workarounds removed
Applies if uninstall runs.
A release with API and configuration contract changes, new capabilities, deprecations, and bug fixes. It includes transport, telemetry, generated configuration, and data-handling updates, with no disclosed security advisories or security-specific fixes.
Check if affected (2)
breakingRelative replace paths in generated Collector source
Applies if you use the generated Collector source.
breakingNamed Config. field
Applies if you use Config..
Plan ahead (1)
deprecatedDefaultMetricsBuilderConfig deprecation
Applies if you use DefaultMetricsBuilderConfig.
A maintenance release with a dependency update, correctness fixes, and new operator-facing capabilities. The MCP server now requires explicit opt-in when MCP_SERVER_ENABLED is not configured.
Check if affected (1)
breakingThe MCP_SERVER_ENABLED default, changed to false
Applies if MCP_SERVER_ENABLED is not configured.
A release that removes older CRD API versions, changes defaults and configuration locations, and adds Kafka and HTTP Bridge capabilities. Monitoring configurations and standalone Topic Operator setups may require updates.
Action needed (2)
breakingThe UseConnectBuildWithBuildah feature gate, enabled by default
The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default.
breakingThe /metrics endpoint, moved to the HTTP management interface
The /metrics endpoint is no longer available on the regular HTTP interface, which uses port 8080 by default. It is now available on the HTTP management interface on port 8081.
Check if affected (4)
breakingOlder CRD API versions, removed
Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.
breakingThe Open Policy Agent (OPA) authorizer plugin, no longer bundled
Applies if you use the Open Policy Agent (OPA) authorizer plugin.
breakingLegacy TLS environment variables, ignored
Applies if you set any of STRIMZI_TLS_ENABLED, STRIMZI_TLS_AUTH_ENABLED, STRIMZI_PUBLIC_CA, STRIMZI_TRUSTSTORE_LOCATION, STRIMZI_TRUSTSTORE_PASSWORD, STRIMZI_KEYSTORE_LOCATION, or STRIMZI_KEYSTORE_PASSWORD.
A security- and maintenance-focused release with updates to Linux and bundled components, along with dependency updates. It also corrects minimal-initrd regressions and changes service startup, SSH defaults, kernel-module availability, and other operator-visible behavior and layout.
Action needed (18)
securitycriticalLinux security updates
Linux was updated with security fixes associated with advisories including CVE-2024-56757, CVE-2025-71239, and CVE-2026-31788.
securityhighcurl security updates
curl was updated with fixes for CVE-2025-10148 and CVE-2025-9086.
securityhighexpat security update
expat was updated with a fix for CVE-2025-59375.
securityhighgnupg security updates
gnupg was updated with fixes for CVE-2025-68972 and CVE-2025-68973.
securityhighGo security updates
go was updated with security fixes associated with CVE-2025-47910, CVE-2025-47912, CVE-2025-58183, and related advisories.
securityhighintel-microcode security updates
intel-microcode was updated with fixes associated with CVE-2024-28956, CVE-2024-43420, CVE-2025-20012, and related advisories.
securityhighlibxslt security updates
libxslt was updated with fixes for CVE-2025-7424 and CVE-2025-7425.
securityhighnvidia-drivers security updates
nvidia-drivers was updated with fixes for CVE-2025-23280, CVE-2025-23282, CVE-2025-23300, and related advisories.
securityhighopenssl security updates
openssl was updated with fixes for CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232.
securityhighPAM security updates
pam was updated with fixes for CVE-2024-10041, CVE-2024-10963, CVE-2024-22365, and CVE-2025-6020.
securitymediumbinutils security updates
binutils was updated with fixes for CVE-2025-5244, CVE-2025-5245, and CVE-2025-8225.
securitymediumcoreutils security update
coreutils was updated with a fix for CVE-2025-5278.
securitymediumlibpcre2 security update
libpcre2 was updated with a fix for CVE-2025-58050.
securitymediumnet-tools security update
net-tools was updated with a fix for CVE-2025-46836.
securitylowopenssh security updates
openssh was updated with fixes for CVE-2025-61984 and CVE-2025-61985.
securitylibxml2 update
libxml2 was updated to libxml2-20250908.
breakingOpenSSH algorithm configuration defaults
Ciphers, MACs, and KexAlgorithms were dropped from the sshd configuration. OpenSSH upstream defaults are used instead.
breakingReduced first-stage initrd kernel modules
The set of kernel modules available in the first initrd is reduced.
Check if affected (1)
breakingAutomatic startup for overlaybd sysext services
Applies if you use the overlaybd sysext.
A feature and maintenance release that adds Store Gateway, federation, overrides, caching, metric, and query capabilities while graduating several experimental features. It also changes defaults and configuration names, updates dependencies, and fixes correctness, memory, panic, and data-corruption defects.
Action needed (1)
breakingThe blocks storage bucket index default
Blocks storage now enables the bucket index by default through -blocks-storage.. Disabling it with -blocks-storage. is not recommended for production.
Check if affected (1)
breakingThe Distributor type and unit label flag
Applies if you configure either -distributor. or -distributor. for remote write v2 and OTLP requests.
Plan ahead (3)
breakingThe Ruler API flag rename
Applies if you configure -experimental..
breakingThe Alertmanager API flag rename
Applies if you configure -experimental..
breakingThe Users Scanner user index update configuration
Applies if you configure either -*. or clean_up_interval.
A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.
Action needed (1)
securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.
Check if affected (6)
securityURL encoding for query_parameter_mutations values
Applies if you configure query_parameter_mutations.
securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
breakingExplicit max_early_data_bytes configuration
Applies if you configure upstream_connect_mode with a value other than IMMEDIATE and do not configure max_early_data_bytes.
Plan ahead (1)
deprecatedThe enforce_rsa_key_usage option, deprecatedremoval date not announced
Applies if you configure enforce_rsa_key_usage.
A security-fix release with fixes for multiple CVEs and updates to affected dependencies. It also changes the default HTTP behavior and restricts configmap access for namespaced policies.
Action needed (12)
securitycriticalCVE-2025-68121 fix
This release fixes CVE-2025-68121.
securitycriticalCVE-2026-33186 fix
This release fixes CVE-2026-33186.
securityhighCVE-2026-24051 fix
This release fixes CVE-2026-24051 in the 1.16 release line.
securityhighThe github. dependency update
The github. dependency is updated to resolve CVE-2025-15558.
securityhighCVE-2025-66564 fix
This release resolves CVE-2025-66564.
securitymediumThe sigstore/rekor dependency update to v1.
The sigstore/rekor dependency is updated to v1. to fix CVE-2026-23831.
securitymediumThe go-tuf/v2 dependency update to v2.
The go-tuf/v2 dependency is updated to v2. to address CVE-2026-23992.
securitymediumCVE-2026-22772 fix
This release fixes CVE-2026-22772.
securitymediumThe go-tuf/v2 dependency update to v2.
The go-tuf/v2 dependency is updated to v2. to patch CVE-2026-24686.
securitylowCVE-2026-1229 fix
This release fixes CVE-2026-1229 in the 1.16 release line.
securitylowCVE-2026-26958 fix
This release fixes CVE-2026-26958.
securityStandard library CVE fixes
This release fixes standard library CVEs.
Check if affected (3)
securitycriticalHTTP disabled by default in namespaced policies
Applies if you configure namespaced policies.
securityCVE fixes for go < 1.
Applies if you depend on go < 1..
breakingRestricted configmap access for namespaced policies
Applies if you configure namespaced policies.
A maintenance release with multiple correctness fixes and security fixes, including changes for several CVEs and standard library CVEs. Operators should account for the changed HTTP default and narrower configmap access in addition to the security fixes.
Action needed (6)
securitycriticalCVE-2026-33186 correction
The release fixes CVE-2026-33186.
securityhighCVE-2026-24051 correction
The release fixes CVE-2026-24051 in the 1.17 release line.
securityhighCVE-2026-34986 correction
The release fixes CVE-2026-34986.
securitylowCVE-2026-1229 correction
The release fixes CVE-2026-1229.
securityCVES 2026-15558 correction
The release includes the CVES 2026-15558 fix for 1.17.
securityGo version update
The Go version was bumped to fix standard library CVEs.
Check if affected (2)
securitycriticalHTTP default for namespaced policies
Applies if you configure namespaced policies.
breakingConfigmap access for namespaced policies
Applies if you configure namespaced policies.
A broad operator-significant release with API, configuration, CLI default, scheduling, runtime, feature-gate, metric, and dependency changes. Upgrade review and testing matter for users of removed or deprecated interfaces, changed defaults, custom scheduler integrations, CRDs, audit logging, and affected metrics.
Action needed (11)
breakingStrictIPCIDRValidation enabled by default
The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.
breakingThe default debug profile, changed to general
The default debug profile changes from legacy to general.
breakingWatchCacheInitializationPostStartHook enabled by default
The WatchCacheInitializationPostStartHook feature gate is enabled by default.
breakingKubeletPSI graduation to GA
The KubeletPSI feature graduated to GA and is enabled by default.
breakingRelaxedServiceNameValidation at beta, enabled by default
The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.
breakingRestartAllContainersOnContainerExits at beta, enabled by default
The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.
breakingSuspended-job feature gates enabled by default
The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.
breakingAtomicFIFO informer store updates
Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.
breakingUnlockWhileProcessing informer behavior
Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.
breakingClientsAllowCARotation functionality enabled by default
This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.
breakingClientsAllowTLSCacheGC functionality enabled by default
This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.
Check if affected (25)
breakingThe volume_operation_total_errors metric, renamed
Applies if you use volume_operation_total_errors.
breakingThe git-repo volume plugin, disabled
Applies if you use the git-repo volume plugin.
breakingAllowlistEntry., renamed to AllowlistEntry.
Applies if you configure AllowlistEntry..
Plan ahead (6)
deprecatedService . deprecation
Applies if you configure Service ..
deprecatedDirect access to metav1., deprecated
Applies if you use metav1..
deprecatedMinNodeScore and MaxNodeScore, deprecated
Applies if you use MinNodeScore or MaxNodeScore.
This release fixes an HFC controller error loop, removes unused RBAC permissions, and updates project dependencies. The changes cover controller correctness and routine maintenance, with no stated security advisory.
Action needed (1)
breakingUnused permissions in the controller ClusterRole removed
Unused RBAC permissions are removed from the controller ClusterRole.
This release removes unused controller permissions and includes fixes and dependency updates. It may concern users tracking HFC controller behavior, CAPI, the Kubernetes group, or the Go build toolchain.
Action needed (1)
breakingUnused controller ClusterRole RBAC permissions removed
Unused RBAC permissions are removed from the controller ClusterRole in this release.
A maintenance release that adds operator-facing options and transport, plugin, and protocol support while correcting defects. It is built with Go 1., which contains fixes for disclosed CVEs; other changes concern operators using the affected features or behaviors.
Action needed (1)
securitycriticalGo 1. build with security fixes
The release is built with Go 1., which includes security fixes for CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.
Check if affected (1)
breakingOversized DoH GET query parameter rejection
Applies if you use DoH.
This is an operator-focused maintenance release with fixes and configuration constraints across controllers. It also adds a feature gate and updates dependency and toolkit components.
Check if affected (1)
breakingRequired audience field on the GCR Receiver secret
Applies if you configure the audience field on the GCR Receiver secret.
A correctness-focused release also changes backend volume naming and removes permissions from the kubevirt. RBAC role. The RBAC change requires operator attention.
Action needed (1)
breakingThe kubevirt. RBAC role, with vnc and screenshot permissions removed
The vnc and screenshot permissions are removed from the kubevirt. RBAC role in this release.
A release with a fix for Lua code injection, a required Envoy version change, and an Envoy dependency update. It is tested against Kubernetes 1.32 through 1.34.
Check if affected (2)
securityhighCVE-2026-41246 fix for cookieRewritePolicies[].
Applies if you use HTTPProxy resources.
breakingEnvoy 1.35.0 minimum version
Applies if you depend on Envoy.
This release combines a new TechDocs sidebar styling capability with dependency updates and constraints. It also corrects an active tab indicator issue in Backstage UI.
Action needed (1)
breakingReact Aria dependency ranges constrained to patch-only updates
React Aria dependency ranges are limited to patch-only updates in Backstage v1.50.2.
A release with a breaking configuration-schema replacement, a repo startup correctness fix, and a React Aria dependency update. It changes configuration values used by existing extensions and blueprints and updates React Aria to v1.17.0 with monopackage imports.
Check if affected (1)
breakingConfiguration schema values replaced
Applies if you use existing extensions and blueprints.
A maintenance release with the Go 1.25.9 toolchain and several correctness fixes. It changes the default for StatefulSet parallel pod management and includes fixes for kubelet restarts, apiserver audit-log latency annotations, and kube-proxy nftables support.
Check if affected (1)
breakingDefault for MaxUnavailableStatefulSet
Applies if you do not enable MaxUnavailableStatefulSet.
Dapr v1.16.13 includes a security-relevant Go dependency update and correctness fixes. The release also changes scheduler reliability and Pulsar pub/sub processing behavior.
Action needed (1)
securityThe Go version update
The Go version is updated from 1. to 1. in v1.16.13.
Check if affected (1)
breakingprocessMode initialization validation
Applies if you configure processMode.
This release combines an operator defect correction with changes to operator capabilities, configuration, and dependency or image versions. It contains no security advisories or explicitly described security fixes.
Action needed (1)
breakingThe default COSI sidecar image version, updated
The default version of the COSI sidecar image is updated in the COSI component.
A substantial feature and maintenance release with API, UI, plugin, authentication-token, catalog, scaffolder, frontend, and SCM changes. It also updates vulnerable glob and rollup dependencies, fixes the . URL, and includes broad correctness and dependency updates.
Action needed (4)
securityhighThe glob and rollup dependencies, upgraded
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe glob dependency, upgraded to v13
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.
securityThe rollup dependency, upgraded to v4.59+
rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe . URL
The . resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.
Check if affected (22)
breakingThe auth. setting
Applies if you do not configure auth..
breakingThe SignInResolverFactoryOptions type parameters
Applies if you use SignInResolverFactoryOptions.
breakingThe catalog permission exports, removed
Applies if you use CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, or catalogPermissionExtensionPoint.
Plan ahead (6)
deprecatedThe show and showModal compatibility implementation, deprecated
Applies if you use show or showModal.
deprecatedThe auth. setting, deprecatedremoval date not announced
Applies if you configure auth..
deprecatedThe config. callback format, deprecated
Applies if you use config..
A maintenance release with a dependency and toolchain update, configuration constraint changes, performance improvements, and correctness fixes. It also fixes an ACL permission bypass along with issues affecting leaf connections, streams, storage, and client authentication.
Check if affected (3)
securityQueue subscription enforcement of ACL deny patterns
Applies if you use queue subscriptions and configure non-queue ACL deny patterns.
breakingThe no_auth_user configuration field, restricted to client connections
Applies if you configure no_auth_user.
breakingDuplicate INFO permission updates for solicited leaf connections
Applies if you use solicited leaf connections.
This release updates the Go toolchain and corrects authorization, leafnode, and WebSocket behavior. Configuration rules for no_auth_user and duplicate leaf permission updates are narrower, so affected existing setups may require review.
Check if affected (2)
breakingThe no_auth_user connection scope restriction
Applies if you configure no_auth_user.
breakingThe INFO permission update restriction
Applies if you use solicited leaf connections.
This release adds Kubernetes-native service routing and related CRD fields, changes Helm behavior, fixes a NATS subscriber initialization race, and retires the runtime-gateway path. Operators using the deprecated gateway configuration need to account for the routing change and removed chart behavior.
Action needed (1)
breakingThe default chart tag is removed
The default tag is removed, so the chart uses chart.'s appVersion.
Check if affected (1)
breakingNative Kubernetes Service routing replaces runtime-gateway
Applies if you use runtime-gateway.
Plan ahead (1)
deprecatedThe Helm gateway section is deprecated
Applies if you configure gateway.
A maintenance release with dependency updates, defect corrections, expanded compatibility, and new integrations and configuration capabilities. An existing configuration source is replaced, so affected operators need to update their configuration.
Action needed (1)
breakingProvider configuration replaced by cloud-integration.
The provider config is no longer used, and configuration is read from cloud-integration. instead. Operators using the replaced configuration source need to update their configuration.
A maintenance release adds Helm v4 server-side apply support and includes numerous correctness fixes. The WASM decompression size-limit change affects inputs that were previously accepted and may require operator review.
Action needed (1)
breakingThe gzip decompression size limit for WASM binaries
A size limit is now enforced on gzip-decompressed WASM binaries fetched over HTTP.
A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.
Action needed (6)
securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.
Check if affected (7)
securityWorkflows admin permission boundaries
Applies if you use Workflows.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
Plan ahead (1)
deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.
This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.
Action needed (1)
securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.
Check if affected (1)
breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
Plan ahead (2)
deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
A broad release with new service discovery, PromQL, TSDB, and UI capabilities, alongside performance, dependency, output, and correctness changes. It also deprecates legacy Hetzner discovery labels and corrects TSDB retention-time handling.
Check if affected (1)
breakingThe storage. unit handling
Applies if you configure storage..
Plan ahead (2)
deprecatedThe __meta_hetzner_datacenter label, deprecatedremoval date not announced
Applies if you use __meta_hetzner_datacenter.
deprecatedThe Hetzner Cloud datacenter location labels, deprecated
Applies if you use __meta_hetzner_hcloud_datacenter_location or __meta_hetzner_hcloud_datacenter_location_network_zone.
A fractional bucketing update changes pseudorandom assignments without changing the API. Consistent assignments require all providers to be updated.
Check if affected (1)
breakingFractional pseudorandom bucketing assignments
Applies if you use providers.
