Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jul 2026Clear ×

Karmadav1.18.2Orchestration & ManagementJul 31, 2026

ACTION 2CHECK 8PLAN 4OTHER 65View full analysis

A broad operator-impacting maintenance release with security-related base image updates, API and configuration changes, scheduling capabilities, and deprecations and removals. Operators should review changed defaults and constraints and account for migration work affecting their configurations, APIs, and metrics.

Action needed (2)

securityThe alpine base image update
The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns.
securityThe alpine base image update
The alpine base image is updated from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (8)

breakingThe cluster lease duration flags, removed
Applies if you configure either --cluster-lease-duration or --cluster-lease-renew-interval-fraction.
breakingThe Estimator metric label value, removed
Applies if you use either estimating_plugin_execution_duration_seconds or estimating_plugin_extension_point_duration_seconds.
breakingThe Etcd.Local.InitImage configuration field, removed
Applies if you configure Etcd.Local.InitImage.
+ 5 more on the release page

Plan ahead (4)

deprecatedThe ReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ReplicaRequirements.resourceRequest.
deprecatedThe ComponentReplicaRequirements.resourceRequest field deprecationdeprecated since v1.18.0
Applies if you use ComponentReplicaRequirements.resourceRequest.
deprecatedThe NodeClaim.nodeAffinity field deprecationdeprecated since v1.18.0
Applies if you use NodeClaim.nodeAffinity.
+ 1 more on the release page

Karmadav1.17.5Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 82View full analysis

A mixed maintenance and feature release with workload-affinity and anti-affinity support, encryption-at-rest capabilities, bug fixes, and updates to dependencies and default images. It also changes operational defaults and validation while deprecating or removing configuration flags and fields, so compatibility and configuration changes are part of the release.

Action needed (1)

breakingControllerPriorityQueue promotion to beta and default enablement
ControllerPriorityQueue is promoted to beta and enabled by default.

Check if affected (4)

breakingThe --etcd-init-image flag, removed from karmadactl init
Applies if you use the --etcd-init-image flag.
breakingnamespace validation for spec.resourceSelectors
Applies if you use PropagationPolicy or OverridePolicy.
breakingDistinct GroupByLabelKey values in WorkloadAffinity
Applies if you configure WorkloadAffinity.
+ 1 more on the release page

Plan ahead (2)

deprecatedEtcd.Local.InitImage deprecationdeprecated since v1.17.0 · removal date not announced
Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.
deprecatedDeprecation of cluster lease flagsdeprecated since v1.17.0 · removal date not announced
Applies if you use --cluster-lease-duration or --cluster-lease-renew-interval-fraction.

Karmadav1.16.8Orchestration & ManagementJul 31, 2026

ACTION 1CHECK 4PLAN 2OTHER 104View full analysis

A mixed maintenance and feature release with bug fixes, new APIs and capabilities, performance and instrumentation improvements, dependency updates, and deprecated field removals. Operators should review the removed fields and the updated dependency, while the release also adds multi-component scheduling, configurable initialization, eviction queue support, and new workload interpreters.

Action needed (1)

securitymediumThe github.com/vektra/mockery dependency update
The github.com/vektra/mockery dependency was bumped to v3.5.5 to address security concerns identified by GO-2025-3900.

Check if affected (4)

breakingThe external etcd fields CAData, CertData, and KeyData, removed
Applies if you configure CAData, CertData, or KeyData.
breakingThe init command's default component images
Applies if you run the init command.
breakingA 32s default timeout for the member cluster client
Applies if you use the member cluster client.
+ 1 more on the release page

Plan ahead (2)

deprecatedThe --etcd-init-image flag, deprecatedremoval date not announced
Applies if you use --etcd-init-image.
breakingThe Prometheus metric labels cluster and cluster_name, replaced by member_clusterremoval planned in 1.18
Applies if you use the cluster or cluster_name metric labels.

Open Policy Agent (OPA)v1.19.0SecurityJul 30, 2026

ACTION 3CHECK 2OTHER 36View full analysis

A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.

Action needed (3)

securityhighoras.land/oras-go/v2 update for GHSA-fxhp-mv3v-67qp
oras.land/oras-go/v2 is updated from 2.6.1 to 2.6.2 to address GHSA-fxhp-mv3v-67qp.
breakingReadHeaderTimeout default
All HTTP servers now set ReadHeaderTimeout to 32s.
breakingPartial set and -object rule name conflicts
The AST rejects partial set and -object rules that share a name.

Check if affected (2)

securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
breakingStricter := safety checking
Applicability is not stated in the release notes.

KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github.com/moby/spdystream dependency, updated
The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

breakingStricter network interface binding admission
Applies if you configure network interface bindings.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
+ 6 more on the release page

Plan ahead (2)

deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

NATSv2.14.4Networking & MessagingJul 30, 2026

CHECK 4OTHER 37View full analysis

A maintenance release with dependency and toolchain updates, JetStream performance and configuration improvements, and broad correctness fixes. It also includes authentication and permission fixes.

Check if affected (4)

securityJWT validation with whitespace-only permissions
Applies if you use JWT validation.
securityverify_and_map authentication with blank passwords
Applies if TLS verify_and_map is configured.
securityMQTT subscription restriction for $MQTT.> subjects
Applies if you use MQTT.
+ 1 more on the release page

NATSv2.12.14Networking & MessagingJul 30, 2026

ACTION 1CHECK 2OTHER 33View full analysis

A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.

Action needed (1)

breakingThe disk concurrency semaphore, increased to 4096 slots
The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.

Check if affected (2)

securityAuthentication checks with no_auth_user and auth callouts
Applies if you configure no_auth_user and use auth callouts.
securityTLS verify_and_map authentication with blank passwords
Applies if you use TLS and configure verify_and_map.

Ciliumv1.20.0Networking & MessagingJul 29, 2026

ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

securitygoogle.golang.org/grpc v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in the main branch.
securitygoogle.golang.org/grpc v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.
securityhelm.sh/helm/v4 v4.1.4
The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.
securitygithub.com/cloudflare/circl v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3.
securitygithub.com/go-jose/go-jose/v4 v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.
securitygithub.com/moby/spdystream v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1.
breakingcni.customConf CNI configuration version
The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.

Check if affected (28)

securitytbid traffic host namespace handling
Applies if you use tbid traffic.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
+ 25 more on the release page

Plan ahead (6)

deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[].subnet or interfaces[].cidr.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
+ 3 more on the release page

wasmCloudv2.6.0Orchestration & ManagementJul 28, 2026

ACTION 1OTHER 36View full analysis

A feature and maintenance release that adds runtime, plugin, service, component, and pooling capabilities while changing the default NATS behavior. It also includes dependency updates and fixes for runtime and observability defects.

Action needed (1)

breakingThe NATS consumer-group default
NATS now uses consumer groups by default in the release.

Confidential Containersv0.22.0SecurityJul 28, 2026

CHECK 6OTHER 20View full analysis

A release with a breaking authentication change and several operator-visible removals, alongside new integrations, APIs, and configuration capabilities. No security fixes or advisory identifiers are disclosed.

Check if affected (6)

breakingKBS client admin-token authentication
Applies if you use the KBS client.
breakingThe CAA docker provider, removed
Applies if you use the CAA docker provider.
breakingThe Fedora-based mkosi-built CAA podvm image, removed
Applies if you use the Fedora-based mkosi-built CAA podvm image.
+ 3 more on the release page

etcdv3.7.1Kubernetes CoreJul 23, 2026

ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

securityhighThe google.golang.org/grpc dependency update
The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.

etcdv3.6.14Kubernetes CoreJul 23, 2026

ACTION 5OTHER 5View full analysis

A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.

Action needed (5)

securitycriticalThe golang.org/x/net dependency update
The golang.org/x/net dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.
securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8
An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3
The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.
securityhighThe google.golang.org/grpc dependency update
The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default value
The default value for snapshotLimitByte is set to a reasonable value in this release.

Kubescapev4.0.11SecurityJul 22, 2026

CHECK 1OTHER 31View full analysis

A feature and maintenance release that adds scanning, reporting, export, MCP, vulnerability-adaptor, and policy capabilities while correcting air-gapped, exception, scan, SARIF, and image-scan behavior. deploy-library now uses the embedded VAP bundle by default.

Check if affected (1)

breakingThe deploy-library bundle source
Applies if you use deploy-library.

Linkerdedge-26.7.1Networking & MessagingJul 21, 2026

ACTION 1CHECK 1OTHER 58View full analysis

This release tightens Gateway API and service-port handling and corrects tracing identity construction. It also updates dependencies and shipped components, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

breakingUndefined service port requests disallowed
The destination component now disallows requests to service ports that are not defined.

Check if affected (1)

breakingGateway API checks during Helm installation
Applies when you use Helm.

Daprv1.18.2Orchestration & ManagementJul 21, 2026

ACTION 3OTHER 18View full analysis

A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.

Action needed (3)

securitymediumgithub.com/go-chi/chi/v5 updated for CVE-2025-69725
github.com/go-chi/chi/v5 is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo.mongodb.org/mongo-driver and github.com/dapr/components-contrib updates
go.mongodb.org/mongo-driver is updated to v1.17.7, and the github.com/dapr/components-contrib dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.

Limav2.2.0Kubernetes CoreJul 21, 2026

CHECK 3OTHER 18View full analysis

An experimental feature release adds guest, CLI, template, VM-driver, and device capabilities. It also changes the Windows default driver and socket_vmnet access constraint, removes a host dependency, and updates nerdctl.

Check if affected (3)

breakingThe default VM driver, from wsl2 to qemu
Applies if you do not configure the VM driver.
breakingThe socket_vmnet access constraint
Applies if you use socket_vmnet.
breakingThe almalinux-kitten template, moved to experimental/
Applies if you use almalinux-kitten.

OpenTelemetryv0.157.0ObservabilityJul 21, 2026

CHECK 1PLAN 1OTHER 11View full analysis

This release adds configuration and feature-gate capabilities, corrects defects, changes histogram bucket values, and introduces the configstorage module. It also removes or deprecates API symbols, with no security issues or advisories identified.

Check if affected (1)

breakingThe BalancerName function, removed
Applies if you use BalancerName.

Plan ahead (1)

deprecatedThe WithForceUnmarshaler option, deprecated
Applies if you use WithForceUnmarshaler.

OpenCostv1.121.0ObservabilityJul 20, 2026

CHECK 1OTHER 14View full analysis

This release combines new cost data and collection capabilities with operational updates. Endpoint access defaults change, and the release includes corrections across pricing, pagination, request handling, providers, and serialization.

Check if affected (1)

breakingEndpoint defaults, deactivated without an admin token
Applies if you use endpoints without setting an admin token.

KubeVelav1.11.0CI/CD & App DeliveryJul 20, 2026

CHECK 3OTHER 67View full analysis

A release with operator-facing authorization and credential-handling fixes, alongside new Helm, CUE, and workflow capabilities. It also adds validation improvements and dependency updates.

Check if affected (3)

securityExplicit authorization for vela-system definitions
Applies if you use vela-system definitions.
securityCredential redaction for Terraform module remote URLs
Applies if you configure Terraform module remote URLs.
breakingUndeclared parameter validation in application definitions
Applies if you use application definitions.

Jaegerv2.20.0ObservabilityJul 20, 2026

ACTION 1CHECK 3PLAN 1OTHER 27View full analysis

A release with backend compatibility removals, forced migrations, new configuration and CLI capabilities, and correctness fixes across storage, extensions, and related components. It does not disclose security advisories or security-specific flaws.

Action needed (1)

breakingTemplate creation through esclient
Template creation moves to esclient, and legacy mapping rendering is retired.

Check if affected (3)

breakingSupport for elasticsearch v6, removed
Applies if you use elasticsearch v6.
breakingThe jaegermcp extension, merged into jaegerquery
Applies if you use the jaegermcp extension.
breakingExpired stable feature gates, removed
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedThe legacy flag, deprecated
Applies if you use legacy flag.

Ciliumv1.19.6Networking & MessagingJul 16, 2026

CHECK 1OTHER 46View full analysis

A maintenance release with numerous correctness fixes, Gateway API and telemetry additions, dependency and image updates, and internal behavior changes. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingHelm handling of hostFirewall.enabled disablement
Applies when you use Helm to disable hostFirewall.enabled, toggling it from true to false.

KubeEdgev1.23.1Provisioning & RuntimeJul 15, 2026

CHECK 1OTHER 7View full analysis

A feature and behavior release that adds Windows and device-management capabilities, changes edge database and node-querying behavior, and updates the Kubernetes dependency. Device status retrieval now uses the new DeviceStatus CRD.

Check if affected (1)

breakingThe DeviceStatus CRD for device status retrieval
Applies if you use the DeviceStatus CRD.

KubeEdgev1.21.2Provisioning & RuntimeJul 15, 2026

CHECK 6PLAN 1OTHER 10View full analysis

This release combines correctness fixes with changes to node-job behavior, operator capabilities, and command workflows. It introduces configuration updates for edge nodes, which are disabled by default and require an EdgeCore restart; no security advisories are identified.

Check if affected (6)

breakingThe v1alpha2 NodeUpgradeJob and ImagePrePullJob defaults
Applies if you use NodeUpgradeJob or ImagePrePullJob.
breakingNode-job switching constraint
Applies if you use NodeUpgradeJob or ImagePrePullJob.
breakingThe taskManager node-job module, disabled by default
Applies if EdgeCore is running.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe v1alpha1 NodeUpgradeJob and ImagePrePullJob jobs, deprecated
Applies if you use NodeUpgradeJob or ImagePrePullJob.

Envoyv1.39.0Networking & MessagingJul 14, 2026

CHECK 11OTHER 50View full analysis

A broad release with operator-facing changes across configuration, protocols, extensions, networking, and observability. Security fixes address multiple identified CVEs and a GHSA, while changed defaults, stricter input validation, and removed functionality may affect existing deployments.

Check if affected (11)

securityhighHTTP/2 header limits and flood protection
Applies if you use HTTP/2.
securityhighHTTP/3 QPACK and content-length security fixes
Applies if you use HTTP/3.
securityhighAdditional protocol, parser, formatter, and decompression security fixes
Applies if you use DNS query validation, JSON nesting limits, PROXY protocol TLV, the formatter, TCP StatsD, TLS SAN, or Zstd decompression.
+ 8 more on the release page

Backstagev1.53.0CI/CD & App DeliveryJul 14, 2026

ACTION 1CHECK 12PLAN 3OTHER 259View full analysis

A substantial mixed feature and maintenance release adds backend, frontend, catalog, authentication, webhook, and TechDocs capabilities alongside dependency updates and defect fixes. It also includes operator-visible changes to APIs, configuration validation, OpenAPI tooling, and MCP transport behavior; no security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingOpenAPI breaking change detection with oasdiff
@useoptic/optic and @useoptic/openapi-utilities have been replaced with oasdiff for OpenAPI breaking change detection.

Check if affected (12)

breakingSchema loading rejects invalid imports
Applicability is not stated in the release notes.
breakingThe package schema openapi init and repo schema openapi test commands, removed
Applies if you use package schema openapi init or repo schema openapi test.
breakingMutually exclusive userGroupMember.path and user.filter configuration
Applies if you configure both userGroupMember.path and user.filter.
+ 9 more on the release page

Plan ahead (3)

deprecatedOpaque entity header extension point deprecation
Applies if you use the opaque entity header extension point.
deprecatedDynamic Client Registration deprecation warning
Applies if you enable Dynamic Client Registration.
deprecatedStable auth.clientIdMetadataDocuments configuration
Applies if you configure auth.clientIdMetadataDocuments or auth.experimentalClientIdMetadataDocuments.

CoreDNSv1.14.5Kubernetes CoreJul 10, 2026

ACTION 1CHECK 1OTHER 30View full analysis

A release with operator-visible behavior corrections, new capabilities, configuration changes, and updated defaults. The changes span CoreDNS core behavior and multiple plugins, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

breakingGo TLS defaults in core
The core component uses Go TLS defaults in this release.

Check if affected (1)

breakingDefault truncate amount for bare truncate
Applies if you configure truncate.

containerdv2.3.3Kubernetes CoreJul 10, 2026

CHECK 2OTHER 7View full analysis

A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.

Check if affected (2)

breakingThe CreateContainer constraint for stopped sandboxes
Applies if you use CreateContainer when the sandbox is not running.
breakingThe erofs default mkfs block size
Applies if you use erofs across platforms.

containerdv2.2.6Kubernetes CoreJul 9, 2026

ACTION 1OTHER 3View full analysis

A maintenance release with CRI and image-distribution fixes. The CRI constraint on CreateContainer requests may require action, while the other fixes take effect through the upgrade.

Action needed (1)

breakingCreateContainer rejection for stopped sandboxes
The CRI now rejects CreateContainer requests when the sandbox is not running. This constraint ships in containerd v2.2.6.

SPIREv1.15.2SecurityJul 9, 2026

ACTION 2CHECK 1OTHER 32View full analysis

A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.

Action needed (2)

securityMigration from github.com/docker/docker to github.com/moby/moby
Dependencies from github.com/docker/docker were migrated to their github.com/moby/moby equivalents to resolve CVEs. The migration ships in this release.
breakingRPC metrics from agent health check loopback calls
Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.

Check if affected (1)

breakingJWT-SVID serving by the delegated API
Applies if you use the delegated API for admin or downstream entries.

Keycloak26.7.0SecurityJul 9, 2026

ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

securityPre-account takeover attack exposure
The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

securitymediumCVE-2026-9796, admin role rename authorization
Applies if you use manage-clients.
securitymediumCVE-2026-9689, OIDC redirect URI parameter handling
Applies if you use OIDC.
securitymediumCVE-2026-9798, CIBA account lockout
Applies if you run the CIBA authentication flow.
+ 16 more on the release page

Plan ahead (4)

deprecatedThe V1 API, deprecated
Applies if you use V1.
deprecatedThe Require Discoverable Credential option, deprecated
Applies if you configure the Require Discoverable Credential option.
deprecatedThe Twitter IDP implementation, deprecated
Applies if you use the Twitter IDP implementation.
+ 1 more on the release page

TiKVv8.5.7Storage & DataJul 9, 2026

ACTION 1CHECK 1OTHER 41View full analysis

A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.

Action needed (1)

securityThird-party dependency upgrades for TiKV 8.5
TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.

Check if affected (1)

breakingInvalid max_ts updates rejected by default
Applies if you do not set storage.max-ts.action-on-invalid-update.

cert-managerv1.21.0SecurityJul 8, 2026

CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.
+ 2 more on the release page

Plan ahead (2)

deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.
deprecatedServerSideApply feature gate deprecation

Thanosv0.42.0ObservabilityJul 8, 2026

ACTION 1CHECK 4OTHER 19View full analysis

A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.

Action needed (1)

securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186
The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.

Check if affected (4)

securityReceive tenant ID validation
Applies if you run Receive.
breakingQuery-Frontend time_taken field renamed to time_taken_ms
Applies if you run Query-Frontend.
breaking--shipper.ignore-unequal-block-size flag removed
Applies if you configure --shipper.ignore-unequal-block-size.
+ 1 more on the release page

gRPCv1.82.1Networking & MessagingJul 8, 2026

CHECK 1View full analysis

A dependency-focused release raises the minimum supported Python protobuf version. The headings contain no operator-facing changes.

Check if affected (1)

breakingThe Python protobuf dependency lower bound, raised
Applies if you use Python.

k8gbv0.20.0Kubernetes CoreJul 3, 2026

CHECK 4OTHER 49View full analysis

k8gb v0.20.0 centers on ZoneDelegation-based DNS management, with TLSRoute and annotation support alongside changes to defaults and naming. The release also includes defect fixes and dependency updates, and no security advisories or vulnerabilities are identified.

Check if affected (4)

breakingThe Bootstrap service, removed
Applies if your configuration uses the Bootstrap service.
breakingThe dynamicZones setting, removed
Applies if your configuration uses dynamicZones.
breakingThe doFinalize default, set to false
Applies if you use doFinalize in ZoneDelegation finalization.
+ 1 more on the release page

gRPCv1.82.0Networking & MessagingJul 2, 2026

CHECK 1OTHER 12View full analysis

A feature and maintenance release that adds and changes capabilities across Core, PHP, Python, and Ruby, corrects runtime defects, and upgrades protobuf dependencies. The Python 1.82.0 package was removed from PyPI.

Check if affected (1)

breakinggRPC Python release 1.82.0, yanked from PyPI
Applies if you use gRPC Python release 1.82.0.

Harborv2.15.2Storage & DataJul 2, 2026

ACTION 1CHECK 2OTHER 21View full analysis

A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.

Action needed (1)

securityToken and blob-mount source validation
Blob-mount source projects are validated, and tokens without iat are rejected.

Check if affected (2)

breakingThe bundled PostgreSQL version, upgraded
Applies if you use PostgreSQL.
breakingThe cache backend, changed from redis to valkey
Applies if you use redis.

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().

Browse by month