AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release focused on correctness fixes and dependency updates, with a small number of new extension points. It does not introduce broad operator-facing configuration changes.
Action needed (1)
breakingRemoval of the Ingress HostFW Policy between RevSNAT and RevDNAT
The BPF NodePort path removes the Ingress HostFW Policy between RevSNAT and RevDNAT.
A maintenance release focused on bug fixes, dependency updates, and image refreshes. It also removes a datapath behavior and includes security dependency fixes that may require operator attention.
Action needed (3)
securityThe google. module, updated to v1.83.1
The google. module is updated to v1.83.1 in this release as a security dependency fix.
securityThe google. module, updated to v1.83.2
The google. module is updated to v1.83.2 in this release as a security dependency fix.
breakingThe Ingress HostFW Policy between RevSNAT and RevDNAT, removed
The Ingress HostFW Policy between RevSNAT and RevDNAT is removed in this release.
A broad feature and maintenance release adds scaffolder recovery and credential controls, TechDocs, notification and streaming capabilities, and Kubernetes and authentication improvements. It also includes dependency and tooling security updates, a security fix, and compatibility changes that affect users of the listed resolvers, catalog integrations, MCP configuration, and task recovery.
Action needed (6)
securityModule Federation dependency updates for security
This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.
securityYarn tooling dependency updates for security
This release updates the Yarn tooling dependencies to versions that avoid known security vulnerabilities.
securityModule Federation security dependency update
This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.
securityOpenAPI generator tooling security update
This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.
securityOpenAPI generator tooling security update
This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.
breakingLocale-insensitive Unicode casing
String handling now uses locale-insensitive Unicode casing for consistent results across environments.
Check if affected (6)
securityKubernetes catalog cluster locator URL validation
Applies if you use the catalog cluster locator.
securityPull request workspace handling security fix
Applies if you use pull request workspace handling.
breakingGitHub user ID catalog lookup matching
Applies if you use GitHub user ID catalog lookups.
Plan ahead (1)
deprecatedGitHub username sign-in resolver deprecation
Applies if you use the GitHub username sign-in resolver.
A substantial feature and compatibility release for operators, with changed defaults and interfaces alongside correctness and performance improvements. It also includes identified security fixes and refreshes a broad set of dependencies.
Action needed (2)
securityhighThe CVE-2026-15809 /etc/passwd injection fix
CRI-O fixes CVE-2026-15809, which allowed a bypass of the CVE-2022-4318 fix and /etc/passwd injection through newline characters in the HOME environment variable.
securityhighThe Go toolchain, updated to 1.26.4
The Go toolchain is updated to 1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
Check if affected (4)
breakingThe insecure_registries option and --insecure-registry flag, removed
Applies if you configure insecure_registries or use --insecure-registry.
breakingThe container_level_enabled default, changed to checkpoint_only
Applies if you do not configure container_level_enabled.
breakingThe gRPC message size defaults, reduced to 16 MiB
Applies if grpc_max_send_msg_size or grpc_max_recv_msg_size is not configured.
A feature-rich release with breaking API and configuration changes, expanded experimental query and storage capabilities, and many correctness fixes. It also includes routine dependency updates.
Action needed (1)
breakingThe searchdepth constraint
Query handling caps searchdepth at 10000 and rejects negative values.
Check if affected (4)
breakingRemoval of the v1 http endpoints
Applies if you use v1 http endpoints.
breakingThe ai. configuration, replaced by ai.
Applies if you configure ai..
breakingElasticsearch configuration key validation
Applicability is not stated in the release notes.
A maintenance release with breaking removal of deprecated APIs alongside performance and correctness fixes. It also tightens feature-gate identifier validation and updates configuration schema handling.
Action needed (5)
breakingRemoval of deprecated AddScraper
The deprecated AddScraper function is removed from pkg/scraperhelper/controller.
breakingRemoval of deprecated ZapOptions
The deprecated ZapOptions configuration is removed from pkg/service.
breakingRemoval of deprecated WithForceUnmarshaler
The deprecated WithForceUnmarshaler function is removed from pkg/xconfmap.
breakingRemoval of deprecated DefaultMetricsBuilderConfig
The deprecated DefaultMetricsBuilderConfig function is removed from cmd/mdatagen.
breakingRemoval of deprecated LoggingOptions
The deprecated LoggingOptions configuration is removed from pkg/service.
Check if affected (2)
breakingRemoval of deprecated AggregationTemporality, Duration, and SetDuration
Applies if you use AggregationTemporality, Duration, or SetDuration.
breakingReplacement of deprecated configuration watcher APIs
Applies if you use extensioncapabilities., Extensions., or service..
A security-focused maintenance release with extensive Linux and OpenSSH vulnerability remediation, broad dependency updates, and platform and image changes. Operators should account for the dropped platform and image support and the new Vagrant 2.2.5 requirement.
Action needed (41)
securitycriticalcontainerd vulnerability remediation
containerd is updated with remediation for CVE-2026-47262, CVE-2026-50195, CVE-2026-53488, CVE-2026-53489, and CVE-2026-53492.
securitycriticalgo vulnerability remediation
go is updated with remediation for the listed vulnerabilities, including CVE-2025-61726, CVE-2025-61727, and CVE-2025-61728.
securityhighbind vulnerability remediation
bind is updated with remediation for CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677.
securityhighglib vulnerability remediation
glib is updated with remediation for CVE-2025-13601 and CVE-2025-14087.
securityhighglibc vulnerability remediation
glibc is updated with remediation for CVE-2025-15281, CVE-2026-0861, and CVE-2026-0915.
securityhighgnutls vulnerability remediation
gnutls is updated with remediation for the listed vulnerabilities, including CVE-2025-14831, CVE-2025-9820, and CVE-2026-1584.
securityhighincus vulnerability remediation
incus is updated with remediation for CVE-2026-23953.
securityhighlibtasn1 vulnerability remediation
libtasn1 is updated with remediation for CVE-2025-13151.
securityhighnvidia-drivers vulnerability remediation
nvidia-drivers is updated with remediation for the listed vulnerabilities, including CVE-2025-33219, CVE-2025-33221, and CVE-2026-24182.
securityhighpodman vulnerability remediation
podman is updated with remediation for CVE-2025-52881 and CVE-2025-9566.
securityhighsssd vulnerability remediation
sssd is updated with remediation for CVE-2025-11561 and CVE-2026-6245.
securityhighurllib3 vulnerability remediation
urllib3 is updated with remediation for CVE-2025-66418 and CVE-2025-66471.
securityhighopenssh vulnerability remediation
openssh is updated with remediation for CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, and CVE-2026-60002.
securitymediumc-ares vulnerability remediation
c-ares is updated with remediation for CVE-2025-62408.
securityhighcurl vulnerability remediation
curl is updated with remediation for CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079, CVE-2025-15224, CVE-2026-1965, CVE-2026-3783, CVE-2026-3784, and CVE-2026-3805.
securitymediumlibarchive vulnerability remediation
libarchive is updated with remediation for CVE-2025-60753 and CVE-2026-4426.
securitymediumlibxml2 vulnerability remediation
libxml2 is updated with remediation for CVE-2026-0989, CVE-2026-0990, CVE-2026-0992, and CVE-2026-1757.
securitymediumlibxslt vulnerability remediation
libxslt is updated with remediation for CVE-2025-10911 and CVE-2025-11731.
securitymediump11-kit vulnerability remediation
p11-kit is updated with remediation for CVE-2026-2100.
securityhighrsync vulnerability remediation
rsync is updated with remediation for the listed vulnerabilities, including CVE-2025-10158, CVE-2026-29518, and CVE-2026-41035.
securitymediumutil-linux vulnerability remediation
util-linux is updated with remediation for CVE-2025-14104 and CVE-2026-27456.
securitylowintel-microcode vulnerability remediation
intel-microcode is updated with remediation for CVE-2025-31648.
securitylowlibpcap vulnerability remediation
libpcap is updated with remediation for CVE-2025-11961 and CVE-2025-11964.
securitycriticalLinux vulnerability remediation
Linux is updated with remediation for the listed vulnerabilities, including CVE-2026-80888 and the other advisories recorded for this change.
securityhighbubblewrap vulnerability remediation
bubblewrap is updated with remediation for CVE-2026-41163.
securitymediumexpat vulnerability remediation
expat is updated with remediation for CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-41080, and CVE-2026-45186.
securityhighgnupg vulnerability remediation
gnupg is updated with remediation for CVE-2026-24881, CVE-2026-24882, and CVE-2026-24883.
securitymediumlibcap vulnerability remediation
libcap is updated with remediation for CVE-2026-4878.
securitymediumlibgcrypt vulnerability remediation
libgcrypt is updated with remediation for CVE-2026-41989.
securityhighopenssh vulnerability remediation
openssh is updated with remediation for CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, and CVE-2026-35414.
securitycriticalopenssl vulnerability remediation
openssl is updated with remediation for the listed vulnerabilities, including CVE-2026-2673, CVE-2026-28386, and CVE-2026-28387.
securitylowrunc vulnerability remediation
runc is updated with remediation for CVE-2026-41579.
securitymediumsystemd vulnerability remediation
systemd is updated with remediation for CVE-2026-40223, CVE-2026-40225, and CVE-2026-40226.
securitylowxz-utils vulnerability remediation
xz-utils is updated with remediation for CVE-2026-34743.
securitylowzlib vulnerability remediation
zlib is updated with remediation for CVE-2026-27171.
breakingEquinix Metal (Packet) support removal
Support for Equinix Metal (Packet) is dropped.
breakingRackspace support removal
Support for Rackspace, including OnMetal, is dropped.
breakingThe Oklo release codename, removed
The Oklo release codename is dropped.
breakingVMware "insecure" image removal
The VMware "insecure" image is dropped.
breakingVagrant VirtualBox image removal
The Vagrant VirtualBox image is dropped.
breakingVagrant 2.2.5 requirement
Vagrant 2.2.5 is now required.
A maintenance release focused on correctness and data-exposure fixes. It also includes security-related dependency updates and a stricter default for namespaced Vault authentication.
Action needed (6)
securityACME server response body limit
ACME server response bodies are capped at 16 MiB to prevent unbounded-body denial-of-service conditions.
securityChallenge. response disclosure fix
The ACME HTTP-01 self-check no longer copies the fetched response body into Challenge.. This prevents internal response contents reached through redirects from being disclosed.
securityGo 1.26.6
The release upgrades Go to 1.26.6, which includes security fixes in the Go command and several standard library packages.
securitygoogle. v1.83.2
The release updates google. to v1.83.2 to fix reported security vulnerabilities.
securitygolang. v0.56.0
The release updates golang. to v0.56.0 to fix reported security vulnerabilities.
breakingValidation for converted AdmissionReview requests
Validation now also applies to equivalent-converted AdmissionReview requests on non-v1 API versions. These requests could previously bypass validation.
Check if affected (1)
breakingNamespaced Vault issuer ambient credentials default
Applies if you use a namespaced Issuer with Vault AWS IAM authentication.
A maintenance release that enables gRPC capabilities and observability, broadens xDS matching, removes a WRR guard, and corrects proxy hostname handling. It also updates connection scaling service configuration and server listener matching.
Action needed (2)
breakingThe v2_non_owning_waker_implementation experiment enabled
The v2_non_owning_waker_implementation experiment is enabled in the promise-based filter.
breakingThe WRR custom backend metrics guard removed
The release removes the WRR environment-variable guard for custom backend metrics.
A security-focused maintenance release with dependency updates and fixes for policy and egress behavior. It also includes correctness changes, deprecation warning enforcement, and a narrowed policy constraint that may require operator changes.
Action needed (2)
securitycriticalGo and x/net updates for CVE-2026-39821
The release updates Go to 1.26.6 and x/net to resolve CVE-2026-39821.
securityhighGo update for CVE-2026-56853
The release updates Go to address CVE-2026-56853.
Check if affected (3)
securityPolicyException scope bypass fix for GHSA-5cjf-wwfg-pj4c
Applies if you use the PolicyException CRD.
securityapiCall. egress blocklist bypass fix
Applies if you configure apiCall. egress.
breakingglobalContext constraint in namespaced policies
Applies if you use globalContext in namespaced policies.
A feature release adding new Helm capabilities and output options, alongside correctness fixes and performance improvements. It also includes dependency updates with two disclosed security-related bumps.
Action needed (3)
securitycriticalgolang. update for GO-2026-5026
Helm updates golang. to v0. to address GO-2026-5026.
securitymediumgo. update for GO-2026-5158
Helm updates go. to v1. for GO-2026-5158.
breakingPer-file decompression size limit removal
Helm removes the per-file decompression size limit from file decompression.
Check if affected (1)
breakingOwnership verification before resource deletion
Applicability is not stated in the release notes.
A workflow-heavy maintenance release corrects reliability, state-management, signing, and pub/sub delivery defects. It also changes binary gRPC metadata filtering for output bindings, with no newly announced operator configuration requirements.
Action needed (1)
breakingBinary gRPC metadata propagation in InvokeBinding, removed
Binary gRPC metadata with keys ending in -bin is no longer copied from incoming gRPC calls into output binding component metadata for InvokeBinding.
A feature release that adds plugin, runtime, concurrency, and observability capabilities. It also corrects runtime defects and enforces guest-memory limits.
Action needed (1)
breakingThe max-guest-memory limit is enforced
This release enforces the max-guest-memory limit.
Plan ahead (1)
deprecatedThe deprecated --enable-meters flag alias
A feature-rich release with breaking changes, new controllers, and expanded provisioning capabilities. It also includes correctness fixes and broad dependency updates.
Action needed (1)
breakingThe separate TryInit call, removed
Provisioner no longer makes a separate TryInit call in this release.
Plan ahead (1)
deprecatedThe BMH Taints field, deprecated
A maintenance release updates the proxy and dependencies, fixes destination behavior, and tightens multicluster credential and Link resource handling. The changes concern proxy, destination, and multicluster components, alongside routine dependency updates.
Action needed (2)
breakingCluster credential secrets and the exec auth provider
Cluster credential secrets created by linkerd multicluster link use the token auth provider. The exec auth provider is disallowed because it is not used or necessary.
breakingLink resource lookup scope
Link resource lookups are restricted to the linkerd-multicluster namespace.
A security-focused maintenance release with fixes for vulnerabilities and changes to image fetching and Windows log handling. Runtime and performance improvements are also included.
Action needed (2)
securityCVE-2026-53495 and GHSA-7jxh-36q5-gcqv fixes
CVE-2026-53495 and GHSA-7jxh-36q5-gcqv are addressed in this release.
securityGHSA-rp3h-jf77-q9p4 fix
GHSA-rp3h-jf77-q9p4 is addressed in this release.
Check if affected (1)
breakingThe ScrubLogs default on Windows
Applies if you run on Windows.
A security-focused maintenance release fixes two disclosed vulnerabilities, changes the Windows logging default, and hardens registry fetching. It also includes correctness and performance fixes.
Action needed (2)
securityCVE-2026-53495 and GHSA-7jxh-36q5-gcqv security fix
This release fixes the disclosed vulnerability identified by CVE-2026-53495 and GHSA-7jxh-36q5-gcqv.
securityGHSA-rp3h-jf77-q9p4 security fix
This release fixes the disclosed vulnerability identified by GHSA-rp3h-jf77-q9p4.
Check if affected (1)
breakingThe ScrubLogs Windows default
Applies if you run containerd on Windows.
A broad multi-cloud release adds resource integrations, filters, and policy actions across AWS, Azure, and GCP, alongside correctness fixes and dependency updates. Operators should also review the LDAP input handling improvement and the behavior changes affecting existing configurations.
Check if affected (3)
breakingThe Status field, replaced by State
Applies if you configure Status.
breakingThe SCM basic auth method, replaced by an Entra ID bearer token
Applies if you use SCM basic auth.
breakingThe cloud-run label mutation fields, restricted to the schema
Applies if you use cloud-run.
A narrowly scoped breaking maintenance release removes the VRLog endpoint. Its enabling flag remains as a deprecated no-op until v26.
Check if affected (2)
breakingThe /debug/vrlog endpoint, removed
Applies if you use /debug/vrlog.
deprecatedThe --vreplication-enable-http-log flag, deprecated as a no-op
Applies if you configure --vreplication-enable-http-log.
A maintenance release with correctness fixes and dependency updates. The /debug/vrlog removal and newly enforced safety limits affect operators using those paths.
Action needed (2)
breakingRecursion-depth limit on the streaming recursive CTE path
A recursion-depth limit is enforced on the streaming recursive CTE path.
breakingStored-procedure safety checks on the streaming CALL path
Stored-procedure safety checks are enforced on the streaming CALL path.
Check if affected (1)
breakingThe /debug/vrlog endpoint, removed
Applies if you use /debug/vrlog.
Plan ahead (1)
deprecatedThe --vreplication-enable-http-log flag, deprecatedremoval planned in v26
Applies if you configure --vreplication-enable-http-log.
A maintenance and API-evolution release with client configuration deprecations, a higher Go toolchain requirement, performance improvements, and a breaking resource-creation API signature change. The release also includes compatibility, error-handling, platform support, and component behavior updates.
Check if affected (3)
breakingDeprecated fields with keepalive section
Applicability is not stated in the release notes.
breakingGo 1.25.0 support removal
Applies if you depend on go.
breakingtelemetry. and telemetry. return signature
Applies if you use telemetry. or telemetry..
Plan ahead (1)
deprecatedClient configuration fields deprecated in favor of keepalive
Applies if you configure any of idle_conn_timeout, max_idle_conns, max_idle_conns_per_host, disable_keep_alives, idle_timeout, or keep_alives_enabled.
A broad feature release expands scanning, policy, reporting, remediation, notifications, telemetry, integrations, and output capabilities. It also includes security hardening and stricter scan constraints, alongside many correctness and runtime fixes.
Action needed (2)
securityGo dependency security vulnerabilities
Dependabot fixes security vulnerabilities in Go dependencies shipped with the release.
securitygosec SAST findings
The release remediates gosec SAST findings in the Go codebase.
Check if affected (10)
securityGrafeas filtering through resourceURL
Applies if you run imagescan.
breakingClient-supplied account and accessKey in scan requests
Applies if you use scan requests.
breakingHard validation for --include-controls
Applies if you configure --include-controls.
Plan ahead (1)
deprecatedThe --fail-threshold flag, hidden and deprecated
Applies if you configure --fail-threshold.
