A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.
Action needed (1)
securityhighCVE-2025-47913 remediation
The release adds a replace directive that points
golang/x/cryptoto the patchedopenshift/golang-cryptomodule to remediate CVE-2025-47913.
Check if affected (2)
breaking
QuiesceFailedindication renamed toQuiesceTimeoutApplies if you use Windows VSS.
The release replaces the
QuiesceFailedindication withQuiesceTimeoutand adds a 60-second Velero pre-backup hook timeout to better handle Windows VSS limitations.breaking
DefaultVirtWebhookClient{QPS,Burst}values alignedApplicability is not stated in the release notes.
The release aligns the
DefaultVirtWebhookClient{QPS,Burst}values withDefaultVirtWebhookClient{QPS,Burst}to help avoid saturating the webhook client during mass eviction events.