AI-analyzed release notes for CNCF graduated and incubating projects.
Version v2.5.0 adds runtime and WIT/API capabilities and includes correctness and dependency updates. The release also enables wasip3 by default and includes a quinn-proto fix for RUSTSEC-2026-0185.
Action needed (1)
securityhighThe quinn-proto security fix
The quinn-proto dependency fix ships in wasmCloud v2.5.0 and addresses RUSTSEC-2026-0185.
Check if affected (1)
breakingDefault wasip3 enablement with wasmtime 46
Applies if your workloads use wasip3.
Release v1.14.0 adds tracing and observability capabilities and broadens ResolutionRequest resolution support. It also includes correctness fixes, a Go security-related update, and shipped dependency updates.
Action needed (1)
securityGo 1. update
Go is updated to 1. in v1.14.0 for CVE remediation.
This release updates the Alpine base image and fixes a Helm chart TLS certificate issue. The Helm fix applies to deployments that use a custom namespace, while the base image change addresses security concerns.
Action needed (1)
securityThe alpine base image, upgraded
The alpine base image is promoted from alpine:3. to alpine:3. to address security concerns.
Karmada v1.17.4 updates its Alpine base image to address security concerns. The release also fixes a Helm chart TLS certificate SAN mismatch when deploying to a custom namespace.
Action needed (1)
securityThe alpine base image, updated to alpine:3.
The alpine base image is updated from alpine:3. to alpine:3. to address security concerns. The update ships in Karmada v1.17.4.
Karmada v1.16.7 updates its Alpine base image for security concerns and includes a Helm chart fix for TLS certificate SANs in custom namespaces. The release affects deployments that use the updated image or the affected Helm chart configuration.
Action needed (1)
securityThe alpine base image, updated
The base image alpine is promoted from alpine:3. to alpine:3. to address security concerns.
A maintenance release with a security fix for unbounded reads in the Terraform remote configuration loader and a correctness fix for CUE imports in status details. It also adds repository ownership metadata.
Check if affected (1)
securityUnbounded read prevention in the Terraform remote configuration loader
Applies if you use the Terraform remote configuration loader.
This release includes a security correction for an unbounded-read denial-of-service condition in the Terraform remote configuration loader. The fix is backported to release-1. and concerns deployments that use this loader.
Check if affected (1)
securityTerraform remote configuration loader DoS fix (GHSA-fmgp-q6jx-gg3x)
Applies if you use the Terraform remote configuration loader.
A maintenance release with a dependency and toolchain update, broad defect corrections, and behavior improvements across authentication, routing, monitoring, clustering, and JetStream. It also removes JSONP monitoring callbacks and addresses MQTT and authorization-related connection and permission handling.
Check if affected (3)
securityNats-Trace-Dest publish permission checks for leaf connections
Applies if you use Leaf connections.
securityMQTT subscribe deny rules on retained message and QoS replay paths
Applies if you use MQTT.
breakingThe JSONP callback support in monitoring endpoints, removed
Applies if you use JSONP callback support.
Version 26.6.4 is a security-focused Keycloak release with fixes for disclosed vulnerabilities. It also upgrades Quarkus to 3., an informational dependency change for operators.
Action needed (8)
securityhighCVE-2026-9099, group-admin escalation to realm-admin
Version 26.6.4 fixes the group-admin escalation to realm-admin identified as CVE-2026-9099 in Keycloak.
securityhighCVE-2026-9086, cross-site scripting via URI validation bypass
Version 26.6.4 fixes the cross-site scripting issue caused by a case-insensitive URI validation bypass identified as CVE-2026-9086 in Keycloak.
securityhighCVE-2026-9795, improper scope mapping enforcement
Version 26.6.4 fixes the privilege escalation caused by improper scope mapping enforcement identified as CVE-2026-9795 in Keycloak.
securityhighCVE-2026-9800, policy enforcer URI comparison
Version 26.6.4 fixes the authorization bypass caused by incorrect URI comparison in the Keycloak policy enforcer, identified as CVE-2026-9800.
securityhighCVE-2026-11800, JWT algorithm confusion authentication bypass
Version 26.6.4 fixes the JWT algorithm confusion authentication bypass identified as CVE-2026-11800 in Keycloak.
securitymediumCVE-2026-9083, arbitrary filesystem path probing
Version 26.6.4 fixes the information disclosure through arbitrary filesystem path probing identified as CVE-2026-9083 in Keycloak.
securitymediumCVE-2026-9705, disabled client takeover
Version 26.6.4 fixes the issue identified as CVE-2026-9705, which allowed disabled clients to be re-enabled and taken over through a registration access token in Keycloak.
securitymediumCVE-2026-9799, UMA permission ticket bypass
Version 26.6.4 fixes the unauthorized resource access caused by a UMA permission ticket bypass identified as CVE-2026-9799 in Keycloak.
cert-manager v1. changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.
Action needed (2)
securityhighGo v1. with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507
Go is updated to v1. in cert-manager v1. to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityGo 1. dependency upgrade
Go is upgraded to 1. as part of the dependency updates in cert-manager v1..
Check if affected (1)
securityReduced cert-manager-edit permissions for Challenge and Order creation and updates
Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.
A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.
Action needed (1)
securityhighGo updated to v1.
Go is updated to v1. to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
Check if affected (1)
securityThe cert-manager-edit aggregate ClusterRole permissions
Applicability is not stated in the release notes.
A maintenance release with disclosed Envoy security fixes across HTTP/3 processing, protocol handling, filters, decompression, certificates, and statistics. The corrections are available through an upgrade to this release.
Action needed (7)
securityhighCVE-2026-48044, Zstd decompressor ratio enforcement
CVE-2026-48044 fixes memory exhaustion in the Zstd decompressor by enforcing the MaxInflateRatio limit inside the decompression loop.
securitymediumCVE-2026-47692, PROXY protocol TLV length validation
CVE-2026-47692 fixes a length mismatch when passthrough TLVs and added TLVs exceed the maximum length in the PROXY protocol header.
securitymediumCVE-2026-47221, HTTP 303 body-less redirect handling
CVE-2026-47221 fixes a segmentation fault when handling HTTP 303 internal redirects for requests without a body.
securitymediumCVE-2026-48090, asynchronous token callback lifetime
CVE-2026-48090 fixes a callback that could run after the filter was torn down, preventing access to dangling pointers and the resulting use-after-free crash.
securitymediumCVE-2026-47778, peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte.
securitymediumCVE-2026-48497, query name length checking
CVE-2026-48497 adds sanity checking for query name length and uses ENVOY_BUG when the check fails, avoiding abnormal process termination.
securityGHSA-p7c7-7c47-pwch, QPACK blocked decoding fix
GHSA-p7c7-7c47-pwch fixes a denial-of-service vulnerability in Envoy's HTTP/3 stack caused by QPACK blocked decoding and unbounded memory growth.
Check if affected (7)
securityhighCVE-2026-48743, HTTP/3 headers-only content-length validation
Applies if you enable envoy..
securityhighCVE-2026-48042, JSON parser nesting depth limit
Applies if you set envoy. to false.
securitymediumCVE-2026-47207, ext_proc server response handling
Applies if you use the ext_proc server.
A maintenance release with Envoy security fixes and five ordinary defect corrections. The security fixes require upgrading, while no deprecations or forced operator configuration changes are announced.
Action needed (4)
securitymediumCVE-2026-47221 in HTTP 303 internal redirects
CVE-2026-47221 fixes handling of HTTP 303 internal redirects for body-less requests. The redirect code no longer attempts to drain an unallocated request body buffer.
securitymediumCVE-2026-48090 in asynchronous token change callbacks
CVE-2026-48090 fixes a bug where an asynchronous token change callback could run after the filter was torn down by onDestroy(), causing dangling-pointer access and a crash.
securitymediumCVE-2026-47778 in peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte. SAN parsing no longer permits NUL byte truncation to produce incorrect trust decisions.
securitymediumCVE-2026-48497 query name length checking
CVE-2026-48497 adds sanity checking for query name length to avoid abnormal process termination. The check uses ENVOY_BUG when it fails.
Check if affected (11)
securityhighCVE-2026-47220 in the %REQUESTED_SERVER_NAME% formatter
Applies if you configure the %REQUESTED_SERVER_NAME% formatter.
securityhighCVE-2026-48044 in the Zstd decompressor
Applies if you use the Zstd decompressor.
securityhighCVE-2026-48743 HTTP/3 headers-only content-length validation
Applies if you use HTTP/3 and enable envoy..
A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.
Action needed (12)
securityhighCVE-2026-47220 crash bug fix
The Envoy security update fixes the crash bug described by CVE-2026-47220.
securityhighCVE-2026-48044 memory exhaustion fix
The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.
securityhighCVE-2026-48042 JSON nesting-depth limit
The Envoy security update limits JSON nesting depth to 1000 through envoy..
securitymediumCVE-2026-47692 bug fix
The Envoy security update fixes the bug described by CVE-2026-47692.
securitymediumCVE-2026-47205 use-after-free crash fix
The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.
securitymediumCVE-2026-48090 asynchronous token callback handling
The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.
securitymediumCVE-2026-47778 Subject Alternative Name validation
The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).
securitymediumCVE-2026-47204 crash and use-after-free fix
The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.
securitymediumCVE-2026-48497 query name length checking
The Envoy security update fixes sanity checking of the query name length.
securitymediumCVE-2026-47775 padding oracle
The Envoy security update addresses a padding oracle described by CVE-2026-47775.
securityGHSA-p7c7-7c47-pwch denial-of-service fix
The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.
breakingWarn-level message logging
The message is now logged at warn level.
Check if affected (5)
securityhighCVE-2026-48743 HTTP/3 content-length validation
Applies if you use HTTP/3.
securitymediumCVE-2026-47207 ext_proc response handling
Applies if you use the ext_proc extension.
securitymediumCVE-2026-47221 HTTP 303 redirect handling
Applicability is not stated in the release notes.
A bug-fix release with two security fixes, along with routine correctness fixes and Go toolchain dependency updates. The security changes affect users of the static grpc auth plugin or twopcz handler; the release also updates Go to go1. and go1..
Check if affected (2)
securityConstant-time password comparison in the static grpc auth plugin
Applies if you use the static grpc auth plugin.
securityEscaping of reflected form values in the twopcz handler
Applies if you use the twopcz handler.
A maintenance release with multiple disclosed security fixes and a security-related Wasmtime dependency update. It also removes the Intel DLB connection-balancer extension from all builds and disables TLS certificate compression by default.
Action needed (16)
securityhighThe com_github_wasmtime dependency update
The Wasmtime dependency com_github_wasmtime was updated to resolve CVE-2026-47261. The update ships in the WebAssembly build.
securityhighREQUESTED_SERVER_NAME crash, CVE-2026-47220
The REQUESTED_SERVER_NAME crash was corrected in Envoy. The change addresses CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.
securityhighzstd RLE zip bomb, CVE-2026-48044
The zstd RLE zip bomb issue was corrected in Envoy. The change addresses CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHighly nested JSON destructor stack overflow, CVE-2026-48042
The stack overflow in the destructor of highly nested JSON was corrected in Envoy. The change addresses CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
securityhighHTTP/3 to HTTP/1 request smuggling, CVE-2026-48743
The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with a nonzero Content-Length was corrected in Envoy. The change addresses CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.
securitymediumAuthz per route crash, CVE-2026-47205
The Authz per route crash was corrected in Envoy. The change addresses CVE-2026-47205 and GHSA-mvh9-767w-x47j.
securitymediumThe ext_proc response issue, CVE-2026-47207
The ext_proc response handling issue involving one gRPC message was corrected in Envoy. The change addresses CVE-2026-47207 and GHSA-68cv-hq5f-g6xv.
securitymediumRouter internal redirects crash, CVE-2026-47221
The router internal redirects crash was corrected in Envoy. The change addresses CVE-2026-47221 and GHSA-rcff-gw58-pjpr.
securitymediumOAuth2 code verifier padding oracle, CVE-2026-47775
The OAuth2 code verifier padding oracle issue was corrected in Envoy. The change addresses CVE-2026-47775 and GHSA-396h-jpq4-vc7p.
securitymediumThe grpc_stats filter segfault, CVE-2026-47204
The grpc_stats filter segfault on Connect protocol requests to direct_response routes was corrected in Envoy. The change addresses CVE-2026-47204 and GHSA-3jxh-8p6x-7pf6.
securitymediumPROXY Protocol v2 skipped TLVs, CVE-2026-47692
The PROXY Protocol v2 header generator issue involving skipped TLVs and attacker-controlled spillover into the upstream application stream was corrected in Envoy. The change addresses CVE-2026-47692 and GHSA-wh36-hm39-mm3r.
securitymediumEmbedded NUL in TLS SAN truncation, CVE-2026-47778
The embedded NUL issue in TLS SAN truncation that could cause an authorization bypass was corrected in Envoy. The change addresses CVE-2026-47778 and GHSA-f8x4-rw5x-f3r7.
securitymediumOAuth2 filter late token completion, CVE-2026-48090
The OAuth2 filter issue involving late asynchronous token completion after stream teardown was corrected in Envoy. The change addresses CVE-2026-48090 and GHSA-3cj2-c63f-q26f.
securitymediumDNS UDP filter abnormal process termination, CVE-2026-48497
The abnormal process termination in the DNS UDP filter was corrected in Envoy. The change addresses CVE-2026-48497 and GHSA-j6g2-wf95-q66q.
securitymediumThe TcpStatsdSink heap buffer overflow, CVE-2026-48706
The heap buffer overflow in TcpStatsdSink was corrected in Envoy. The change addresses CVE-2026-48706 and GHSA-7q3f-gwg7-j8g4.
securityHTTP/3 QPACK blocked decoding, GHSA-p7c7-7c47-pwch
The HTTP/3 stack issue involving QPACK blocked decoding was corrected in Envoy. The change addresses GHSA-p7c7-7c47-pwch.
Check if affected (2)
breakingThe envoy. extension removal
Applies if you use envoy..
breakingThe envoy. default
Applies if you do not configure envoy..
A security-focused release with fixes for multiple Envoy components, extensions, protocols, and dependencies. It also disables the broken envoy. contrib extension at the Bazel layer for all builds and platforms.
Action needed (1)
securityhighcom_github_wasmtime dependency update, CVE-2026-47261
The com_github_wasmtime dependency was bumped to resolve CVE-2026-47261.
Check if affected (16)
securityhighREQUESTED_SERVER_NAME crash fix, CVE-2026-47220
Applies if you configure REQUESTED_SERVER_NAME.
securityhighzstd RLE zip bomb fix, CVE-2026-48044
Applies if you depend on zstd.
securityhighHighly nested JSON destructor stack overflow fix, CVE-2026-48042
Applies if you use JSON.
A security-focused release with fixes for crashes, request handling, protocol processing, authentication, and parsing, plus a security-related wasm dependency update. The contrib extension envoy. is disabled in all builds.
Action needed (1)
securityhighHighly nested JSON destructor stack overflow
The stack overflow in the destructor of highly nested JSON is corrected in connection with CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
Check if affected (15)
securityhighzstd RLE zip bomb correction
Applies if you use zstd.
securityhighHTTP/3 to HTTP/1 request smuggling
Applies if you use HTTP/3 and HTTP/1.
securityhighcom_github_wasmtime dependency update
Applies if you use wasm.
A security-focused maintenance release with fixes across filters, protocol handling, request processing, and JSON parsing. It also updates the Wasmtime dependency and disables the contrib extension envoy..
Action needed (1)
securityhighHighly nested JSON destructor stack overflow, corrected for CVE-2026-48042
This release corrects the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
Check if affected (14)
securityhighzstd RLE zip bomb, corrected for CVE-2026-48044
Applies if you use zstd.
securityhighHTTP/3 headers-only content-length validation, corrected for CVE-2026-48743
Applies if you use HTTP/3.
securityhighcom_github_wasmtime dependency update for CVE-2026-47261
Applies if you use wasm.
Crossplane v2. is a maintenance release with security fixes delivered through dependency and toolchain updates. It also corrects namespace handling for injected resource references in crossplane render, so rendered output matches reconciler behavior for cluster-scoped XRs.
Action needed (2)
securityPackage signature verification TOCTOU fix, GHSA-mf7q-r4rv-jv94
The package signature verification TOCTOU flaw identified by GHSA-mf7q-r4rv-jv94 is fixed through the crossplane-runtime v2. dependency bump. The affected code moved from crossplane to crossplane-runtime during the v2. milestone, so this fix ships through that dependency in Crossplane v2..
securityGo 1., golang., and golang. updates
The release-2. branch bumps Go to 1. and updates golang. and golang. for CVE-related security fixes.
This release includes a security fix for package signature verification and updates to dependencies. It concerns deployments affected by the disclosed package-signature-verification flaw or by the updated dependency versions.
Action needed (1)
securitycriticalPackage signature verification TOCTOU fix, GHSA-wfqx-gjrf-g28r
Crossplane v2. fixes the package signature verification TOCTOU issue identified by GHSA-wfqx-gjrf-g28r.
Crossplane v2.1.7 is a maintenance release with dependency and Go toolchain updates. The changes affect the software components shipped with this release.
Action needed (3)
securityThe github. module update
The github. module is updated to v0. in Crossplane v2.1.7.
securityThe golang. module update
The golang. module is updated to v0. in Crossplane v2.1.7.
securityThe Go toolchain at 1.
The Go toolchain is bumped to 1. in Crossplane v2.1.7.
A dependency maintenance release with security updates to the Go toolchain and MongoDB driver, alongside routine dependency bumps. Cosign and Docker remediation items were not applied and remain limitations.
Action needed (2)
securityhighThe Go toolchain, updated to 1.
The Go toolchain is updated to 1., the latest Go 1.25 security patch. The change addresses CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityThe go. module, updated to v1.
The go. module is updated to v1. with a security update.
A maintenance release that changes several defaults, updates dependencies, and fixes multiple security vulnerabilities. It also includes a fallback to scp for remote sources and destinations in auto mode.
Check if affected (5)
securitycriticalcontainerd v2.3.2 security fixes
Applies if you use containerd.
securityhighCVE-2026-53657 and GHSA-2j9v-p4xj-cjw2 guest agent socket fix
Applies if you run a QEMU VM that uses the guest agent socket.
breakingcontainerd. default on non-Linux guests
Applies if you run non-Linux guests.
containerd v2.1.9 includes security fixes alongside checkpoint-restore and image-label behavior changes, plus updates to bundled runc and the Go toolchain. The security fixes require the v2.1.9 release, while the other changes matter when their affected behavior is in use.
Action needed (5)
securitycriticalCVE-2026-53488 security fix
The CVE-2026-53488 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-xhf5-7wjv-pqxp.
securityhighCVE-2026-53492 security fix
The CVE-2026-53492 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-33vj-92qq-66hc.
securityhighCVE-2026-53489 security fix
The CVE-2026-53489 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-rgh6-rfwx-v388.
securitymediumCVE-2026-50195 security fix
The CVE-2026-50195 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-cvxm-645q-p574.
securitymediumCVE-2026-47262 security fix
The CVE-2026-47262 security issue is corrected in containerd v2.1.9 and is tracked as GHSA-jpcc-p29g-p8mq.
containerd v1.7.33 includes security updates for containerd and go-jose, along with runtime and toolchain dependency updates. It also changes file-read bounds and image-config label propagation.
Action needed (2)
securitycriticalcontainerd security updates for CVE-2026-53488 and CVE-2026-47262
containerd ships security updates associated with CVE-2026-53488 and CVE-2026-47262. The release also includes GHSA-jpcc-p29g-p8mq and GHSA-xhf5-7wjv-pqxp.
securityhighgo-jose/go-jose/v3 updated to v3.0.5
go-jose/go-jose/v3 is updated to v3.0.5 to fix GHSA-78h2-9frx-2jm8 and CVE-2026-34986.
This release includes containerd security changes, behavior changes, and updates to the bundled runc binary and Go toolchain. The security advisories and runtime updates concern deployments that use the affected container runtime components.
Action needed (1)
securitycriticalcontainerd security fixes, including CVE-2026-53488
The containerd change is associated with CVE-2026-53488, CVE-2026-47262, GHSA-jpcc-p29g-p8mq, and GHSA-xhf5-7wjv-pqxp.
containerd v2.3.2 is a maintenance release with disclosed security fixes, correctness and behavior changes, and dependency and toolchain updates. The security fixes are the main concern for operators, while the other changes matter where the affected behavior is in use.
Action needed (1)
securitycriticalThe containerd security fixes
containerd v2.3.2 includes a security fix identified as CVE-2026-50195 and associated with CVE-2026-47262, CVE-2026-53488, CVE-2026-53489, CVE-2026-53492, GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, and GHSA-xhf5-7wjv-pqxp.
A maintenance release with disclosed security fixes, dependency and toolchain updates, and changes to checkpoint and image-processing behavior. User-database reads are bounded in openUserFile, which may reject inputs that previously worked.
Action needed (2)
securitycriticalSecurity fixes for five disclosed CVEs
The release includes fixes for CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262, along with the associated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, and GHSA-xhf5-7wjv-pqxp advisories.
breakingBounded openUserFile user-database reads
User-database file reads in openUserFile are now bounded, so inputs that previously worked may be rejected.
Prometheus v3.5.4 is primarily a security maintenance release, with a fix for plaintext secret exposure and dependency updates addressing reported advisories. It also adds publication of container images to the GitHub Container Registry at ghcr..
Action needed (2)
securitycriticalgolang. and OpenTelemetry dependency updates
The golang. dependency is updated to v0., and OpenTelemetry to v1.. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.
securityPatched UI dependency versions
The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.
Check if affected (1)
securityPlaintext secret exposure via /-/config corrected
Applies if you access the /-/config endpoint.
A release focused on CRD compatibility and Entity Operator watching defaults, with fixes for disclosed security vulnerabilities. It affects deployments using older CRD APIs or configuring cross-namespace watching.
Action needed (2)
securityhighFix for CVE-2026-55225
The release fixes CVE-2026-55225, also identified as GHSA-mw9r-p8xp-wx96.
securitymediumFix for CVE-2026-55226
The release fixes CVE-2026-55226, also identified as GHSA-r427-j2h7-wv3m.
Check if affected (2)
breakingSupported CRD API versions narrowed
Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.
breakingEntity Operator cross-namespace watching default
Applies if you configure STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED or watchedNamespace.
wasmCloud v2.4.0 adds operator capabilities and configuration options while correcting runtime and tooling behavior. It also changes supported platform behavior and updates dependencies associated with Rust security advisories, so platform-specific users and deployments using the affected crates are most directly concerned.
Action needed (1)
securityThe postgres crates, updated for Rust security advisories
The postgres crates are updated for RUSTSEC-2026-0178, RUSTSEC-2026-1079, and RUSTSEC-2026-0180. This dependency update ships in wasmCloud v2.4.0.
Check if affected (1)
breakingwebgpu disabled for s390
Applicability is not stated in the release notes.
v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.
Check if affected (3)
securitymediumMySQL schema migrations 008
Applies if you use the MySQL backend.
securityConstant-time preshared key authentication
Applies if you use preshared key authentication.
securityRequired OIDC issuer and audience configuration
Applies if authn. is set to oidc.
A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.
Action needed (2)
securityThe infinispan dependency upgrade
infinispan was upgraded from ^0. to ^0. to address known vulnerabilities.
breakingThe unused json-schema runtime dependency, removed
The unused json-schema runtime dependency has been removed.
Check if affected (7)
breakingThe catalog. setting, removed
Applies if you configure catalog..
breakingComboboxProps as a union type
Applies if you use ComboboxProps.
breakingThe default /kubernetes page, removed
Applies if you use /kubernetes.
Plan ahead (9)
deprecatedTop-level Combobox input state props, deprecated
Applies if you use plain-array options.
deprecatedPrevious tokens, deprecatedremoval date not announced
Applicability is not stated in the release notes.
deprecatedThe single-module runCliModule helper, deprecated
Applies if you use runCliModule.
KubeVirt v1.8.4 adds observability coverage, changes node-labeller CPU feature handling, and fixes a virt-handler resource leak. It also updates a dependency to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Action needed (1)
securityhighThe github. dependency, upgraded for CVE-2026-35469
github. is upgraded from v0.5.0 to v0.5.1 in KubeVirt v1.8.4 to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
A maintenance-focused release with correctness fixes, dependency updates, operator troubleshooting improvements, and a security fix for a namespace-bypass issue. It also removes obsolete Helm settings, so configurations using those values need review.
Check if affected (3)
securityWildcard namespace bypass for selectorless ipBlock rules, fixed
Applies if you configure ipBlock.
breakingThe loadBalancer. Helm option, removed
Applies if you configure loadBalancer..
breakingThe l2podAnnouncements. Helm value, replaced by l2podAnnouncements.
Applies if you configure l2podAnnouncements. and enable L2 pod announcements.
This Flatcar release includes multiple Linux vulnerability fixes and updates Linux to 6.12.93. It also adds NVMe/TCP support for storage backends that use NVMe over Fabrics, while the Linux security fixes make the release relevant to systems requiring those updates.
Action needed (1)
securitycriticalLinux security fixes for multiple CVEs
This release includes Linux fixes for CVE-2026-46243, CVE-2026-46244, CVE-2026-46275, CVE-2026-46315, CVE-2026-46316, CVE-2026-46321, CVE-2026-46322, and CVE-2026-46323.
A maintenance release with correctness fixes, a security-relevant dependency update, resolver compatibility constraints, metric behavior changes, and additional dependency upgrades. The changes include a restriction on the object types handled by Tekton Resolvers and an update to gRPC.
Action needed (1)
securitycriticalgoogle. updated to 1.79.3 for CVE-2026-33186
The google. dependency is updated from 1.77.0 to 1.79.3 to fix CVE-2026-33186, an authorization bypass caused by a missing leading slash in the :path header.
Check if affected (1)
breakingTekton Resolvers, limited to supported object types
Applies if you use the Resolver API.
Tekton v1.6.3 contains resolver validation and behavior corrections, along with fixes affecting cross-architecture execution and metrics. It also updates dependencies, including a gRPC change for CVE-2026-33186, so resolver users and dependency-sensitive deployments should review the release.
Action needed (1)
securitycriticalThe google. dependency fix for CVE-2026-33186
The google. dependency includes a fix for CVE-2026-33186 in v1.6.3.
Check if affected (1)
breakingTekton Resolver target restrictions
Applies if your ResolutionRequest objects use Tekton Resolvers.
A release with operator-facing additions and fixes, including new LLMInferenceService capabilities and status observability. It also updates dependencies and images and includes security-related fixes.
Action needed (1)
securityhighazure-core pinned for CVE-2026-21226
The azure-core dependency is pinned to >=1. to address CVE-2026-21226.
Check if affected (3)
securityvllm setup and pillow dependency fixes
Applies if you depend on vllm or pillow.
breakingIncorrect CRDs removed from llmisvc-crd
Applies if you use llmisvc-crd.
breakingHelm imagePullPolicy defaults
Applies if you use Helm.
