Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jul 2026Clear ×

Tektonv1.9.6CI/CD & App DeliveryJul 8, 2026

ACTION 3View full analysis

Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang.org packages, with no specific advisory identifiers or vulnerability details in the note.

Action needed (3)

securityGo 1.25.10 update
Go is updated to 1.25.10 for CVE remediation in v1.9.6.
securitygolang.org/x/crypto v0.52.0 update
golang.org/x/crypto is updated to v0.52.0 for CVE remediation in v1.9.6.
securitygolang.org/x/net v0.55.0 update
golang.org/x/net is updated to v0.55.0 for CVE remediation in v1.9.6.

Source ↗

Harborv2.15.2Storage & DataJul 2, 2026

ACTION 1CHECK 2OTHER 21View full analysis

A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.

Action needed (1)

securityToken and blob-mount source validation
Blob-mount source projects are validated, and tokens without iat are rejected.

Check if affected (2)

breakingThe bundled PostgreSQL version, upgraded
Applies if you use PostgreSQL.
breakingThe cache backend, changed from redis to valkey
Applies if you use redis.

Source ↗

etcdv3.6.13Kubernetes CoreJul 1, 2026

ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0
The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.
securityhighgolang.org/x/crypto, updated to v0.52.0
The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if --listen-client-http-urls is configured.

Source ↗

etcdv3.5.32Kubernetes CoreJul 1, 2026

ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

securityCRL enforcement with --listen-client-http-urls
Applies if --listen-client-http-urls is configured.

Source ↗

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().

Source ↗

← NewerJul 8, 2026 – Jul 1, 2026

Browse by month