RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Prometheusv3.13.2ObservabilityJul 30, 2026
ACTION 2OTHER 2View full analysis

Prometheus v3.13.2 updates dependencies for two disclosed vulnerabilities and includes related transitive dependency upgrades. It also fixes a PromQL SIGBUS crash when the data disk is full.

Action needed (2)

  • securityhighgolang.org/x/text update for CVE-2026-56852

    golang.org/x/text updates from v0.38.0 to v0.39.0 in Prometheus v3.13.2 for CVE-2026-56852.

  • securityhighgoogle.golang.org/grpc update for GHSA-hrxh-6v49-42gf

    google.golang.org/grpc updates from v1.81.1 to v1.82.1 in Prometheus v3.13.2 for GHSA-hrxh-6v49-42gf.

Source ↗
Volcanov1.15.1Orchestration & ManagementJul 30, 2026
ACTION 1OTHER 16View full analysis

Volcano v1.15.1 is a maintenance release with a dependency update, configuration-format compatibility changes, and correctness fixes. It also includes implementation-only changes with no operator-facing impact.

Action needed (1)

  • securityThe golang.org/x/crypto dependency, upgraded

    Volcano v1.15.1 upgrades golang.org/x/crypto from v0.49.0 to v0.53.0, incorporating upstream SSH security fixes released in v0.52.0.

Source ↗
cert-managerv1.21.1SecurityJul 29, 2026
ACTION 4OTHER 4View full analysis

cert-manager v1.21.1 is a maintenance release with fixes for regressions and updates to dependencies affected by reported security vulnerabilities. The dependency updates concern all installations, while the regression fixes address controller behavior and require no setup change.

Action needed (4)

  • securityThe golang.org/x/text dependency, updated to v0.40.0

    The golang.org/x/text dependency is updated to v0.40.0 to fix a reported security vulnerability.

  • securityThe google.golang.org/grpc dependency, updated to v1.82.1

    The google.golang.org/grpc dependency is updated to v1.82.1 to fix a reported security vulnerability.

  • securityThe github.com/google/cel-go dependency, updated to v0.29.0

    The github.com/google/cel-go dependency is updated to v0.29.0 to fix a reported security vulnerability.

  • securityThe go.opentelemetry.io/otel dependency, updated to v1.44.0

    The go.opentelemetry.io/otel dependency is updated to v1.44.0 to fix a reported security vulnerability.

Source ↗
Ciliumv1.20.0Networking & MessagingJul 29, 2026
ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

  • securitygoogle.golang.org/grpc v1.79.3

    The google.golang.org/grpc module is updated to v1.79.3 in the main branch.

  • securitygoogle.golang.org/grpc v1.82.1

    The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.

  • securityhelm.sh/helm/v4 v4.1.4

    The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.

  • securitygithub.com/cloudflare/circl v1.6.3

    The github.com/cloudflare/circl module is updated to v1.6.3.

  • securitygithub.com/go-jose/go-jose/v4 v4.1.4

    The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.

  • securitygithub.com/moby/spdystream v0.5.1

    The github.com/moby/spdystream module is updated to v0.5.1.

  • breakingcni.customConf CNI configuration version

    The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.

  • breakingCilium operator IPAM metrics removal

    The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.

  • breakingDefault CNI configuration version

    The default CNI configuration version changes from 0.3.1 to 1.0.0.

  • breakingNative histogram default

    Native histograms are emitted for all histograms by default.

  • breakingAgent bootstrap metrics removal

    Agent bootstrap metrics are removed.

Check if affected (28)

  • securitytbid traffic host namespace handling

    Applies if you use tbid traffic.

  • breakingDocker libnetwork plugin removal

    Applies if you use the Docker libnetwork plugin.

  • breakingces-slice-mode removal

    Applies if you configure ces-slice-mode.

  • + 25 more on the release page

Plan ahead (6)

  • deprecatedBeta Mutual Auth deprecationremoval date not announced

    Applies if you use Mutual Auth.

  • deprecatedDeprecated address and interface CIDR fields

    Applies if you configure addresses[].subnet or interfaces[].cidr.

  • deprecatedLocal REST BGP API deprecationremoval date not announced

    Applies if you use the local REST BGP APIs.

  • + 3 more on the release page
Source ↗
Rookv1.19.8Storage & DataJul 28, 2026
ACTION 1OTHER 4View full analysis

v1.19.8 is a maintenance release with a security-related dependency update and behavioral improvements. The recorded dependency change updates the vulnerable go text package from v0.37 to a newer version.

Action needed (1)

  • securityThe go text package, updated from v0.37

    The go text package is updated from v0.37 to the latest version because v0.37 has a vulnerability. This dependency update ships in v1.19.8.

Source ↗
OpenFeaturecore/v0.16.1CI/CD & App DeliveryJul 27, 2026
ACTION 2OTHER 8View full analysis

This release combines ordinary bug fixes with security-related updates. It also improves blob/HTTP synchronization, with no announced operator-facing removals, deprecations, or default changes.

Action needed (2)

  • securityThe google.golang.org/grpc module update to v1.82.1

    The google.golang.org/grpc module is updated to v1.82.1 in core v0.16.1.

  • securityThe vulnerability-updates update

    vulnerability-updates is updated in core v0.16.1.

Source ↗
OpenFeatureflagd-proxy/v0.9.7CI/CD & App DeliveryJul 27, 2026
ACTION 2OTHER 3View full analysis

A maintenance release with a bug-fix heading, a new server timeout setting, dependency updates, and security-related updates. The google.golang.org/grpc update requires upgrading.

Action needed (2)

  • securityThe google.golang.org/grpc module, updated to v1.82.1

    The google.golang.org/grpc module is updated to v1.82.1 as a security-related dependency change.

  • securityThe vulnerability-updates dependency update

    The release updates vulnerability-updates as a security-related dependency change.

Source ↗
OpenFeatureflagd/v0.16.1CI/CD & App DeliveryJul 27, 2026
ACTION 3OTHER 5View full analysis

flagd/v0.16.1 combines bug fixes with security dependency updates and a configurable sync-server capability. The security notes do not include advisory identifiers or flaw details, while the sync-server changes include server timeouts and configurable gRPC keepalive enforcement.

Action needed (3)

  • securitySecurity dependency updates

    Security dependencies are updated in flagd/v0.16.1.

  • securityThe google.golang.org/grpc module update

    The google.golang.org/grpc module is updated to v1.82.1 in flagd/v0.16.1.

  • securityVulnerability updates

    Vulnerability updates are included in flagd/v0.16.1 as a security change.

Source ↗
etcdv3.7.1Kubernetes CoreJul 23, 2026
ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

  • securityhighThe google.golang.org/grpc dependency update

    The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.

  • breakingThe snapshotLimitByte default

    The release sets a reasonable default value for snapshotLimitByte.

  • breakingThe client HTTP server ReadHeaderTimeout

    The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

  • securityhighWatch responses restricted to authorized keys

    Applicability is not stated in the release notes.

Source ↗
etcdv3.6.14Kubernetes CoreJul 23, 2026
ACTION 5OTHER 5View full analysis

A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.

Action needed (5)

  • securitycriticalThe golang.org/x/net dependency update

    The golang.org/x/net dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.

  • securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8

    An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.

  • securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3

    The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.

  • securityhighThe google.golang.org/grpc dependency update

    The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.

  • breakingThe snapshotLimitByte default value

    The default value for snapshotLimitByte is set to a reasonable value in this release.

Source ↗
etcdv3.5.33Kubernetes CoreJul 23, 2026
ACTION 5OTHER 5View full analysis

A maintenance release with correctness and security fixes, timeout behavior changes, and dependency and toolchain updates. It also updates the build toolchain used to compile binaries.

Action needed (5)

  • securityhighWatch response authorization for key ranges

    The watch authorization issue is fixed: a user with read permission on one key could no longer receive watch responses for every key starting from that key. The fix addresses GHSA-xg4h-6gfc-h4m8.

  • securityhighThe tlsHandshakeTimeout setting for tlsListener

    A tlsHandshakeTimeout is set for tlsListener. The change addresses GHSA-6vch-q96h-7gc3.

  • securityhighThe golang.org/x/net dependency, updated to v0.56.0

    The golang.org/x/net dependency is updated to v0.56.0 to address GO-2026-5942.

  • securityhighThe golang.org/x/text dependency, updated to v0.39.0

    The golang.org/x/text dependency is updated to v0.39.0 to address GO-2026-5970.

  • securityhighThe google.golang.org/grpc dependency, updated to 1.82.1

    The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.

Source ↗
Crossplanev2.3.4Orchestration & ManagementJul 23, 2026
ACTION 7OTHER 5View full analysis

This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.

Action needed (7)

  • securityThe github.com/sigstore/rekor module update to v1.5.2

    Crossplane v2.3.4 updates the github.com/sigstore/rekor module to v1.5.2 for security fixes.

  • securityThe github.com/sigstore/cosign/v3 module update to v3.0.6

    Crossplane v2.3.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6 for security fixes.

  • securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0

    Crossplane v2.3.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0 for security fixes.

  • securityThe github.com/sigstore/sigstore-go module update to v1.2.0

    Crossplane v2.3.4 updates the github.com/sigstore/sigstore-go module to v1.2.0 for security fixes.

  • securityCombined security dependency updates

    Crossplane v2.3.4 includes combined security updates for grpc, golang.org/x/net, and golang.org/x/text.

  • securityThe golang.org/x/text module update to v0.39.0

    Crossplane v2.3.4 updates the golang.org/x/text module to v0.39.0 for security fixes.

  • securityThe golang.org/x/net module update to v0.56.0

    Crossplane v2.3.4 updates the golang.org/x/net module to v0.56.0 for security fixes.

Source ↗
Crossplanev2.2.4Orchestration & ManagementJul 23, 2026
ACTION 5OTHER 2View full analysis

Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.

Action needed (5)

  • securityThe github.com/sigstore/rekor module update to v1.5.2

    Crossplane v2.2.4 updates the github.com/sigstore/rekor module to v1.5.2.

  • securityThe github.com/sigstore/cosign/v3 module update to v3.0.6

    Crossplane v2.2.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6.

  • securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0

    Crossplane v2.2.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0.

  • securityThe github.com/sigstore/sigstore-go module update to v1.2.0

    Crossplane v2.2.4 updates the github.com/sigstore/sigstore-go module to v1.2.0.

  • securityCombined grpc, x/net, and x/text dependency updates

    Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.

Source ↗
Crossplanev2.1.8Orchestration & ManagementJul 23, 2026
ACTION 7OTHER 1View full analysis

Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.

Action needed (7)

  • securityThe github.com/sigstore/rekor module at v1.5.2

    The github.com/sigstore/rekor module is updated to v1.5.2 in Crossplane v2.1.8.

  • securityThe github.com/sigstore/timestamp-authority/v2 module at v2.1.0

    The github.com/sigstore/timestamp-authority/v2 module is updated to v2.1.0 in Crossplane v2.1.8.

  • securityThe github.com/sigstore/cosign/v2 module at v2.6.3

    The github.com/sigstore/cosign/v2 module is updated to v2.6.3 in Crossplane v2.1.8.

  • securityThe Go toolchain at 1.25.12

    The Go toolchain is updated to 1.25.12 in Crossplane v2.1.8.

  • securityThe github.com/sigstore/sigstore-go module at v1.2.0

    The github.com/sigstore/sigstore-go module is updated to v1.2.0 in Crossplane v2.1.8.

  • securityCombined grpc, x/net, and x/text dependency updates

    Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.

  • securityThe golang.org/x/text module at v0.39.0

    The golang.org/x/text module is updated to v0.39.0 in Crossplane v2.1.8.

Source ↗
Crossplanev1.20.11Orchestration & ManagementJul 23, 2026
ACTION 4OTHER 1View full analysis

A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.

Action needed (4)

  • securityThe github.com/sigstore/rekor module, updated to v1.5.2

    The github.com/sigstore/rekor module is updated to v1.5.2 in the release-1.20 line.

  • securityThe Go toolchain, updated to 1.25.12

    The Go toolchain is updated to 1.25.12 in the release-1.20 line.

  • securityThe alpine Docker tag, updated to v3.24

    The alpine Docker tag is updated to v3.24 in the release-1.20 line.

  • securitySecurity updates for grpc, x/net, and x/text

    Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.

Source ↗
gRPCv1.83.0Networking & MessagingJul 22, 2026
CHECK 1View full analysis

This release includes a security-related default change in TLS key exchange. The change affects deployments that use TLS key exchange.

Check if affected (1)

  • securityPost-Quantum Cryptography as the default for TLS key exchange

    Applies when TLS key exchange is used.

Source ↗
Daprv1.18.2Orchestration & ManagementJul 21, 2026
ACTION 3OTHER 18View full analysis

A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.

Action needed (3)

  • securitymediumgithub.com/go-chi/chi/v5 updated for CVE-2025-69725

    github.com/go-chi/chi/v5 is updated to v5.2.4, which resolves CVE-2025-69725.

  • securitymediumgo.mongodb.org/mongo-driver and github.com/dapr/components-contrib updates

    go.mongodb.org/mongo-driver is updated to v1.17.7, and the github.com/dapr/components-contrib dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.

  • breakingConflict errors for workflow instance IDs

    Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.

Source ↗
KubeVelav1.11.0CI/CD & App DeliveryJul 20, 2026
CHECK 3OTHER 67View full analysis

A release with operator-facing authorization and credential-handling fixes, alongside new Helm, CUE, and workflow capabilities. It also adds validation improvements and dependency updates.

Check if affected (3)

  • securityExplicit authorization for vela-system definitions

    Applies if you use vela-system definitions.

  • securityCredential redaction for Terraform module remote URLs

    Applies if you configure Terraform module remote URLs.

  • breakingUndeclared parameter validation in application definitions

    Applies if you use application definitions.

Source ↗
Litmus3.31.0ObservabilityJul 15, 2026
ACTION 1OTHER 9View full analysis

Release 3.31.0 contains a dependency update addressing vulnerabilities in graphql/server. It also includes correctness fixes across probes, GraphQL, authentication, infrastructure, and experiment handling.

Action needed (1)

  • securityDependencies in graphql/server updated

    Dependencies in graphql/server are updated to fix vulnerabilities. The update ships in Release 3.31.0.

Source ↗
Envoyv1.39.0Networking & MessagingJul 14, 2026
CHECK 11OTHER 50View full analysis

A broad release with operator-facing changes across configuration, protocols, extensions, networking, and observability. Security fixes address multiple identified CVEs and a GHSA, while changed defaults, stricter input validation, and removed functionality may affect existing deployments.

Check if affected (11)

  • securityhighHTTP/2 header limits and flood protection

    Applies if you use HTTP/2.

  • securityhighHTTP/3 QPACK and content-length security fixes

    Applies if you use HTTP/3.

  • securityhighAdditional protocol, parser, formatter, and decompression security fixes

    Applies if you use DNS query validation, JSON nesting limits, PROXY protocol TLV, the formatter, TCP StatsD, TLS SAN, or Zstd decompression.

  • + 8 more on the release page
Source ↗
Buildpacksv0.40.8CI/CD & App DeliveryJul 13, 2026
CHECK 1OTHER 3View full analysis

A maintenance release rebuilds the pack on Go 1.25.12 to address two disclosed standard library security issues. It also updates several dependencies and includes a newer default lifecycle version.

Check if affected (1)

  • securityhighGo 1.25.12 standard library rebuild for GO-2026-4970 and GO-2026-5856

    Applies if you use 1.25.11 -> 1.25.12.

Source ↗
Kyvernov1.18.2SecurityJul 10, 2026
ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with operator-relevant fixes and behavior changes, plus security work in the 1.18 release line. It includes namespace-boundary enforcement for generators and security dependency updates.

Action needed (1)

  • securitySecurity dependency updates

    Security dependency updates from #16340 are backported to release-1.18.

Check if affected (1)

  • securityNamespace-boundary enforcement in generator.apply()

    Applies if you use generator.apply().

Source ↗
Helmv3.21.3Kubernetes CoreJul 9, 2026
ACTION 1OTHER 1View full analysis

This release includes a security-related dependency cleanup and a dependency update. The github.com/containerd/containerd dependency moves from 1.7.32 to 1.7.33.

Action needed (1)

  • securityThe containerd v1 dependency, removed

    The containerd v1 dependency is removed in Helm v3.21.3 to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.

Source ↗
SPIREv1.15.2SecurityJul 9, 2026
ACTION 2CHECK 1OTHER 32View full analysis

A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.

Action needed (2)

  • securityMigration from github.com/docker/docker to github.com/moby/moby

    Dependencies from github.com/docker/docker were migrated to their github.com/moby/moby equivalents to resolve CVEs. The migration ships in this release.

  • breakingRPC metrics from agent health check loopback calls

    Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.

Check if affected (1)

  • breakingJWT-SVID serving by the delegated API

    Applies if you use the delegated API for admin or downstream entries.

Source ↗
Flatcar Container Linuxstable-4593.2.4Provisioning & RuntimeJul 9, 2026
ACTION 1OTHER 2View full analysis

This Flatcar release is a security update focused on fixes for disclosed Linux vulnerabilities. It also updates the Linux and ca-certificates dependencies.

Action needed (1)

Source ↗
Flatcar Container Linuxlts-4081.3.9Provisioning & RuntimeJul 9, 2026
ACTION 1OTHER 2View full analysis

This Flatcar release is a security update with fixes for Linux issues identified by CVE advisories. It also updates Linux and ca-certificates.

Action needed (1)

Source ↗
Prometheusv3.5.5ObservabilityJul 9, 2026
ACTION 1OTHER 1View full analysis

Prometheus v3.5.5 includes a Go 1.25.12 toolchain change and a disclosed security fix in the UI. The security fix concerns the sanitize-html dependency and CVE-2026-53606.

Action needed (1)

  • securitymediumThe sanitize-html dependency update for CVE-2026-53606

    The Prometheus UI updates sanitize-html to v2.17.5 to fix CVE-2026-53606.

Source ↗
Keycloak26.7.0SecurityJul 9, 2026
ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

  • securityPre-account takeover attack exposure

    The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

Plan ahead (4)

  • deprecatedThe V1 API, deprecated

    Applies if you use V1.

  • deprecatedThe Require Discoverable Credential option, deprecated

    Applies if you configure the Require Discoverable Credential option.

  • deprecatedThe Twitter IDP implementation, deprecated

    Applies if you use the Twitter IDP implementation.

  • + 1 more on the release page
Source ↗
TiKVv8.5.7Storage & DataJul 9, 2026
ACTION 1CHECK 1OTHER 41View full analysis

A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.

Action needed (1)

  • securityThird-party dependency upgrades for TiKV 8.5

    TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.

Check if affected (1)

  • breakingInvalid max_ts updates rejected by default

    Applies if you do not set storage.max-ts.action-on-invalid-update.

Source ↗
cert-managerv1.21.0SecurityJul 8, 2026
CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

  • securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258

    Applies if you use the cert-manager-edit aggregate ClusterRole.

  • breakingObjectReference API removal

    Applies if you use ObjectReference in an API.

  • breakingPrometheus ServiceMonitor and PodMonitor Helm value removal

    Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.

  • + 2 more on the release page

Plan ahead (2)

  • deprecatedGateway API controller configuration fields

    Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.

  • deprecatedServerSideApply feature gate deprecation

Source ↗
etcdv3.7.0Kubernetes CoreJul 8, 2026
ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if you configure --listen-client-http-urls.

Source ↗
Thanosv0.42.0ObservabilityJul 8, 2026
ACTION 1CHECK 4OTHER 19View full analysis

A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.

Action needed (1)

  • securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186

    The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.

Check if affected (4)

  • securityReceive tenant ID validation

    Applies if you run Receive.

  • breakingQuery-Frontend time_taken field renamed to time_taken_ms

    Applies if you run Query-Frontend.

  • breaking--shipper.ignore-unequal-block-size flag removed

    Applies if you configure --shipper.ignore-unequal-block-size.

  • + 1 more on the release page
Source ↗
Tektonv1.6.5CI/CD & App DeliveryJul 8, 2026
ACTION 1View full analysis

This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.

Action needed (1)

  • securityGo 1.25.10 dependency update

    Go is updated to 1.25.10 for CVE remediation in this release.

Source ↗
Tektonv1.9.6CI/CD & App DeliveryJul 8, 2026
ACTION 3View full analysis

Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang.org packages, with no specific advisory identifiers or vulnerability details in the note.

Action needed (3)

  • securityGo 1.25.10 update

    Go is updated to 1.25.10 for CVE remediation in v1.9.6.

  • securitygolang.org/x/crypto v0.52.0 update

    golang.org/x/crypto is updated to v0.52.0 for CVE remediation in v1.9.6.

  • securitygolang.org/x/net v0.55.0 update

    golang.org/x/net is updated to v0.55.0 for CVE remediation in v1.9.6.

Source ↗
Harborv2.15.2Storage & DataJul 2, 2026
ACTION 1CHECK 2OTHER 21View full analysis

A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.

Action needed (1)

  • securityToken and blob-mount source validation

    Blob-mount source projects are validated, and tokens without iat are rejected.

Check if affected (2)

  • breakingThe bundled PostgreSQL version, upgraded

    Applies if you use PostgreSQL.

  • breakingThe cache backend, changed from redis to valkey

    Applies if you use redis.

Source ↗
etcdv3.6.13Kubernetes CoreJul 1, 2026
ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

  • securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0

    The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

  • securityhighgolang.org/x/crypto, updated to v0.52.0

    The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if --listen-client-http-urls is configured.

Source ↗
etcdv3.5.32Kubernetes CoreJul 1, 2026
ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

  • securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883

    go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

  • securityCRL enforcement with --listen-client-http-urls

    Applies if --listen-client-http-urls is configured.

Source ↗
Prometheusv3.13.0ObservabilityJul 1, 2026
ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

  • securitycriticalThe sanitize-html dependency update

    The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.

  • breakingThe third-party license artifact

    Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

  • securitymediumRedirect credential forwarding

    Applies if you use scraping, remote read/write, alerting, or service discovery.

  • breakingPromQL duration-expression function names

    Applies if you enable experimental-duration-expr and use min() and max().

Source ↗
wasmCloudv2.5.0Orchestration & ManagementJun 30, 2026
ACTION 1CHECK 1OTHER 21View full analysis

Version v2.5.0 adds runtime and WIT/API capabilities and includes correctness and dependency updates. The release also enables wasip3 by default and includes a quinn-proto fix for RUSTSEC-2026-0185.

Action needed (1)

  • securityhighThe quinn-proto security fix

    The quinn-proto dependency fix ships in wasmCloud v2.5.0 and addresses RUSTSEC-2026-0185.

Check if affected (1)

  • breakingDefault wasip3 enablement with wasmtime 46

    Applies if your workloads use wasip3.

Source ↗
Tektonv1.14.0CI/CD & App DeliveryJun 30, 2026
ACTION 1OTHER 37View full analysis

Release v1.14.0 adds tracing and observability capabilities and broadens ResolutionRequest resolution support. It also includes correctness fixes, a Go security-related update, and shipped dependency updates.

Action needed (1)

  • securityGo 1.26.4 update

    Go is updated to 1.26.4 in v1.14.0 for CVE remediation.

Source ↗
← NewerOlder →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023