Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: cert-managerClear ×

cert-managerv1.21.1SecurityJul 29, 2026

ACTION 4OTHER 4View full analysis

cert-manager v1.21.1 is a maintenance release with fixes for regressions and updates to dependencies affected by reported security vulnerabilities. The dependency updates concern all installations, while the regression fixes address controller behavior and require no setup change.

Action needed (4)

securityThe golang.org/x/text dependency, updated to v0.40.0
The golang.org/x/text dependency is updated to v0.40.0 to fix a reported security vulnerability.
securityThe google.golang.org/grpc dependency, updated to v1.82.1
The google.golang.org/grpc dependency is updated to v1.82.1 to fix a reported security vulnerability.
securityThe github.com/google/cel-go dependency, updated to v0.29.0
The github.com/google/cel-go dependency is updated to v0.29.0 to fix a reported security vulnerability.
securityThe go.opentelemetry.io/otel dependency, updated to v1.44.0
The go.opentelemetry.io/otel dependency is updated to v1.44.0 to fix a reported security vulnerability.

Source ↗

cert-managerv1.21.0SecurityJul 8, 2026

CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
The cert-manager-edit aggregate ClusterRole no longer grants create on ACME Challenge resources or create, patch, and update on Order resources. This prevents direct manipulation of these internal resources and addresses GHSA-8rvj-mm4h-c258.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
The deprecated ObjectReference API is removed in this release.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.
The Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path are removed.
+ 2 more on the release page

Plan ahead (2)

deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.
The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet.
deprecatedServerSideApply feature gate deprecation
cainjector now uses server-side apply unconditionally, and the ServerSideApply feature gate is deprecated.

Source ↗

cert-managerv1.19.6SecurityJun 25, 2026

ACTION 2CHECK 1View full analysis

cert-manager v1.19.6 changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.

Action needed (2)

securityhighGo v1.25.11 with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507
Go is updated to v1.25.11 in cert-manager v1.19.6 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityGo 1.25.10 dependency upgrade
Go is upgraded to 1.25.10 as part of the dependency updates in cert-manager v1.19.6.

Check if affected (1)

securityReduced cert-manager-edit permissions for Challenge and Order creation and updates
Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.
The cert-manager-edit aggregate ClusterRole no longer includes the create, patch, or update verbs for Challenge and Order. This change ships in cert-manager v1.19.6 and addresses GHSA-8rvj-mm4h-c258.

Source ↗

cert-managerv1.20.3SecurityJun 25, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.

Action needed (1)

securityhighGo updated to v1.26.4
Go is updated to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

Check if affected (1)

securityThe cert-manager-edit aggregate ClusterRole permissions
Applicability is not stated in the release notes.
The default cert-manager-edit aggregate ClusterRole no longer grants namespace users permission to create ACME Challenge and Order resources directly. This fixes GHSA-8rvj-mm4h-c258.

Source ↗

cert-managerv1.19.5SecurityApr 21, 2026

ACTION 2OTHER 1View full analysis

This release contains security-related updates to Go dependencies and the Go toolchain. It concerns deployments that rely on the affected dependencies or the bundled Go toolchain.

Action needed (2)

securityGo dependencies with reported vulnerabilities updated
Go dependencies with reported vulnerabilities are updated in cert-manager v1.19.5.
securityThe go toolchain updated to 1.25.8
The go toolchain is updated to 1.25.8 in cert-manager v1.19.5 to address reported vulnerabilities.

Source ↗

cert-managerv1.20.2SecurityApr 11, 2026

ACTION 1OTHER 2View full analysis

cert-manager v1.20.2 fixes invalid Helm YAML generation and updates Go to 1.26.2. It also includes a security-related update to Go dependencies with reported vulnerabilities.

Action needed (1)

securityGo dependency updates
Go dependencies with reported vulnerabilities were updated in cert-manager v1.20.2. No advisory identifier is provided for this update.

Source ↗

cert-managerv1.20.1SecurityMar 27, 2026

ACTION 1OTHER 2View full analysis

cert-manager v1.20.1 contains bug corrections and a security-related dependency update. The gRPC vulnerability details are limited to the scanner reports, which state that it does not affect cert-manager.

Action needed (1)

securityThe google.golang.org/grpc dependency update
The google.golang.org/grpc dependency is bumped in cert-manager v1.20.1 to address a vulnerability reported by scanners. The report states that the vulnerability does not affect cert-manager.

Source ↗

cert-managerv1.20.0SecurityMar 10, 2026

ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
The cert-manager controller no longer risks a panic when it caches a DNS response in an unexpected order. An attacker who can modify DNS responses or control the DNS server could otherwise cause a denial of service.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
The OtherNames feature is promoted to Beta and enabled by default.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
The default container user UID changes from 1000 to 65532, and the default container group GID changes from 0 to 65532.
+ 1 more on the release page

Source ↗

cert-managerv1.18.6SecurityFeb 24, 2026

ACTION 2View full analysis

cert-manager v1.18.6 is a patch release focused on fixing reported vulnerabilities, including CVE-2025-68121, through a Go toolchain bump. CVE-2026-24051 is explicitly stated not to affect cert-manager.

Action needed (2)

securitycriticalCVE-2025-68121 vulnerability fix
The v1.18.6 patch release fixes reported vulnerabilities, most notably CVE-2025-68121, in cert-manager.
securitycriticalGo toolchain bump for CVE-2025-68121
The Go toolchain is bumped in cert-manager v1.18.6 to address CVE-2025-68121.

Source ↗

cert-managerv1.19.4SecurityFeb 24, 2026

ACTION 3OTHER 1View full analysis

cert-manager v1.19.4 is a patch release focused on reported vulnerabilities and dependency updates. It includes fixes for CVE-2026-24051, CVE-2025-68121, and GO-2026-4394.

Action needed (3)

securitycriticalThe go dependency update
The go dependency is bumped in cert-manager v1.19.4 to address CVE-2025-68121.
securityhighcert-manager v1.19.4 vulnerability fixes
cert-manager v1.19.4 is a patch release addressing reported vulnerabilities, including CVE-2026-24051 and CVE-2025-68121.
securityhighThe otel SDK dependency update
The otel SDK dependency is bumped in cert-manager v1.19.4 to address GO-2026-4394.

Source ↗

cert-managerv1.18.5SecurityFeb 2, 2026

ACTION 1OTHER 3View full analysis

cert-manager v1.18.5 contains a security fix for GHSA-gx3x-vq4p-mhhv alongside other bug fixes. It also adds IPv6 HTTP-01 support and updates the Go toolchain.

Action needed (1)

securitymediumGHSA-gx3x-vq4p-mhhv denial-of-service fix
cert-manager v1.18.5 fixes the denial-of-service issue identified by GHSA-gx3x-vq4p-mhhv. The release contains three bug fixes in total.

Source ↗

cert-managerv1.19.3SecurityFeb 2, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.

Check if affected (1)

securitymediumcert-manager controller DNS response panic fix, GHSA-gx3x-vq4p-mhhv
Applicability is not stated in the release notes.
This release fixes a potential panic in the cert-manager controller when a cached DNS response arrives in an unexpected order. The issue is tracked as GHSA-gx3x-vq4p-mhhv and could cause denial of service when an attacker modifies DNS responses or controls the DNS server.

Source ↗

Browse by month