Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: KubeVirtClear ×

KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

ACTION 2CHECK 9PLAN 2OTHER 138View full analysis

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

securitycriticalThe grpc dependency, updated
grpc is updated to 1.79.3 to remediate CVE-2026-33186.
securityhighThe github.com/moby/spdystream dependency, updated
The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

breakingStricter network interface binding admission
Applies if you configure network interface bindings.
Admission now rejects interfaces with no binding or multiple bindings instead of allowing them to fail silently at runtime.
breakingThe Template feature gate, enabled by default
Applies if you enable the Template feature gate.
The Template feature gate has graduated to Beta and is enabled by default. Virt-template components are deployed automatically unless explicitly disabled.
breakingThe ephemeral hotplug volume metric and alert, removed
Applies if you use the ephemeral hotplug volume metric.
The ephemeral hotplug volume metric and alert have been removed.
+ 6 more on the release page

Plan ahead (2)

deprecatedcgroup v1 support, deprecatedremoval date not announced
Applies if you run with cgroup v1 support.
cgroup v1 support is deprecated, with removal planned for the next release.
deprecatedLegacy VM creation recording rules and metrics, deprecated
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.
Multiple recording rules are deprecated in favor of new names to comply with recording rule naming conventions. The kubevirt_vm_created_total recording rule and kubevirt_vm_created_by_pod_total metric are deprecated completely.

Source ↗

KubeVirtv1.8.4Orchestration & ManagementJun 16, 2026

ACTION 1OTHER 3View full analysis

KubeVirt v1.8.4 adds observability coverage, changes node-labeller CPU feature handling, and fixes a virt-handler resource leak. It also updates a dependency to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Action needed (1)

securityhighThe github.com/moby/spdystream dependency, upgraded for CVE-2026-35469
github.com/moby/spdystream is upgraded from v0.5.0 to v0.5.1 in KubeVirt v1.8.4 to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Source ↗

KubeVirtv1.8.3Orchestration & ManagementJun 3, 2026

ACTION 2PLAN 1OTHER 13View full analysis

A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.

Action needed (2)

securitycriticalgoogle.golang.org/grpc update to 1.79.3
The google.golang.org/grpc dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.
securitySymlink traversal fix in the VMExport directory handler
The VMExport directory handler is fixed to prevent symlink traversal.

Plan ahead (1)

deprecatedDeprecated kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total recording rules
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.
The recording rules kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total are deprecated in favor of new names to comply with recording-rule naming conventions. Both are deprecated completely.

Source ↗

KubeVirtv1.7.4Orchestration & ManagementJun 3, 2026

ACTION 1OTHER 5View full analysis

KubeVirt v1.7.4 includes correctness fixes and behavior changes affecting PCI topology and IPv6 migration. It also updates the gRPC dependency to address CVE-2026-33186.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency update for CVE-2026-33186
KubeVirt v1.7.4 updates google.golang.org/grpc to version 1.79.3 to remediate CVE-2026-33186.

Source ↗

KubeVirtv1.6.6Orchestration & ManagementJun 3, 2026

ACTION 1OTHER 8View full analysis

KubeVirt v1.6.6 includes a dependency update for CVE-2026-33186. The recorded change affects the gRPC dependency shipped with this release.

Action needed (1)

securitycriticalgoogle.golang.org/grpc update for CVE-2026-33186
KubeVirt v1.6.6 bumps google.golang.org/grpc to remediate CVE-2026-33186.

Source ↗

KubeVirtv1.6.4Orchestration & ManagementMar 16, 2026

ACTION 1CHECK 2OTHER 16View full analysis

A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.

Action needed (1)

securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.

Check if affected (2)

breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
The release replaces the QuiesceFailed indication with QuiesceTimeout and adds a 60-second Velero pre-backup hook timeout to better handle Windows VSS limitations.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.
The release aligns the DefaultVirtWebhookClient{QPS,Burst} values with DefaultVirtWebhookClient{QPS,Burst} to help avoid saturating the webhook client during mass eviction events.

Source ↗

Browse by month