A correctness fix clears removed components from Application status. Deleted components are filtered from status fields, and status arrays are updated when components are removed from the spec.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
Feb 2026Clear ×
OPA v1.13.2 updates the Go version used to build its binaries and images. The release includes the Go standard library fix for GO-2026-4337.
Action needed (1)
securitycritical
Go1.25.7 build dependencyOPA binaries and images are now built with
Go1.25.7. TheGostandard library in that version contains a fix forGO-2026-4337.
Litmus 3.26.0 is a maintenance release focused on operator-visible corrections to UI layout behavior and image-registry validation. Other release-note material concerns headings, duplicate detail, or development and build-only changes.
Source ↗
A release with breaking changes to package installation and package-cache side-loading, alongside new operator capabilities and ordinary defect corrections. It also includes security-tagged dependency updates, but no advisory identifiers or vulnerability details are provided.
Action needed (7)
securitySecurity update for
golang.org/x/crypto The
golang.module was updated toorg/x/crypto v0.as a security update.45. 0 securitySecurity update for
github.com/go-chi/chi/v5 The
github.module was updated tocom/go-chi/chi/v5 v5.as a security update.2. 4 securitySecurity update for
github.com/sigstore/cosign/v3 The
github.module was updated tocom/sigstore/cosign/v3 v3.as a security update.0. 4 securitySecurity update for
github.com/theupdateframework/go-tuf/v2 The
github.module was updated tocom/theupdateframework/go-tuf/v2 v2.as a security update.4. 1 securitySecurity update for
github.com/sigstore/rekor The
github.module was updated tocom/sigstore/rekor v1.as a security update.5. 0 securitySecurity update for
github.com/sigstore/sigstore The
github.module was updated tocom/sigstore/sigstore v1.as a security update.10. 4 securitySecurity update for
github.com/quic-go/quic-go The
github.module was updated tocom/quic-go/quic-go v0.as a security update.57. 0
Check if affected (2)
breakingInput CRD installation from Function packages
Applies if you use
Functionpackages andInput CRDs.breakingPackage cache structure
Applicability is not stated in the release notes.
This release focuses on dependency and component upgrades. It adds no new operator capabilities or stated security changes, and it requires no setup changes beyond upgrading.
Source ↗
A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.
Check if affected (7)
breakingStable
catalogProcessingExtensionPointexportApplies if you use
catalogProcessingExtensionPointwhen providing custom processors and entity providers into the catalog.breakingRejected
CatalogApiandErrorApioverridesApplicability is not stated in the release notes.
breakingRemoved
auth.experimentalDynamicClientRegistration. tokenExpiration Applies if you configure
auth..experimentalDynamicClientRegistration. tokenExpiration - + 4 more on the release page
Plan ahead (2)
deprecatedDeprecated
IconComponenttypeApplies if you use
IconComponent.deprecatedDeprecated
itemspropApplies if you use the
itemsprop.
Cilium v1.19.1 contains routine bug fixes, performance improvements, and dependency and image updates. The available release information does not identify security advisories or explicitly described security flaws.
Source ↗
A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.
Action needed (1)
securityhighCVE-2025-61732 cgo comment parsing flaw
This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.
Check if affected (4)
securitycriticalCVE-2025-68121 TLS session resumption validation
Applies if you use
Config.with mutations orClone Config..GetConfigForClient securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
securityResource annotation validation against container injection
Applies if you configure resource annotations.
- + 1 more on the release page
A security release addressing two vulnerabilities in cgo comment parsing and crypto/tls session resumption. The fixes are relevant to deployments using the affected Go functionality.
Action needed (2)
securitycriticalCVE-2025-68121 session resumption vulnerability correction
CVE-2025-68121 corrects a
crypto/tlssession resumption flaw that could let resumed handshakes succeed afterClientCAsorRootCAschanged between the initial and resumed handshake.securityhighCVE-2025-61732 code-smuggling vulnerability correction
CVE-2025-61732 addresses a discrepancy in Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.
A broad release adds operator-visible capabilities across ambient networking, telemetry, Gateway API, and traffic management, while changing several defaults. The most consequential operational changes affect ambient mesh DNS and iptables behavior, debug endpoint authorization, Envoy metrics compression, and istiod memory and circuit-breaker handling.
Action needed (1)
breakingAutomatic GOMEMLIMIT setting for istiod
istiodnow automatically setsGOMEMLIMITto 90% of its memory limits through theautomemlimitlibrary. The change ships in 1.29.0.
Check if affected (4)
breakingDefault-enabled iptables reconciliation
Applies when the
istio-cniDaemonSet is upgraded.breakingDefault authorization for debug endpoints
Applies if you use debug endpoints on port
15014.breakingDefault HTTP compression for Envoy metrics
Applies if you use Envoy metrics at the Prometheus stats endpoint based on client
Accept-Headervalues.- + 1 more on the release page
A maintenance release with fixes for job scheduling and SubJob recovery behavior. No operator action is required beyond upgrading.
Source ↗A maintenance release combining an operator-facing configuration adjustment with bug fixes and routine dependency and image refreshes. No security advisories or security-specific fixes are disclosed.
Action needed (1)
breakingExclusion of
topology.labels from security labels by defaultkubernetes. io The default security-label handling in this release excludes
topology.labels from security labels.kubernetes. io
This release is focused on dependency and container image maintenance, including a runtime dependency addition and updated installation image digests. No security issues or operator configuration changes are disclosed.
Source ↗
A maintenance release postpones removal of one flag and reverses another flag's deprecation. It also includes dependency and toolchain updates addressing named security advisories.
Action needed (2)
securityhighThe
gotoolchain, updated to 1.24.13Binaries are compiled using
go 1.. The toolchain update addresses CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.24. 13 securitymediumThe
golang.dependency, updated to 0.45.0org/x/crypto golang.is updated to 0.45.0 to address CVE-2025-47914 and CVE-2025-58181.org/x/crypto
Plan ahead (1)
deprecatedThe
--max-snapshotsflag, removal postponedremoval planned in v3.8Applies if you use
--max-snapshots.
A maintenance release that changes the Go toolchain used to compile binaries. It also includes fixes for three named CVEs and their corresponding GHSA advisories.
Action needed (1)
securityhighGo 1.24.13 toolchain for compiled binaries
Binaries are compiled with Go 1.24.13. This release includes fixes for CVE-2025-61726, CVE-2025-61731, and CVE-2025-61732, with corresponding advisories GHSA-gm9r-q53w-2gh4,
GHSA-xvqr-69v8-f3gv4, and GHSA-8jvr-vh7g-f8gx.
A maintenance release updates the Go dependency and toolchain to go 1.. It addresses three CVEs and their corresponding GitHub advisories.
Action needed (1)
securityhighGo 1.24.13 dependency and toolchain update
The Go dependency and toolchain update to
go 1.addresses CVE-2025-61726, CVE-2025-61731, and CVE-2025-61732, along with GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.24. 13
This release includes a Go toolchain dependency upgrade and a corrected Pulsar PubSub subscription-metadata defect. A regression test verifies that metadata is applied to consumer options.
Action needed (1)
securityhighThe
Gotoolchain upgrade to1.24. 13 Dapr
v1.upgrades16. 9 Goto1.. The upgrade addresses advisories24. 13 GO-2026-4340andGO-2026-4341.
A maintenance release contains an operator-facing correctness fix for the isRuleKubescapeVersionCompatible bug with version 4.. The remaining note entries are headings, test changes, or merge metadata.
This release combines performance improvements, bug fixes, and new configuration capabilities with a shuffle-sharding behavior change in Receive. It also upgrades Prometheus, deprecates a flag, and makes native histogram ingestion always enabled.
Check if affected (1)
breaking
Receiveshuffle sharding now uses consistent hashingApplies if you use
Receive.
This release includes an operator-facing toolchain update. The change addresses CVE-2025-68121 in OpenFGA v1.11.5.
Action needed (1)
securitycriticalThe Go toolchain, updated to
1.25. 7 The Go toolchain is updated to
1.in OpenFGA v1.11.5 to address CVE-2025-68121.25. 7
Vitess v23.0.2 is a maintenance release focused on defect corrections and a Go toolchain dependency update. The release also includes a performance-related change in query execution.
Source ↗
A maintenance release with correctness fixes in device allocation and kubeadm behavior, plus a Go toolchain update. The changes address scheduling races, etcd learner promotion, argument ordering, and Node patch retries.
Source ↗A maintenance release corrects operator-relevant behavior across scheduling, kubeadm, logging, and Windows networking. Kubernetes is now built using Go 1.24.12, and no security advisories or security-specific fixes are disclosed.
Source ↗A maintenance release focused on correctness fixes and regression repairs across Kubernetes components. It also updates the Go toolchain and changes kubeadm retry behavior.
Source ↗A maintenance release with numerous correctness fixes and an enforced feature-gate default change. It also updates the Go toolchain and hnslib dependency, with no disclosed security advisories.
Check if affected (1)
breakingThe
SchedulerAsyncAPICallsfeature gate, disabled by defaultApplies if you use the
SchedulerAsyncAPICallsfeature gate.
OpenFGA v1.11.4 fixes a planner regression in specific scenarios and updates the OpenTelemetry SDK. The SDK change addresses a disclosed issue affecting earlier versions.
Action needed (1)
securityThe
otel/sdkdependency atv1.40. 0 The
otel/sdkdependency is upgraded tov1.in OpenFGA v1.11.4 to address the issue identified as40. 0 SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758in earlier versions.
This release includes security safeguards for gateway resource creation and pod specification rendering, along with stricter authorization for debug endpoints. It also adds a Helm configuration field and corrects a TLS configuration mapping.
Action needed (1)
securityResource annotation validation
Resource annotation validation now rejects newline and control characters that could inject containers into pod specifications through template rendering.
Check if affected (2)
securityGateway deployment controller resource validation
Applies if the
gateway deployment controllerruns.breakingNamespace-based authorization for debug endpoints
Applies if you use debug endpoints on port
15014.
A maintenance release focused on security fixes, with additional ordinary bug corrections. It also includes startup-memory corrections and a removal related to that area.
Action needed (4)
securityhighCVE-2026-1609, disabled users obtaining tokens through the JWT Authorization Grant
Keycloak 26.5.3 fixes an issue where disabled users could still obtain tokens through the
JWT Authorization Grant.securityhighCVE-2026-1529, forged invitation JWT enabling cross-organization self-registration
Keycloak 26.5.3 fixes an issue where a forged invitation JWT could enable self-registration across organizations.
securityhighCVE-2026-1486, authentication through disabled identity providers
Keycloak 26.5.3 fixes a logic bypass in the
JWT Authorization Grantthat allowed authentication through disabled identity providers.securitymediumCVE-2025-14778, incorrect ownership checks in
/uma-policy/Keycloak 26.5.3 fixes incorrect ownership checks in the
/uma-policy/endpoint.
OpenCost v1.119.2 contains operator-facing fixes, configuration and cloud-integration changes, logging updates, and third-party dependency upgrades. No security advisories or explicit vulnerability disclosures are present.
Source ↗
Helm v4.1.1 is a correctness-fix release. The recorded note tail points to fixes for waiting context options, failed-resource handling in kstatus, resource matching behavior, and nil elements during slice copying.
Source ↗
This release removes a deprecated v1 adapter wrapper and changes the default span kind in API v3 operations. The remaining release notes do not describe distinct operator-facing changes.
Action needed (1)
breakingDeprecated
protofromtraceswrapper removalThe deprecated
protofromtraceswrapper has been removed fromv1adapter.
k8gb v0.18.0 adds runtime filtering and a Prometheus metric, and corrects several GSLB and DNS behaviors. It also updates dependencies and packaging and adds support features, while CI-only security-pipeline and workflow changes are not operator-facing security fixes.
Source ↗Jaeger v2.15.0 introduces a breaking constraint for trace and metric storage configuration. It also adds experimental MCP and ClickHouse capabilities, corrects API behavior, and includes an internal implementation change without direct operator impact.
Check if affected (1)
breakingTrace and metric storage configuration backend constraint
Applies if you configure trace or metric storage with more than one backend type.
A maintenance release with operator-facing removals, default and behavior changes, new CRD fields, expanded configuration support, and dependency updates. No security advisory is disclosed.
Action needed (1)
breakingNodes/proxy RBAC enablement removal
The unnecessary
nodes/proxyRBAC enablement is removed.
Check if affected (2)
breakingDefault Ceph image pull policy
Applies if you do not configure
ceph image pull policy.breakingAutomated node fencing code removal
Applies if
automated node fencingruns.
This release contains no described operator-facing changes. The available release note content consists only of headings and a duplicated release-bot entry.
Source ↗This release changes NATS connection authentication and the component spec feature. Dependency and OCI image base updates are also included.
Action needed (1)
breakingThe component spec feature, removed
The component spec feature is removed in this release.
Vitess v23.0.1 is a maintenance release focused on bug fixes and behavior corrections. It also adds CLI and TabletManager capabilities and updates dependencies.
Action needed (1)
securityThe
golang.dependency, updatedorg/x/crypto Vitess v23.0.1 updates
golang.from 0.42.0 to 0.45.0.org/x/crypto
A maintenance release with defect fixes and compatibility updates across the language integrations, plus changes to Python packaging and logging.
Source ↗Kubescape v4.0.0 expands operator capabilities while changing sensing architecture and scan output behavior. It also updates a dependency, improves scan performance, and includes a fix for version handling and injection.
Action needed (1)
securityVersion handling and injection fix
The release fixes version handling and injection in Kubescape v4.0.0.
Vitess v22.0.3 is a maintenance release focused on correctness across query serving, replication, tablet management, and orchestration. It also adds new vtbench credential and DemotePrimary force flags and upgrades the Go toolchain; no security fixes are described.