Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Feb 2026Clear ×

Ciliumv1.19.0Networking & MessagingFeb 4, 2026

ACTION 15CHECK 30PLAN 7OTHER 436View full analysis

A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.

Action needed (15)

securityThe github.com/containerd/containerd dependency, updated
The github.com/containerd/containerd module is updated to v1.7.29.
securityThe github.com/go-viper/mapstructure/v2 dependency, updated
The github.com/go-viper/mapstructure/v2 module is updated to v2.4.0.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker module is updated to v28.3.3+incompatible.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto module is updated to v0.45.0.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.4
The helm.sh/helm/v3 module is updated to v3.18.4.
securityThe helm.sh/helm/v3 dependency, updated to v3.18.5
The helm.sh/helm/v3 module is updated to v3.18.5.
breakingThe plpmtud default, set to blackhole
The default plpmtud mode is now blackhole (blackhole-detected).
breakingThe AddressScopeMax default, set to 254
The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.
breakingThe tls authMode default, set to migration
tls authMode is set to migration by default.
breakingThe CNI deletion timeout, reduced to 1.5 seconds
The CNI deletion timeout is reduced to 1.5 seconds.
breakingThe policy-default-local-cluster default
policy-default-local-cluster is now set by default.
breakingHost firewall bypass, disabled by default
Host firewall bypass is disabled by default.
breakingFQDN match pattern sanitization
FQDN match pattern sanitization is refactored and tightened.
breakingEncrypted traffic forwarding via cilium_host, removed
Forwarding encrypted traffic via cilium_host has been removed.
breakingCNI configuration in the container image, removed
The CNI configuration is no longer installed in the container image.

Check if affected (30)

breakingLocal-cluster default for network policy selectors
Applies if you do not set cluster in network policy selectors.
breakingThe CiliumBGPPeeringPolicy v1 API, removed
Applies if you use CiliumBGPPeeringPolicy.
breakingMutual Authentication, disabled by default
Applies if you enable Mutual Authentication.
+ 27 more on the release page

Plan ahead (7)

deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced
Applies if you use --enable-ipsec-encrypted-overlay.
deprecatedKafka match fields and ToRequires and FromRequires, deprecated
Applies if you use ToRequires or FromRequires.
deprecatedTLS certificate and key Helm values, deprecated
Applies if you pass TLS certificates or keys in Helm values.
+ 4 more on the release page

Source ↗

CRI-Ov1.32.13Kubernetes CoreFeb 4, 2026

OTHER 1View full analysis

This release contains an operator-facing bug fix for container SELinux labeling. Systemd and init containers now respect a user-specified SELinux label.

Source ↗

Crossplanev2.1.4Orchestration & ManagementFeb 3, 2026

ACTION 4OTHER 2View full analysis

Crossplane v2.1.4 is a maintenance release with security-related dependency updates. It also includes corrections for shared transitive dependency upgrades, so the release concerns operators tracking dependency and security fixes.

Action needed (4)

securityThe github.com/quic-go/quic-go module, updated to v0.57.0
The release updates the github.com/quic-go/quic-go module to v0.57.0 as a security-related dependency change.
securitysigstore dependency updates for CVEs
The release updates sigstore dependencies to fix CVEs.
securityThe github.com/theupdateframework/go-tuf/v2 module, updated to v2.4.1
The release updates the github.com/theupdateframework/go-tuf/v2 module to v2.4.1 as a security-related dependency change.
securityThe github.com/go-chi/chi/v5 module, updated to v5.2.4
The release updates the github.com/go-chi/chi/v5 module to v5.2.4 as a security-related dependency change.

Source ↗

Crossplanev2.0.7Orchestration & ManagementFeb 3, 2026

ACTION 1OTHER 2View full analysis

This release updates a security-related dependency and corrects shared transitive dependency upgrades. It also fixes propagation of composite identity through nested XR trees.

Action needed (1)

securityThe github.com/theupdateframework/go-tuf/v2 dependency, updated to v2.4.1
The github.com/theupdateframework/go-tuf/v2 module is updated to v2.4.1 in the release-2.0 branch.

Source ↗

Crossplanev1.20.5Orchestration & ManagementFeb 3, 2026

ACTION 1OTHER 1View full analysis

Crossplane v1.20.5 is a maintenance release focused on dependency updates. It includes a security-related update to sigstore dependencies and addresses a defect in shared transitive dependency upgrades.

Action needed (1)

securityThe sigstore dependencies, updated for CVE fixes
The release-1.20 branch updates sigstore dependencies to fix CVEs.

Source ↗

CRI-Ov1.34.5Kubernetes CoreFeb 3, 2026

OTHER 1View full analysis

A maintenance release includes a fix for high performance hook IRQ SMP affinity handling during late container deletion. The fix prevents IRQ SMP affinity for other containers from being changed incorrectly.

Source ↗

CRI-Ov1.33.9Kubernetes CoreFeb 3, 2026

View full analysis

This release contains no described operator-facing changes. No recorded release-note items indicate changes to configuration, interfaces, or operational behavior.

Source ↗

Backstagev1.46.5CI/CD & App DeliveryFeb 2, 2026

ACTION 1View full analysis

This is a maintenance release with security fixes backported from v1.47.3. The fixes affect operators using the v1.46.5 release line.

Action needed (1)

securityBackported security fixes from v1.47.3
This release contains backported security fixes from v1.47.3.

Source ↗

Backstagev1.47.3CI/CD & App DeliveryFeb 2, 2026

CHECK 1View full analysis

A security-focused release with fixes for the TechDocs Node plugin. The release is relevant to deployments that use @backstage/plugin-techdocs-node.

Check if affected (1)

securitySecurity fixes for @backstage/plugin-techdocs-node
Applies if you use @backstage/plugin-techdocs-node.

Source ↗

cert-managerv1.18.5SecurityFeb 2, 2026

ACTION 1OTHER 3View full analysis

cert-manager v1.18.5 contains a security fix for GHSA-gx3x-vq4p-mhhv alongside other bug fixes. It also adds IPv6 HTTP-01 support and updates the Go toolchain.

Action needed (1)

securitymediumGHSA-gx3x-vq4p-mhhv denial-of-service fix
cert-manager v1.18.5 fixes the denial-of-service issue identified by GHSA-gx3x-vq4p-mhhv. The release contains three bug fixes in total.

Source ↗

cert-managerv1.19.3SecurityFeb 2, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.

Check if affected (1)

securitymediumcert-manager controller DNS response panic fix, GHSA-gx3x-vq4p-mhhv
Applicability is not stated in the release notes.

Source ↗

Kyvernov1.17.0SecurityFeb 2, 2026

ACTION 2CHECK 2OTHER 142View full analysis

A substantial feature and maintenance release adds CEL and policy capabilities while correcting controller and API defects. It also includes security fixes, including a kubectl image update for CVEs, along with dependency and integration changes.

Action needed (2)

securitySecurity vulnerabilities addressed
Security vulnerabilities are addressed in this release.
securityUpdated kubectl image for CVE fixes
The kubectl image is updated to address CVEs in this release.

Check if affected (2)

breakingRestricted resource access in namespaced CEL policy types
Applies if you use namespaced CEL policy types.
breakingOpt-in VAP/MAP reporting
Applies if you use VAP/MAP reporting.

Source ↗

KEDAv2.19.0Orchestration & ManagementFeb 2, 2026

CHECK 1OTHER 18View full analysis

A feature and maintenance release that adds scaler and authentication capabilities, updates scaler behavior and status reporting, and corrects several defects. It also replaces a deprecated dependency and removes the NATS Streaming scaler.

Check if affected (1)

breakingThe NATS Streaming scaler, removed
Applies if you use the NATS Streaming scaler.

Source ↗

Argov3.3.0CI/CD & App DeliveryFeb 2, 2026

ACTION 3CHECK 1OTHER 362View full analysis

Argo v3.3.0 is a substantial feature and maintenance release with changes across synchronization, health, hydration, diff and apply behavior, the UI, and resource operations. It also updates core dependencies and removes an app controller flag.

Action needed (3)

securityThe k8s.io/kubernetes module, updated to v1.34.2
The k8s.io/kubernetes module is updated to v1.34.2 in Argo v3.3.0.
securityHelm 3.19.4
Helm is updated to 3.19.4 in Argo v3.3.0.
securityRedis, updated to the latest stable release
Redis is updated to the latest stable release in Argo v3.3.0.

Check if affected (1)

breakingThe --self-heal-backoff-cooldown-seconds flag, removed
Applies if your app controller configuration uses --self-heal-backoff-cooldown-seconds.

Source ↗

← NewerFeb 4, 2026 – Feb 2, 2026

Browse by month