Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Apr 2026Clear ×Project: containerdClear ×

containerdv2.3.0Kubernetes CoreApr 30, 2026

ACTION 1PLAN 1OTHER 41View full analysis

A substantial operator-facing release with new capabilities, behavior changes, a compatibility constraint, and a deprecation. It is the first annual LTS release under a Kubernetes-aligned cadence, with support planned for at least two years.

Action needed (1)

breakingPlugin names disallow commas
OCI hook adjustments accumulate owners, and commas are disallowed in plugin names in this release.

Plan ahead (1)

deprecatedThe shim.Command API, deprecated
Applies if you use shim.Command.
shim.Command is deprecated in containerd 2.3.

Source ↗

containerdapi/v1.11.0Kubernetes CoreApr 30, 2026

CHECK 1OTHER 6View full analysis

This release adds and changes API and runtime capabilities, removes a sandbox metadata field, and updates a dependency. No security advisories or vulnerabilities are disclosed.

Check if affected (1)

breakingThe Container sandbox metadata field, removed
Applies if you use Container in API specs.
The Container field is removed from sandbox metadata in API v1.11.0.

Source ↗

containerdv2.2.3Kubernetes CoreApr 14, 2026

ACTION 1OTHER 14View full analysis

containerd v2.2.3 includes a disclosed security-related update to spdystream, alongside correctness, runtime, extraction, and dependency/toolchain changes. The recorded advisory is CVE-2026-35469.

Action needed (1)

securityhighspdystream dependency update for CVE-2026-35469
The spdystream dependency is updated in containerd v2.2.3 in connection with CVE-2026-35469.

Source ↗

containerdv2.0.8Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 4View full analysis

containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.

Action needed (1)

securityhighThe spdystream update for CVE-2026-35469
The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.

Check if affected (1)

securityCredential sanitization before gRPC returns
Applies if you use pod events through the Container Runtime Interface (CRI).
The Container Runtime Interface (CRI) path sanitizes errors before gRPC returns them, preventing credential leaks in pod events. The correction ships in containerd v2.0.8.

Source ↗

containerdv2.1.7Kubernetes CoreApr 14, 2026

ACTION 2CHECK 1OTHER 14View full analysis

A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.

Action needed (2)

securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2
The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.
securityhighgithub.com/moby/spdystream v0.5.1 update
The release updates github.com/moby/spdystream to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securityCredential sanitization before gRPC returns
Applies if pod events are used.
The release sanitizes errors before returning them over gRPC to prevent credential leakage in pod events.

Source ↗

containerdv1.7.31Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 9View full analysis

containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.

Action needed (1)

securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securitySanitized gRPC errors in pod events
Applies if you use pod events.
containerd v1.7.31 sanitizes errors before returning them through gRPC. The change addresses credential leakage in pod events.

Source ↗

Browse by month