RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Jun 2026Clear ×
Envoyv1.35.13Networking & MessagingJun 23, 2026
ACTION 1CHECK 14View full analysis

A security-focused maintenance release with fixes across filters, protocol handling, request processing, and JSON parsing. It also updates the Wasmtime dependency and disables the contrib extension envoy.network.connection_balance.dlb.

Action needed (1)

  • securityhighHighly nested JSON destructor stack overflow, corrected for CVE-2026-48042

    This release corrects the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (14)

Source ↗
Buildpacksv0.40.7CI/CD & App DeliveryJun 23, 2026
OTHER 3View full analysis

This release focuses on builder configuration and registry issue documentation. It changes the lifecycle version included in builders, corrects the yank registry issue body, and updates the suggested Heroku builder image.

Source ↗
OpenTelemetryv0.155.0ObservabilityJun 23, 2026
CHECK 9PLAN 1OTHER 10View full analysis

A release that removes stabilized feature gates, updates processor metric names, and changes service configuration APIs. It also adds schema and metadata tooling capabilities and fixes generator defects.

Check if affected (9)

  • breakingThe confightp.framedSnappy feature gate, removed

    Applies if you use confightp.framedSnappy.

  • breakingThe configoptional.AddEnabledField feature gate, removed

    Applies if you use configoptional.AddEnabledField.

  • breakingThe confmap.newExpandedValueSanitizer feature gate, removed

    Applies if you use confmap.newExpandedValueSanitizer.

  • + 6 more on the release page

Plan ahead (1)

  • deprecatedService configuration API deprecations

    Applies if you use service.Settings.CollectorConf or extensioncapabilities.ConfigWatcher.

Source ↗
Crossplanev2.3.3Orchestration & ManagementJun 22, 2026
ACTION 2OTHER 1View full analysis

Crossplane v2.3.3 is a maintenance release with security fixes delivered through dependency and toolchain updates. It also corrects namespace handling for injected resource references in crossplane render, so rendered output matches reconciler behavior for cluster-scoped XRs.

Action needed (2)

  • securityPackage signature verification TOCTOU fix, GHSA-mf7q-r4rv-jv94

    The package signature verification TOCTOU flaw identified by GHSA-mf7q-r4rv-jv94 is fixed through the crossplane-runtime v2.3.3 dependency bump. The affected code moved from crossplane to crossplane-runtime during the v2.3 milestone, so this fix ships through that dependency in Crossplane v2.3.3.

  • securityGo 1.25.11, golang.org/x/net, and golang.org/x/sys updates

    The release-2.3 branch bumps Go to 1.25.11 and updates golang.org/x/net and golang.org/x/sys for CVE-related security fixes.

Source ↗
Crossplanev2.2.3Orchestration & ManagementJun 22, 2026
ACTION 1OTHER 3View full analysis

This release includes a security fix for package signature verification and updates to dependencies. It concerns deployments affected by the disclosed package-signature-verification flaw or by the updated dependency versions.

Action needed (1)

  • securitycriticalPackage signature verification TOCTOU fix, GHSA-wfqx-gjrf-g28r

    Crossplane v2.2.3 fixes the package signature verification TOCTOU issue identified by GHSA-wfqx-gjrf-g28r.

Source ↗
Crossplanev2.1.7Orchestration & ManagementJun 22, 2026
ACTION 3OTHER 1View full analysis

Crossplane v2.1.7 is a maintenance release with dependency and Go toolchain updates. The changes affect the software components shipped with this release.

Action needed (3)

  • securityThe github.com/quic-go/quic-go module update

    The github.com/quic-go/quic-go module is updated to v0.59.1 in Crossplane v2.1.7.

  • securityThe golang.org/x/net module update

    The golang.org/x/net module is updated to v0.55.0 in Crossplane v2.1.7.

  • securityThe Go toolchain at 1.25.11

    The Go toolchain is bumped to 1.25.11 in Crossplane v2.1.7.

Source ↗
Crossplanev1.20.10Orchestration & ManagementJun 22, 2026
ACTION 2OTHER 2View full analysis

A dependency maintenance release with security updates to the Go toolchain and MongoDB driver, alongside routine dependency bumps. Cosign and Docker remediation items were not applied and remain limitations.

Action needed (2)

  • securityhighThe Go toolchain, updated to 1.25.11

    The Go toolchain is updated to 1.25.11, the latest Go 1.25 security patch. The change addresses CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

  • securityThe go.mongodb.org/mongo-driver module, updated to v1.17.7

    The go.mongodb.org/mongo-driver module is updated to v1.17.7 with a security update.

Source ↗
OpenKruisev1.9.0CI/CD & App DeliveryJun 21, 2026
CHECK 2OTHER 31View full analysis

OpenKruise v1.9.0 adds operator-facing capabilities, upgrades several APIs to v1beta1, and tightens validation for numerical maxUnavailable and maxSurge values. It also includes multiple correctness fixes, with no security advisories or vulnerabilities disclosed.

Check if affected (2)

  • breakingKruise APIs upgraded to v1beta1

    Applies if your manifests use the listed Kruise APIs at v1alpha1.

  • breakingNumerical string values for maxUnavailable and maxSurge rejected

    Applies if you configure numerical string values for maxUnavailable or maxSurge.

Source ↗
Helmv3.21.2Kubernetes CoreJun 20, 2026
OTHER 1View full analysis

Helm v3.21.2 is a patch release that updates its Kubernetes client-library dependency set to v1.36. The release concerns compatibility with the expected Kubernetes v1.36 libraries, including client-go and related components.

Source ↗
Limav2.1.3Kubernetes CoreJun 19, 2026
CHECK 5OTHER 2View full analysis

A maintenance release that changes several defaults, updates dependencies, and fixes multiple security vulnerabilities. It also includes a fallback to scp for remote sources and destinations in auto mode.

Check if affected (5)

  • securitycriticalcontainerd v2.3.2 security fixes

    Applies if you use containerd.

  • securityhighCVE-2026-53657 and GHSA-2j9v-p4xj-cjw2 guest agent socket fix

    Applies if you run a QEMU VM that uses the guest agent socket.

  • breakingcontainerd.user default on non-Linux guests

    Applies if you run non-Linux guests.

  • + 2 more on the release page
Source ↗
containerdv2.1.9Kubernetes CoreJun 18, 2026
ACTION 5OTHER 7View full analysis

containerd v2.1.9 includes security fixes alongside checkpoint-restore and image-label behavior changes, plus updates to bundled runc and the Go toolchain. The security fixes require the v2.1.9 release, while the other changes matter when their affected behavior is in use.

Action needed (5)

Source ↗
containerdv1.7.33Kubernetes CoreJun 18, 2026
ACTION 2OTHER 4View full analysis

containerd v1.7.33 includes security updates for containerd and go-jose, along with runtime and toolchain dependency updates. It also changes file-read bounds and image-config label propagation.

Action needed (2)

Source ↗
containerdv2.0.10Kubernetes CoreJun 18, 2026
ACTION 1OTHER 4View full analysis

This release includes containerd security changes, behavior changes, and updates to the bundled runc binary and Go toolchain. The security advisories and runtime updates concern deployments that use the affected container runtime components.

Action needed (1)

Source ↗
containerdv2.3.2Kubernetes CoreJun 18, 2026
ACTION 1OTHER 11View full analysis

containerd v2.3.2 is a maintenance release with disclosed security fixes, correctness and behavior changes, and dependency and toolchain updates. The security fixes are the main concern for operators, while the other changes matter where the affected behavior is in use.

Action needed (1)

Source ↗
containerdv2.2.5Kubernetes CoreJun 18, 2026
ACTION 2OTHER 7View full analysis

A maintenance release with disclosed security fixes, dependency and toolchain updates, and changes to checkpoint and image-processing behavior. User-database reads are bounded in openUserFile, which may reject inputs that previously worked.

Action needed (2)

Source ↗
Linkerdedge-26.6.3Networking & MessagingJun 18, 2026
OTHER 9View full analysis

This edge release completes functionality for rate-limit-aware load balancing in Linkerd 2.20. It updates the proxy and several third-party dependencies, with no security advisories or security flaws identified.

Source ↗
Argov3.4.4CI/CD & App DeliveryJun 18, 2026
OTHER 9View full analysis

This release focuses on correctness fixes in Argo CD. All Argo CD container images are signed by cosign, and provenance is generated for container images and CLI binaries that meet SLSA Level 3 specifications. No security advisory is disclosed.

Source ↗
Argov3.3.12CI/CD & App DeliveryJun 18, 2026
OTHER 5View full analysis

Argo CD v3.3.12 is a maintenance release containing operator-relevant bug fixes. No security advisories or setup-breaking changes are disclosed.

Source ↗
Helmv4.2.2Kubernetes CoreJun 17, 2026
OTHER 1View full analysis

A maintenance release with a correctness fix in WaitForDelete. The status observer no longer cancels the watch too early, which addresses intermittent failures in full test suites.

Source ↗
Prometheusv3.5.4ObservabilityJun 17, 2026
ACTION 2CHECK 1OTHER 1View full analysis

Prometheus v3.5.4 is primarily a security maintenance release, with a fix for plaintext secret exposure and dependency updates addressing reported advisories. It also adds publication of container images to the GitHub Container Registry at ghcr.io.

Action needed (2)

  • securitycriticalgolang.org/x/net and OpenTelemetry dependency updates

    The golang.org/x/net dependency is updated to v0.55.0, and OpenTelemetry to v1.43.0. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.

  • securityPatched UI dependency versions

    The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.

Check if affected (1)

  • securityPlaintext secret exposure via /-/config corrected

    Applies if you access the /-/config endpoint.

Source ↗
Strimzi1.0.1Networking & MessagingJun 17, 2026
ACTION 2CHECK 2View full analysis

A release focused on CRD compatibility and Entity Operator watching defaults, with fixes for disclosed security vulnerabilities. It affects deployments using older CRD APIs or configuring cross-namespace watching.

Action needed (2)

Check if affected (2)

  • breakingSupported CRD API versions narrowed

    Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.

  • breakingEntity Operator cross-namespace watching default

    Applies if you configure STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED or watchedNamespace.

Source ↗
Litmus3.30.0ObservabilityJun 17, 2026
OTHER 7View full analysis

Litmus 3.30.0 adds installation charts and an exposed metrics port, while correcting GraphQL configuration and experiment creation behavior. It also tightens an RBAC operation and updates Docker base images and Go dependencies.

Source ↗
wasmCloudv2.4.0Orchestration & ManagementJun 17, 2026
ACTION 1CHECK 1OTHER 11View full analysis

wasmCloud v2.4.0 adds operator capabilities and configuration options while correcting runtime and tooling behavior. It also changes supported platform behavior and updates dependencies associated with Rust security advisories, so platform-specific users and deployments using the affected crates are most directly concerned.

Action needed (1)

  • securityThe postgres crates, updated for Rust security advisories

    The postgres crates are updated for RUSTSEC-2026-0178, RUSTSEC-2026-1079, and RUSTSEC-2026-0180. This dependency update ships in wasmCloud v2.4.0.

Check if affected (1)

  • breakingwebgpu disabled for s390

    Applicability is not stated in the release notes.

Source ↗
OpenFGAv1.18.0SecurityJun 17, 2026
CHECK 3View full analysis

v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.

Check if affected (3)

  • securitymediumMySQL schema migrations 008

    Applies if you use the MySQL backend.

  • securityConstant-time preshared key authentication

    Applies if you use preshared key authentication.

  • securityRequired OIDC issuer and audience configuration

    Applies if authn.method is set to oidc.

Source ↗
Rookv1.20.1Storage & DataJun 16, 2026
CHECK 2OTHER 6View full analysis

A release with operator-facing configuration and behavior changes, including a new default and cleanup of stale resources. It also includes dependency and feature updates, with no security advisory disclosed.

Check if affected (2)

  • breakingStale MDS and RGW pdbs removed

    Applies if you configure MDS and RGW pdbs.

  • breakingcsi-addons disabled by default

    Applies if you enable csi-addons.

Source ↗
Rookv1.19.7Storage & DataJun 16, 2026
CHECK 2OTHER 4View full analysis

This release updates the default Ceph version and changes operational handling for Helm ownership, stale PDB cleanup, OSD device classes, and post-upgrade releases. It contains no disclosed security advisories.

Check if affected (2)

  • breakingDefault Ceph version 19.2.4

    Applies if you use Ceph.

  • breakingStale MDS and RGW PDB cleanup

    Applicability is not stated in the release notes.

Source ↗
Backstagev1.52.0CI/CD & App DeliveryJun 16, 2026
ACTION 2CHECK 7PLAN 9OTHER 288View full analysis

A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.

Action needed (2)

  • securityThe infinispan dependency upgrade

    infinispan was upgraded from ^0.12.0 to ^0.13.0 to address known vulnerabilities.

  • breakingThe unused json-schema runtime dependency, removed

    The unused json-schema runtime dependency has been removed.

Check if affected (7)

  • breakingThe catalog.stitchingStrategy.mode: 'immediate' setting, removed

    Applies if you configure catalog.stitchingStrategy.mode.

  • breakingComboboxProps as a union type

    Applies if you use ComboboxProps.

  • breakingThe default /kubernetes page, removed

    Applies if you use /kubernetes.

  • + 4 more on the release page

Plan ahead (9)

  • deprecatedTop-level Combobox input state props, deprecated

    Applies if you use plain-array options.

  • deprecatedPrevious tokens, deprecatedremoval date not announced

    Applicability is not stated in the release notes.

  • deprecatedThe single-module runCliModule helper, deprecated

    Applies if you use runCliModule.

  • + 6 more on the release page
Source ↗
KubeVirtv1.8.4Orchestration & ManagementJun 16, 2026
ACTION 1OTHER 3View full analysis

KubeVirt v1.8.4 adds observability coverage, changes node-labeller CPU feature handling, and fixes a virt-handler resource leak. It also updates a dependency to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Action needed (1)

  • securityhighThe github.com/moby/spdystream dependency, upgraded for CVE-2026-35469

    github.com/moby/spdystream is upgraded from v0.5.0 to v0.5.1 in KubeVirt v1.8.4 to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Source ↗
Ciliumv1.19.5Networking & MessagingJun 16, 2026
CHECK 3OTHER 48View full analysis

A maintenance-focused release with correctness fixes, dependency updates, operator troubleshooting improvements, and a security fix for a namespace-bypass issue. It also removes obsolete Helm settings, so configurations using those values need review.

Check if affected (3)

  • securityWildcard namespace bypass for selectorless ipBlock rules, fixed

    Applies if you configure ipBlock.

  • breakingThe loadBalancer.standalone Helm option, removed

    Applies if you configure loadBalancer.standalone.

  • breakingThe l2podAnnouncements.interface Helm value, replaced by l2podAnnouncements.interfacePattern

    Applies if you configure l2podAnnouncements.interface and enable L2 pod announcements.

Source ↗
Ciliumv1.18.11Networking & MessagingJun 16, 2026
OTHER 38View full analysis

Cilium v1.18.11 is a maintenance release with operator-relevant bug fixes and expanded information reporting for troubleshooting commands. It also updates dependencies, container images, and the proxy version, with no security advisories or explicitly described security flaws.

Source ↗
Ciliumv1.17.17Networking & MessagingJun 16, 2026
OTHER 21View full analysis

Cilium v1.17.17 updates troubleshooting information, Helm chart configurability, proxy and dependency versions, and installation image digests. It also fixes retries for CiliumNode Get errors in multipool.

Source ↗
Flatcar Container Linuxstable-4593.2.3Provisioning & RuntimeJun 16, 2026
ACTION 1OTHER 2View full analysis

This Flatcar release includes multiple Linux vulnerability fixes and updates Linux to 6.12.93. It also adds NVMe/TCP support for storage backends that use NVMe over Fabrics, while the Linux security fixes make the release relevant to systems requiring those updates.

Action needed (1)

Source ↗
Daprv1.18.1Orchestration & ManagementJun 16, 2026
OTHER 4View full analysis

Dapr v1.18.1 is a bug-fix release covering workflow timer cleanup, sidecar shutdown and restart behavior, ContinueAsNew completion handling, operator resynchronization, and Helm CRD schema alignment. No security advisories or security flaws are identified.

Source ↗
Linkerdedge-26.6.2Networking & MessagingJun 16, 2026
CHECK 1OTHER 18View full analysis

A release with narrower ExternalWorkloads endpoint behavior, annotation support for upcoming load-balancing features, policy and profile fixes, dependency updates, and new load-biasing functionality. This release is explicitly not recommended in favor of edge-26.6.3.

Check if affected (1)

  • breakingNamespace-restricted ExternalWorkloads endpoints

    Applies if you use ExternalWorkloads.

Source ↗
Daprv1.17.10Orchestration & ManagementJun 15, 2026
View full analysis

This release corrects a resiliency retry defect in pubsub publish operations. Configured status-code matching is honored when publish errors carry gRPC status codes.

Source ↗
Daprv1.16.16Orchestration & ManagementJun 15, 2026
OTHER 2View full analysis

A maintenance release with fixes for Sentry certificate signing interoperability and Helm-based downgrade handling. It backports certificate template and SignRequest changes, along with the dapr_scheduler.storageSize Helm template helper.

Source ↗
Tektonv1.13.1CI/CD & App DeliveryJun 15, 2026
CHECK 1OTHER 3View full analysis

A maintenance release with defect corrections and a behavior change affecting implicit resource settings for internal containers. No security advisories are disclosed.

Check if affected (1)

  • breakingDefault resource requirements for internal containers are removed

    Applies if you do not set default-container-resource-requirements.

Source ↗
Tektonv1.12.1CI/CD & App DeliveryJun 15, 2026
CHECK 1OTHER 29View full analysis

A maintenance release with several correctness fixes and multiple dependency updates. Resolver behavior is narrowed so that only StepActions, Tasks, and Pipelines can be resolved, which requires review for users of Tekton Resolvers.

Check if affected (1)

  • breakingTekton Resolver object restrictions

    Applies if you use Tekton Resolvers.

Source ↗
Tektonv1.9.4CI/CD & App DeliveryJun 15, 2026
ACTION 1CHECK 1OTHER 24View full analysis

A maintenance release with correctness fixes, a security-relevant dependency update, resolver compatibility constraints, metric behavior changes, and additional dependency upgrades. The changes include a restriction on the object types handled by Tekton Resolvers and an update to gRPC.

Action needed (1)

  • securitycriticalgoogle.golang.org/grpc updated to 1.79.3 for CVE-2026-33186

    The google.golang.org/grpc dependency is updated from 1.77.0 to 1.79.3 to fix CVE-2026-33186, an authorization bypass caused by a missing leading slash in the :path header.

Check if affected (1)

  • breakingTekton Resolvers, limited to supported object types

    Applies if you use the Resolver API.

Source ↗
← NewerOlder →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023