AI-analyzed release notes for CNCF graduated and incubating projects.
KubeVirt v1.8.4 adds observability coverage, changes node-labeller CPU feature handling, and fixes a virt-handler resource leak. It also updates a dependency to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Action needed (1)
securityhighThe github. dependency, upgraded for CVE-2026-35469
github. is upgraded from v0.5.0 to v0.5.1 in KubeVirt v1.8.4 to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.
Action needed (2)
securitycriticalgoogle. update to 1.79.3
The google. dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.
securitySymlink traversal fix in the VMExport directory handler
The VMExport directory handler is fixed to prevent symlink traversal.
Plan ahead (1)
deprecatedDeprecated kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total recording rules
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.
The recording rules kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total are deprecated in favor of new names to comply with recording-rule naming conventions. Both are deprecated completely.
KubeVirt v1.7.4 includes correctness fixes and behavior changes affecting PCI topology and IPv6 migration. It also updates the gRPC dependency to address CVE-2026-33186.
Action needed (1)
securitycriticalThe google. dependency update for CVE-2026-33186
KubeVirt v1.7.4 updates google. to version 1. to remediate CVE-2026-33186.
KubeVirt v1.6.6 includes a dependency update for CVE-2026-33186. The recorded change affects the gRPC dependency shipped with this release.
Action needed (1)
securitycriticalgoogle. update for CVE-2026-33186
KubeVirt v1.6.6 bumps google. to remediate CVE-2026-33186.
