AI-analyzed release notes for CNCF graduated and incubating projects.
This release includes a security-related dependency cleanup and a dependency update. The github. dependency moves from 1. to 1..
Action needed (1)
securityThe containerd v1 dependency, removed
The containerd v1 dependency is removed in Helm v3. to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.
A maintenance release updates golang. from 0. to 0.. It also contains release-navigation text and a generic upgrade recommendation.
A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.
Action needed (2)
securityMigration from github. to github.
Dependencies from github. were migrated to their github. equivalents to resolve CVEs. The migration ships in this release.
breakingRPC metrics from agent health check loopback calls
Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.
Check if affected (1)
breakingJWT-SVID serving by the delegated API
Applies if you use the delegated API for admin or downstream entries.
v3.4.5 is a maintenance release focused on correctness fixes and dependency updates. No security advisory or vulnerability is disclosed.
Source ↗This Flatcar release is a security update focused on fixes for disclosed Linux vulnerabilities. It also updates the Linux and ca-certificates dependencies.
Action needed (1)
securitycriticalLinux security fixes for disclosed CVEs
The Linux package carries fixes associated with CVE-2026-46242, CVE-2026-52908, CVE-2026-52910, CVE-2026-52917, CVE-2026-52924, CVE-2026-52929, CVE-2026-52930, CVE-2026-52935, CVE-2026-52939, CVE-2026-52942, CVE-2026-52946, CVE-2026-52947, CVE-2026-52948, CVE-2026-53131, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53140, CVE-2026-53143, CVE-2026-53144, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53152, CVE-2026-53154, CVE-2026-53156, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160, CVE-2026-53161, CVE-2026-53168, CVE-2026-53175, CVE-2026-53176, CVE-2026-53177, CVE-2026-53180, CVE-2026-53181, CVE-2026-53182, CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53186, CVE-2026-53189, CVE-2026-53190, CVE-2026-53191, CVE-2026-53192, CVE-2026-53193, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53198, CVE-2026-53199, CVE-2026-53202, CVE-2026-53203, CVE-2026-53205, CVE-2026-53207, CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53212, CVE-2026-53213, CVE-2026-53214, CVE-2026-53215, CVE-2026-53216, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53221, CVE-2026-53223, CVE-2026-53225, CVE-2026-53227, CVE-2026-53228, CVE-2026-53229, CVE-2026-53230, CVE-2026-53233, CVE-2026-53234, CVE-2026-53235, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238, CVE-2026-53239, CVE-2026-53241, CVE-2026-53242, CVE-2026-53245, CVE-2026-53247, CVE-2026-53249, CVE-2026-53251, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53271, CVE-2026-53272, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53328, CVE-2026-53329, CVE-2026-53331, CVE-2026-53332, CVE-2026-53336, CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53346, CVE-2026-53347, CVE-2026-53349, CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-53354, CVE-2026-53355, CVE-2026-53356, CVE-2026-53359, CVE-2026-53361, CVE-2026-53362. The fixes ship in Flatcar stable-4593..
This Flatcar release is a security update with fixes for Linux issues identified by CVE advisories. It also updates Linux and ca-certificates.
Action needed (1)
securitycriticalLinux security fixes for CVE advisories
Linux receives security fixes associated with CVE-2026-46242, CVE-2026-46243, CVE-2026-46244, CVE-2026-46275, CVE-2026-46323, CVE-2026-52908, CVE-2026-52910, CVE-2026-52912, CVE-2026-52913, CVE-2026-52914, CVE-2026-52915, CVE-2026-52916, CVE-2026-52917, CVE-2026-52918, CVE-2026-52919, CVE-2026-52921, CVE-2026-52922, CVE-2026-52923, CVE-2026-52924, CVE-2026-52926, CVE-2026-52927, CVE-2026-52929, CVE-2026-52930, CVE-2026-52931, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52941, CVE-2026-52942, CVE-2026-52943, CVE-2026-52944, CVE-2026-52946, CVE-2026-52947, CVE-2026-52948, CVE-2026-53080, CVE-2026-53131, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53143, CVE-2026-53144, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53154, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160, CVE-2026-53161, CVE-2026-53168, CVE-2026-53176, CVE-2026-53177, CVE-2026-53181, CVE-2026-53182, CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53186, CVE-2026-53189, CVE-2026-53190, CVE-2026-53192, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53198, CVE-2026-53199, CVE-2026-53207, CVE-2026-53208, CVE-2026-53209, CVE-2026-53212, CVE-2026-53213, CVE-2026-53214, CVE-2026-53215, CVE-2026-53216, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53221, CVE-2026-53223, CVE-2026-53225, CVE-2026-53227, CVE-2026-53228, CVE-2026-53230, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238, CVE-2026-53239, CVE-2026-53242, CVE-2026-53245, CVE-2026-53247, CVE-2026-53249, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53271, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53329, CVE-2026-53331, CVE-2026-53336, CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53347, CVE-2026-53349, CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-53354, CVE-2026-53355, CVE-2026-53356, CVE-2026-53357, CVE-2026-53358, CVE-2026-53359, CVE-2026-53361, and CVE-2026-53362.
Prometheus v3.5.5 includes a Go 1.25.12 toolchain change and a disclosed security fix in the UI. The security fix concerns the sanitize-html dependency and CVE-2026-53606.
Action needed (1)
securitymediumThe sanitize-html dependency update for CVE-2026-53606
The Prometheus UI updates sanitize-html to v2.17.5 to fix CVE-2026-53606.
A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.
Action needed (1)
securityPre-account takeover attack exposure
The release corrects an issue that provided room for pre-account takeover attacks.
Check if affected (19)
securitymediumCVE-2026-9796, admin role rename authorization
Applies if you use manage-clients.
securitymediumCVE-2026-9689, OIDC redirect URI parameter handling
Applies if you use OIDC.
securitymediumCVE-2026-9798, CIBA account lockout
Applies if you run the CIBA authentication flow.
Plan ahead (4)
deprecatedThe V1 API, deprecated
Applies if you use V1.
deprecatedThe Require Discoverable Credential option, deprecated
Applies if you configure the Require Discoverable Credential option.
deprecatedThe Twitter IDP implementation, deprecated
Applies if you use the Twitter IDP implementation.
A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.
Action needed (1)
securityThird-party dependency upgrades for TiKV 8.5
TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.
Check if affected (1)
breakingInvalid max_ts updates rejected by default
Applies if you do not set storage..
A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.
Check if affected (5)
securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus., prometheus., or prometheus..
Plan ahead (2)
deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI., or gatewayAPI..
deprecatedServerSideApply feature gate deprecation
A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang..
Action needed (1)
securityhighgolang. updated to v0.
The release updates golang. to v0. to resolve CVE-2026-46598, CVE-2026-39835, CVE-2026-39828, and CVE-2026-46597.
Check if affected (1)
securityCRL enforcement bypass on the gRPC listener, fixed
Applies if you configure --listen-client-http-urls.
A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.
Action needed (1)
securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186
The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.
Check if affected (4)
securityReceive tenant ID validation
Applies if you run Receive.
breakingQuery-Frontend time_taken field renamed to time_taken_ms
Applies if you run Query-Frontend.
breaking--shipper. flag removed
Applies if you configure --shipper..
A dependency maintenance release raises Python's minimum supported protobuf version from 6.33.5 to 7.35.1. It contains no other operator-facing changes.
Check if affected (1)
breakingPython protobuf dependency lower bound update
Applies if you use Python.
This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.
Action needed (1)
securityGo 1.25.10 dependency update
Go is updated to 1. for CVE remediation in this release.
Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang. packages, with no specific advisory identifiers or vulnerability details in the note.
Action needed (3)
securityGo 1.25.10 update
Go is updated to 1. for CVE remediation in v1.9.6.
securitygolang. v0.52.0 update
golang. is updated to v0. for CVE remediation in v1.9.6.
securitygolang. v0.55.0 update
golang. is updated to v0. for CVE remediation in v1.9.6.
Rook v1.20.2 includes dependency updates, behavioral changes, and fixes across Ceph, CSI, core, security, and storage operations. The release also tightens the manager NetworkPolicy to ingress-only; no vulnerability or advisory is disclosed.
Source ↗Nothing here needs operator attention.
Source ↗Flux v2.9.1 is a maintenance release focused on defect fixes, dependency and component updates, and a performance improvement. It includes changes across controller behavior and build and decryption paths, with no security advisories disclosed.
Source ↗OpenTelemetry v0.156.0 adds mdatagen and memory-limiter capabilities, changes generated configuration APIs, and corrects runtime and API defects. No security advisories or security-specific fixes are disclosed.
Source ↗OpenKruise v1.9.1 is a maintenance release focused on an operator-facing defect in Kubernetes server version parsing. The fix addresses a controller panic involving certain GKE and EKS version strings.
Source ↗k8gb v0.20.0 centers on ZoneDelegation-based DNS management, with TLSRoute and annotation support alongside changes to defaults and naming. The release also includes defect fixes and dependency updates, and no security advisories or vulnerabilities are identified.
Check if affected (4)
breakingThe Bootstrap service, removed
Applies if your configuration uses the Bootstrap service.
breakingThe dynamicZones setting, removed
Applies if your configuration uses dynamicZones.
breakingThe doFinalize default, set to false
Applies if you use doFinalize in ZoneDelegation finalization.
Lima v2.1.4 contains behavior fixes, FreeBSD template and general template updates, a nerdctl update from v2.3.3 to v2.3.4, and a change to the JSON network-list output. No security advisories or security-specific fixes are disclosed.
Source ↗A patch release fixes a formatting regression in opa fmt introduced in v1.18.0. It restores behavior where existing newlines in single-item collections determine whether policies are formatted on one line or across multiple lines.
Adds the endpointslices/restricted virtual resource to RBAC. Other listed material does not establish an additional operator-facing change.
CRI-O v1.35.5 includes an operator-facing correctness fix for container status ImageRef values after a CRI-O restart. It also updates CPU injection and gomaxprocs handling to account for workload partitioning and reduce potential Go scheduler throttling.
A feature and maintenance release that adds and changes capabilities across Core, PHP, Python, and Ruby, corrects runtime defects, and upgrades protobuf dependencies. The Python 1. package was removed from PyPI.
Check if affected (1)
breakinggRPC Python release 1., yanked from PyPI
Applies if you use gRPC Python release 1..
A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.
Action needed (1)
securityToken and blob-mount source validation
Blob-mount source projects are validated, and tokens without iat are rejected.
Check if affected (2)
breakingThe bundled PostgreSQL version, upgraded
Applies if you use PostgreSQL.
breakingThe cache backend, changed from redis to valkey
Applies if you use redis.
A performance behavior change updates the gomaxprocs hook to ignore workload partitioning when deciding whether to inject it. The calculation gives containers at least twice their requested number of CPUs to reduce potential Go scheduler throttling.
A maintenance release with fixes for CPU allocation behavior and container status reporting. CPU allocation is corrected to reduce scheduler throttling, and ImageRef remains stable across CRI-O restarts.
A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.
Action needed (2)
securityhighgo. dependencies, updated to v1.
The go. and go. dependencies are updated from v1. to v1.. The updates address CVE-2026-29181 and CVE-2026-39883.
securityhighgolang., updated to v0.
The golang. dependency is updated to v0.. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.
Check if affected (1)
securityCRL enforcement bypass on the gRPC listener, fixed
Applies if --listen-client-http-urls is configured.
A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.
Action needed (1)
securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go. and go. were updated from v1. to v1.. The updates address CVE-2026-29181 and CVE-2026-39883.
Check if affected (1)
securityCRL enforcement with --listen-client-http-urls
Applies if --listen-client-http-urls is configured.
A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.
Action needed (2)
securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.. This replaces the npm_licenses. archive previously shipped in release tarballs and container images.
Check if affected (2)
securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().
Longhorn v1.11.3 is a maintenance release with multiple correctness fixes and new metrics for LONGHORN_DISTRO. It requires Kubernetes v1.34 or later because the CSI external provisioner was upgraded to v6.3.0.
Istio 1.28.10 contains an operator-relevant correctness fix in the krt controller framework. The available release information does not include a standalone change item for this fix.
Source ↗
