Releases

Envoy v1.39.0 is a major release combining several breaking behavior changes (mandatory keyUsage enforcement, disabled DLB balancer, stricter TLS inspector validation, changed OTel sampling behavior) with a large batch of roughly 20 medium-severity CVE fixes spanning HTTP/2, HTTP/3, ext_authz, ext_proc, OAuth2, DNS, and several other subsystems. It also ships extensive non-actionable feature and performance work, including dynamic-modules extension points and a new streaming JSON parser for AI protocols.

• securityBroad CVE batch fixed across core protocol and extension code

  This release fixes roughly 20 CVEs across HTTP/2, HTTP/3, ext_authz, ext_proc, gRPC stats, internal redirects, OAuth2, DNS, JSON parsing, PROXY protocol, formatters, StatsD, TLS SAN handling, and Zstd decompression, all rated medium by the notes. Notable ones include HTTP/2 cookie-based header-limit bypass (CVE-2026-47774), HTTP/3 QPACK blocked-decoding DoS (GHSA-p7c7-7c47-pwch), and Zstd decompression memory exhaustion (CVE-2026-48044). The fixes ship in v1.39.0.

• securityOAuth2 cookie encryption moves to AES-256-GCM (opt-in migration)

  OAuth2 adds AES-256-GCM cookie encryption to address CVE-2026-47775, replacing the older CBC-based scheme. Migration is opt-in: enable oauth2_use_gcm_encryption, monitor the oauth_legacy_cbc_decrypt metric, then disable oauth2_legacy_cbc_decrypt_compat once legacy decryption is no longer observed.

• breakingCertificate keyUsage enforcement is now mandatory

  Envoy now always enforces the certificate keyUsage extension; the enforce_rsa_key_usage field is deprecated and ignored. This applies unconditionally starting in v1.39.0, so certificates that previously relied on lax enforcement may now fail validation.

• breakingDLB connection balancer disabled in all builds

  The Intel DLB connection balancer (envoy.network.connection_balance.dlb) is disabled in all builds because of a broken source archive. This applies wherever that extension is configured.

• breakingTLS inspector now rejects out-of-range client TLS versions

  The TLS inspector now validates that client TLS versions fall between 1.0 and 1.3, rejecting anything outside that range. The check is unconditional in v1.39.0 but can be reverted with envoy.reloadable_features.tls_inspector_enforce_client_tls_version.

• breakingOTel tracing now defers to Envoy's own sampling decision

  The OpenTelemetry tracer now honors Envoy's own request-entry sampling decision, including overall_sampling, even when a propagated trace context or configured sampler requests sampling. This applies to deployments relying on downstream or context-based sampling overriding Envoy's local config, and may reduce the volume of exported spans.

Backstage v1.53.0 is a feature release with seven breaking changes across auth, CLI, and API layers. The SSE MCP transport, proxy agent bootstrap, and OpenAPI testing CLI commands are removed; OAuth redirect validation is tightened to reject wildcards crossing host-path boundaries and embedded credentials; config-loader enforces strict type checking; and EntityContextMenuItemBlueprint changes output structure. Optic is replaced by oasdiff for OpenAPI tooling. Numerous bugfixes address TechDocs, Scaffolder, and catalog issues; new features include breadcrumbs framework, user settings storage, and extended auth/database options. No security fixes are included.

• breakingSSE MCP transport removed

  The Server-Sent Events (SSE) transport for MCP actions has been removed from @backstage/plugin-mcp-actions-backend. If your deployment uses the SSE transport, switch to the Streamable HTTP endpoint or update your MCP configuration.

• breakingStricter config-loader type validation

  Config-loader now validates imported types in TypeScript configuration schemas instead of treating them as unconstrained. Invalid imports will cause schema loading to fail. Review your configuration schemas for unresolved or missing type imports.

• breakingTighter OAuth redirect URI and CIMD allowlist matching

  Wildcard patterns in OAuth redirect URIs are now constrained: patterns must include an explicit protocol, wildcards no longer match across host and path boundaries, and embedded credentials are always rejected. Patterns like http://localhost:* now match only the root path; use http://localhost:*/* to allow any path. Update your auth configuration to match this stricter syntax.

• breakingEntityContextMenuItemBlueprint output type change

  The EntityContextMenuItemBlueprint API now outputs menu item data instead of a rendered MUI element; the icon type is now IconElement. Update any code that depends on the catalog entity context menu to use the new data structure.

• breakingLegacy proxy agent bootstrap removed

  The bootstrapEnvProxyAgents export has been removed from @backstage/cli-common, along with global-agent and undici dependencies. If you rely on this export, use Node's native NODE_USE_ENV_PROXY environment variable instead.

• breakingOpenAPI CLI commands and wrapInOpenApiTestServer removed

  The package schema openapi init and repo schema openapi test CLI commands have been removed. Runtime OpenAPI validation is still available via wrapServer from @backstage/backend-openapi-utils/testUtils. The wrapInOpenApiTestServer function has also been removed; use wrapServer instead.

• breakingOpenAPI tooling switched from Optic to oasdiff

  Optic (@useoptic/optic and @useoptic/openapi-utilities) has been replaced with oasdiff in @backstage/repo-tools for OpenAPI breaking change detection. Update any tooling or CI/CD pipelines that reference Optic.

CoreDNS v1.14.5 is a maintenance release improving DoH/DoH3 transport safety and forward plugin robustness with per-upstream read timeout configuration. Three behavior changes affect TLS defaults, DoQ timeout handling, and forward plugin configuration; no CVE fixes.

• breakingTLS defaults switch to Go standard library

  CoreDNS v1.14.5 now uses Go's standard TLS defaults instead of custom configuration. Review and test any TLS-dependent setups, particularly for DoH/DoH3 transport, to ensure compliance with your security requirements.

• breakingDoQ stream reads now bounded by server timeout

  DNS over QUIC (DoQ) stream reads are now bounded by the server read timeout. Check if your DoQ deployments have appropriate read timeout values configured; streams that previously hung indefinitely will now time out.

• enhancementPer-upstream read timeout now configurable

  The forward plugin now accepts per-upstream read timeout configuration. If you have asymmetric upstream latency or need fine-grained control per resolver, you can now configure this; existing setups continue to use the server-level read timeout.

SPIRE v1.15.2 is a mixed release addressing security concerns through docker/docker to moby/moby migration (resolving CVEs) and a HIGH-severity delegated identity API restriction preventing JWT-SVID exposure for admin or downstream entries. The release also introduces the SPIFFE Broker, per-caller rate limiting, TLS metrics endpoint support, and numerous performance and compatibility improvements across multiple attestors and plugins.

• securityResolve docker/docker CVEs via moby/moby migration

  docker/docker dependencies have been migrated to moby/moby equivalents to resolve Docker/Moby CVEs. Upgrade to v1.15.2.

• breakingDelegated API no longer serves JWT-SVIDs for admin/downstream entries

  The delegated identity API no longer serves JWT-SVIDs for admin or downstream entries. If you use the delegated identity API with admin or downstream entries, verify that clients no longer depend on JWT-SVID tokens from those entry types.

TiKV/TiDB v8.5.7 is a mixed release combining several default/behavior changes operators must review (stricter max_ts and NOT NULL validation, auto IndexMerge, TiDB Lightning web UI removal, resource-control metric relabeling) with a security-relevant dependency upgrade and a broad set of new features, performance work, and bug fixes.

• securityVulnerable TiKV third-party dependencies patched

  This release upgrades vulnerable third-party dependencies used by TiKV 8.5 and aligns required compatibility fixes with upstream, improving stability and security. Upgrade to pick up the patched dependencies.

• breakingmax_ts invalid-update handling now errors by default

  TiKV now rejects max_ts updates confirmed invalid instead of only logging them. If you rely on the previous log-only behavior, set storage.max-ts.action-on-invalid-update to log before upgrading.

• breakingFix control 52869 (auto IndexMerge) enabled by default

  TiDB now enables optimizer fix control 52869 by default, letting the optimizer consider IndexMerge automatically when alternative indexes exist. This can change query plans in some cases; review plans for sensitive queries after upgrade.

• breakingStrict NOT NULL validation on INSERT enabled by default

  tidb_enable_strict_not_null_check now defaults to ON, enforcing strict validation when an INSERT explicitly writes NULL into a NOT NULL column. Statements that previously succeeded may now fail; audit INSERT paths that rely on lenient NULL handling.

• breakingResource-control background metrics lose resource_group label

  TiKV background resource-control metrics are now aggregated globally via a single rate limiter, dropping the per resource_group label. Update dashboards and alerting rules that filter or group by resource_group for background metrics.

• breakingTiDB Lightning web interface removed

  TiDB Lightning drops its web interface starting in v8.5.7. Switch to the command-line tools tidb-lightning for import tasks and tidb-lightning-ctl for checkpoint and troubleshooting operations.

cert-manager v1.21.0 is a mixed release: it ships a security-hardening RBAC restriction (GHSA-8rvj-mm4h-c258) plus two other breaking Helm/RBAC changes, alongside new ARI, Vault AWS-IAM, and Gateway API capabilities and several bug fixes. Operators should review Helm values and RBAC assumptions before upgrading.

• securityReview cert-manager-edit permissions after Challenge/Order create rights removed

  cert-manager-edit no longer grants create on Challenge resources or create/patch/update on Order resources, closing a path where a user with edit access could tamper with ACME validation flow. Fixed upstream in v1.20.3 and carried into v1.21.0; upgrade if your tooling or users create Challenge/Order resources directly, since those workflows will need the cert-manager-approve or a custom role instead.

• breakingDefault tokenrequest RBAC for the controller ServiceAccount removed

  The Helm chart no longer creates the default Role/RoleBinding granting serviceaccounts/token: create to the controller's own ServiceAccount. This only affects clusters relying on the undocumented pattern of serviceAccountRef.name pointing at the controller's ServiceAccount; those setups need an explicit RBAC grant added post-upgrade.

• breakingRemove deprecated Prometheus Helm values before upgrading

  prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path are gone from the Helm values schema (the ServiceMonitor port was also renamed from tcp-prometheus-servicemonitor to http-metrics). Any values override still setting these keys will fail Helm's schema validation on upgrade; scrub them from your values files first.

Thanos v0.42.0 is a mixed release: it patches a critical gRPC authorization-bypass vulnerability (CVE-2026-33186, CVSS 9.1) that could defeat path-based deny rules, alongside several breaking flag removals in Receive and Store, a gRPC keepalive policy change, and a batch of new TLS/cipher configuration options. Upgrade promptly for the security fix, but review the removed flags and renamed Query-Frontend field before rolling out.

• securityFix critical gRPC authorization bypass (CVE-2026-33186)

  A malformed `:path` header in gRPC requests can bypass path-based "deny" rules in `grpc/authz` interceptors, effectively defeating authorization checks. Fixed via an updated `thanos-community/grpc-go` fork. CVSS 9.1, critical, tracked as CVE-2026-33186. Upgrade to v0.42.0 immediately if you rely on gRPC path-based authorization.

• breakingReceive: --shipper.ignore-unequal-block-size removed

  `--shipper.ignore-unequal-block-size` is gone. TSDB now delays compaction until the shipper finishes uploading blocks, so compaction can safely proceed during upload without the risk this flag used to guard against. Remove any references to it from Receive configs.

• breakingStore: --debug.advertise-compatibility-label removed

  `--debug.advertise-compatibility-label` is gone and Store no longer advertises the `@thanos_compatibility_store_type=store` external label by default. This breaks compatibility with Thanos Query instances older than v0.8.0; upgrade Queriers first if you still run pre-v0.8.0 components.

• breakingQuery-Frontend: time_taken field renamed to time_taken_ms

  The Query-Frontend JSON field `time_taken` is now `time_taken_ms`, aligning naming with its unit for easier log parsing. Update any log collector rules or dashboards that key off the old field name.

gRPC v1.82.1 is a narrow patch release that only raises the Python protobuf lower bound from 6.33.5 to 7.35.1. This is a breaking change for anyone pinned to an older protobuf release and should be checked before upgrading.

• breakingprotobuf lower bound raised to 7.35.1

  The minimum required protobuf version has moved from 6.33.5 to 7.35.1. Projects pinned to protobuf below 7.35.1 will fail to resolve dependencies against this gRPC release and need to bump their protobuf pin before upgrading.

Flux v2.9.1 is a patch release fixing a CRD schema corruption bug where post-build variable substitution could clobber Flux's own CRD fields, plus smaller fixes for SOPS .ini decryption and a dry-run strategic merge patch error. No breaking changes, deprecations, or CVEs are disclosed.

• breakingCRD schema corruption from post-build substitution is fixed

  Post-build variable substitution in Kustomizations could accidentally match and corrupt Flux's own CRD schema fields when a manifest contained ${...} sequences overlapping those field names. This affected Kustomizations with post-build substitution enabled. Fixed by annotating Flux CRDs with kustomize.toolkit.fluxcd.io/substitute: disabled. Upgrade to v2.9.1 if you use post-build substitution.

Harbor v2.15.2 is a maintenance patch backporting the 2.15.0 security hardening set (blob-mount token validation, crypto/SMTP cleanup) plus the Redis-to-Valkey cache backend swap, alongside a large batch of UI/UX fixes following the Angular 21/Clarity v18 upgrade. No critical or high severity issues are involved; upgrade at normal patch cadence, but check external Redis/Valkey compatibility first.

• securityBlob-mount token validation hardened

  Blob-mount now validates that the source project matches and rejects tokens missing the 'iat' claim, closing a gap that could let a token be replayed or misused across projects during blob mounting. No configuration change is needed, just upgrade.

• securityCrypto usage hardened, unused SMTP package dropped

  Harbor tightened internal crypto usage and dropped the unused SMTP package, reducing attack surface. Rated low severity; upgrade covers it, no action required beyond that.

• breakingCache backend switched from Redis to Valkey

  The cache backend moves from Redis to Valkey. If you run external Redis, or reference redis-specific config/images/health checks in your deployment, verify compatibility with Valkey before or during the upgrade.

• breakingInternal YAML library replaced

  Harbor's YAML library changed from gopkg.in/yaml.v2 to github.com/goccy/go-yaml internally. This is an internal dependency swap with no expected operator-facing change, but flag it if you parse Harbor-generated YAML with strict schema assumptions.

• breakingRegistry pinned to stable v2.8.3-harbor.1

  The bundled registry component now tracks the stable v2.8.3-harbor.1 tag instead of an rc.5 pre-release build, giving a more predictable registry version in this patch.

Prometheus v3.13.0 is an LTS release leading with a HIGH-severity credential-forwarding fix (CVE-2025-4673, CVE-2023-45289) and a MEDIUM XSS fix (CVE-2026-44990), alongside four breaking changes to pagination tokens, path resolution, PromQL duration function names, and license file packaging, plus a broad set of new features and performance improvements.

• securityHIGH: Credentials no longer forwarded on cross-host redirects

  Credentials (Authorization header, basic auth, bearer token, OAuth2, and configured headers) are no longer forwarded when following a redirect to a different host. This affects scraping, remote read/write, alerting, and service discovery where credentials are configured and cross-host redirects occur. Tracked as CVE-2025-4673 and CVE-2023-45289; driven by upgrading prometheus/common from v0.68.x to v0.69.0. Review any targets or endpoints that rely on redirects, as credentials will now be dropped silently on host change.

• securityMEDIUM: XSS fix in UI dependency (CVE-2026-44990)

  sanitize-html was bumped to fix a cross-site scripting vulnerability (CVE-2026-44990) in the Prometheus UI. No configuration change needed; upgrade to v3.13.0.

• breakingPagination token algorithm changed from SHA-1 to SHA-256

  Rule group pagination tokens now use SHA-256 instead of SHA-1. Any client or tooling that stores or compares pagination tokens across versions will see different token values after upgrade.

• breaking--http.config.file relative path resolution changed

  Relative file paths inside the file passed to --http.config.file are now resolved relative to that config file's own directory, not its parent directory. If you use relative paths in that config, verify they still resolve correctly after upgrading.

• breakingDuration-expression functions min()/max() renamed to min_of()/max_of()

  If you use the experimental-duration-expr feature flag, the PromQL duration functions min() and max() have been renamed to min_of() and max_of(). Update any queries or rules that use the old names.

• breakingnpm_licenses.tar.bz2 removed; licenses now at /assets/third-party-licenses.txt

  npm_licenses.tar.bz2 is no longer shipped in release tarballs or container images. Third-party npm license text is now embedded in the binary and served at /assets/third-party-licenses.txt. Any automation that extracted that archive needs updating.

Longhorn v1.11.3 is a bugfix rollup addressing over a dozen stability issues across volume operations, backups, and instance management. One upgrade prerequisite applies: the CSI external provisioner is now v6.3.0, requiring Kubernetes v1.34 or later when upgrading from v1.10.x or v1.11.0.

• breakingKubernetes v1.34+ required when upgrading from v1.10.x or v1.11.0

  The bundled CSI external provisioner is bumped to v6.3.0, which requires Kubernetes v1.34 or later. If your cluster runs an older Kubernetes version and you are upgrading from Longhorn v1.10.x or v1.11.0, bring Kubernetes to v1.34+ first before applying this upgrade.