AI-analyzed release notes for CNCF graduated and incubating projects.
This release contains routine correctness fixes and a security fix in the server. The security change concerns users of the SSD CLI.
Action needed (1)
securitySSD CLI secret-mask spoofing prevention
The server prevents secret-mask spoofing in the SSD CLI. This fix ships in Argo CD v3.5.1.
A maintenance release with correctness fixes, a server-side secret-mask spoofing fix, and a third-party dependency update. Ordinary fixes and the dependency update require no operator action, while upgrading addresses the security fix.
Action needed (1)
securitySSD CLI secret-mask spoofing prevention
The server now prevents secret-mask spoofing in the SSD CLI. This fix ships in the 3.4 release line.
A maintenance release with fixes for secret masking and pprof endpoint configuration, alongside dependency updates for two listed CVEs. The secret-handling fixes and dependency updates are addressed by upgrading, while the remaining defect fixes require no operator action.
Action needed (2)
securityhighThe /ui brace-expansion dependency update for CVE-2026-69152
The /ui dependency brace-expansion is updated to 2.1.4 and 1.1.18 for CVE-2026-69152.
securitymediumThe DOMPurify dependency update for CVE-2026-49978
The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.
Check if affected (2)
securitySSD CLI secret mask spoofing prevention
Applies if you use SSD CLI.
securitySecret hiding in the last-applied-configuration annotation
Applies if you configure last-applied-configuration.
A feature and maintenance release with expanded metadata, migration, storage-pool, learner, self-healing, proximity-read, and RocksDB capabilities. Operators need to follow the stated upgrade order and prerequisites; the release also contains corrective fixes, with no security advisories or explicit security flaws disclosed.
Source ↗A corrective and performance-focused release with operator-visible default and constraint changes, deprecated flag removal, and dependency vulnerability fixes. It also expands scanning, output, registry, and MCP capabilities.
Action needed (3)
securityBatch dependency vulnerability fixes
Batch 1 and 2 dependency vulnerability fixes are included in this release.
breakingRegoV1 evaluation and v0 compatibility shim removal
Rego evaluation now uses RegoV1 and drops the v0 compatibility shim in this release.
breakingLoopback-only constraint
A loopback-only constraint is applied in this release.
Check if affected (3)
breakingOpt-in pprof debug server
Applies if you enable the pprof debug server.
breaking--frameworks default set to all
Applies if you do not configure --frameworks.
breakingDeprecated flags removal
Applies if you configure deprecated flags.
wasmCloud v2.7.0 adds runtime, networking, plugin, TLS, and chart capabilities while correcting runtime and Helm/chart defects. It also changes defaults and updates dependencies.
Action needed (1)
breakingDefault-enabled implements and maps
implements and maps are enabled by default in wasmCloud v2.7.0.
OpenKruise v1.8.5 corrects nodeimage TTL cleanup so setting completionPolicy. does not delete the job itself. It adds the default-ttlseconds-for-always-nodeimage flag for kruise-controller-manager to control nodeimage data TTL.
This release updates dependencies associated with published security advisories. Builders created with the pack CLI from this release contain lifecycle v0.21.0 by default.
Action needed (3)
securityhighThe github. dependency update
github. updates from v5.19.1 to v5.19.2 in buildpacks v0.40.9. The release note cites GHSA-hc8v-wwc9-vgxm.
securitymediumThe go. dependency update
go. updates from v1.43.0 to v1.44.0 in buildpacks v0.40.9. The release note cites GO-2026-5158 and CVE-2026-41178 for a baggage header that was not length-capped.
securityThe github. dependency update
github. updates from v1.18.6 to v1.18.7 in buildpacks v0.40.9. The release note cites GO-2026-5841 and GHSA-259r-337f-4rfw for an out-of-bounds read in s2.
A maintenance release with correctness fixes that narrow some existing configuration constraints. It also adds CLI repository migration support and updates dependencies; no explicit security advisory or vulnerability is disclosed.
Check if affected (3)
breakingThe image-automation-controller refspec constraint
Applies if you configure refspecs.
breakingGCS static authentication limited to service account keys
Applies if you configure GCS static authentication.
breakingThe allow-webhooks network policy restriction
Applies if you configure allow-webhooks.
This release contains a security-related build toolchain update and an input-binding startup fix. The probe timeout is configurable for applications with slow startup.
Action needed (1)
securityThe Go toolchain version, updated to 1.
The Go version used to build Dapr is updated from 1. to 1. across the runtime, build tooling, and container images.
This release adds new inference-service, storage, runtime, routing, and deployment capabilities, alongside correctness fixes and dependency updates. Operators should review the Starlette security update, changed defaults, and narrower readiness behavior.
Action needed (2)
securitymediumstarlette dependency update for CVE-2026-48710
The starlette dependency is bumped to >=1. for CVE-2026-48710.
breakingStandard default alignment with the llm-d optimized baseline
The standard default is aligned with the llm-d optimized baseline.
Check if affected (7)
breakinglora-affinity-scorer default for LoRA adapters
Applies if you use LoRA adapters.
breakingLLMInferenceServiceConfig deletion-prevention finalizer
Applies if you use LLMInferenceServiceConfig.
breakingendpointPickerRef default EPP port
Applies if you configure endpointPickerRef and do not configure port.
OpenFGA v1.18.3 includes a correctness fix for an experimental graph check. No operator-facing change details are included in the recorded release items.
Source ↗A maintenance release with security fixes and additional bug fixes. The security fixes require upgrading, and the ordinary bug fixes require no operator action beyond upgrading.
Check if affected (12)
securityhighCVE-2026-15573 unnormalized URI matching in pathmatcher
Applies if you use pathmatcher.
securityhighCVE-2026-15572 DCR protocol mapper type-swap policy
Applies if you use DCR.
securityhighCVE-2026-16442 SAML broker login restriction
Applies if you use the SAML broker.
Version 1.15.0 adds authentication, TLS, GraphQL, configuration, and UI capabilities, alongside fixes for correctness defects. It also updates shipped container and frontend dependencies, with no disclosed security advisories or security-specific fixes.
Source ↗OpenCost v1.121.1 adds opt-in Athena query-result reuse configuration and NAT gateway cost metrics to OpenCost scrapes, and updates the Kubernetes dependency to k8s. 0.36.3. Athena result reuse applies only to query engine v3, has no effect on v2 workgroups, and AWS limits MaxAgeInMinutes to 10080 minutes. No security advisories or security fixes are disclosed.
OpenTelemetry v0.158.0 adds a replacement processor and configuration-schema capabilities, along with changes to component maturity and several defect corrections. It also removes the pkg/xconfmap validation API in favor of symbols in confmap.
Check if affected (1)
breakingThe pkg/xconfmap validation symbols, renamed
Applies if you use pkg/xconfmap's Validator or Validate symbols.
A maintenance release focused on operator-facing bug fixes, with additional feature and configuration work. It also includes dependency updates, including a UI dependency update for CVE-2026-41240.
Action needed (3)
securitymediumThe redoc/dompurify dependency update for CVE-2026-41240
The UI dependency redoc/dompurify is bumped to v3.4.0 to fix CVE-2026-41240.
securityThe formidable dependency update
The formidable dependency is updated to v2.1.3.
breakingThe auto-sync toggle removal from the app top bar
The auto-sync toggle is removed from the app top bar.
Check if affected (1)
breakingThe theme default changed to auto
Applies if theme is not configured.
This release fixes user-namespace UID/GID restoration after CRI-O restart, reduces debug-log verbosity for List* RPC calls, and restores pre-1.34 handling of environment-variable values containing non-UTF-8 data. It also updates or removes dependencies listed in the dependency manifest.
CRI-O v1.34.11 includes a correctness fix that restores prior handling of environment-variable values containing non-UTF-8 data. No detailed change item is provided here.
Source ↗This cri-o release includes a fix for a disclosed security vulnerability alongside runtime behavior, monitoring configuration, metric, and dependency updates. It is most relevant to deployments affected by the HOME environment-variable issue or the related observability and CNI configuration changes.
Action needed (1)
securityhighCVE-2026-15809 HOME environment-variable injection fix
cri-o v1.36.3 fixes CVE-2026-15809. The vulnerability allowed a bypass of the CVE-2022-4318 fix, enabling /etc/passwd injection through newline characters in the HOME environment variable.
Linkerd edge-26.8.1 updates third-party dependencies and the Linkerd proxy component. No security advisories or operator action are identified for this release.
Source ↗A maintenance release with diagnostic logging, experimental cache metric changes, and corrections for weighted-graph and tuple-validation defects. It also updates the Go toolchain and embedded grpc-health-probe in released images.
Action needed (1)
securityhighgrpc-health-probe rebuilt at v0.
The embedded grpc-health-probe is rebuilt with Go 1.26.5 and bumped to v0. in released images. The update addresses the Go standard library vulnerabilities documented in the Go 1.26.5 release notes, including CVE-2026-39822.
