Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Sep 2026Clear ×

cert-managerv1.20.4SecurityTodaySep 16, 2026

ACTION 6OTHER 2View full analysis

A security-focused patch release fixes multiple dependency vulnerabilities and an ingress-shim defect. It also updates distroless base images and release-signing procedures.

Action needed (6)

securityhighThe golang.org/x/net, golang.org/x/text, and golang.org/x/crypto versions
golang.org/x/net is updated to v0.58.0, golang.org/x/text to v0.41.0, and golang.org/x/crypto to v0.55.0. The updates fix CVE-2026-46600, CVE-2026-56852, and CVE-2026-56854.
securityhighThe google.golang.org/grpc version and advisory fixes
google.golang.org/grpc is updated to v1.83.2 to fix CVE-2026-84304, CVE-2026-84445, CVE-2026-84303, GHSA-vp52-pcj8-j9qc, GHSA-2v4p-qf9q-27wj, and GHSA-hrxh-6v49-42gf.
securityThe Go version and standard library security fixes
Go is updated to 1.26.5 and then 1.26.6. These versions include security fixes for the go command and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages.
securitymediumThe github.com/google/cel-go version
github.com/google/cel-go is updated to v0.30.0 to fix the reported vulnerability GHSA-gcjh-h69q-9w9g.
securityThe security-scanned Go dependencies
golang.org/x/mod, go.opentelemetry.io/otel, and go.etcd.io/etcd/client/pkg/v3 are updated to versions flagged by security scanners.
securitymediumThe software.sslmate.com/src/go-pkcs12 version
software.sslmate.com/src/go-pkcs12 is updated to v0.7.2 to fix the reported vulnerability GHSA-mpwr-8vm7-h73f.

Source ↗

containerdapi/v1.12.0Kubernetes CoreTodaySep 16, 2026

PLAN 2OTHER 8View full analysis

A feature and maintenance release adds runtime and API capabilities while updating dependencies. It also deprecates two interfaces, with no disclosed security changes.

Plan ahead (2)

deprecatedcontainerd.io/runtime-allow-mounts shim annotation deprecation
deprecatedTask API address and version fields in runc options

Source ↗

Linkerdedge-26.9.3Networking & MessagingTodaySep 16, 2026

OTHER 1View full analysis

A maintenance release with a Linkerd proxy version update. It has no explicitly stated operator behavior change.

Source ↗

Keycloak26.7.4SecurityTodaySep 16, 2026

ACTION 4CHECK 2OTHER 6View full analysis

A security-heavy maintenance release with vulnerability fixes, alongside correctness and performance corrections. It also updates the Quarkus dependency.

Action needed (4)

securityhighCVE-2026-79651 and unbounded locale caching
CVE-2026-79651 fixes an unauthenticated denial-of-service issue caused by unbounded locale caching. The fix ships in this release.
securityhighCVE-2026-74909 and matrix parameter stripping
CVE-2026-74909 completes the fix for a percent-encoded semicolon bypass of matrix parameter stripping in PathMatcher. The fix ships in this release.
securityhighCVE-2026-17526 and the impersonation role
CVE-2026-17526 fixes privilege escalation involving the impersonation role impersonating a realm administrator. The fix ships in this release.
securitymediumCVE-2026-19607 and username takeover
CVE-2026-19607 fixes a username takeover issue that could lead to account lockout. The fix ships in this release.

Check if affected (2)

securityhighCVE-2026-18212 and SAML Redirect DEFLATE helpers
Applies if you use SAML Redirect.
securityCVE-2026-90997 and stateless replay gate row counts
Applies if you use MySQL/MariaDB.

Source ↗

Ciliumv1.20.2Networking & MessagingTodaySep 16, 2026

OTHER 65View full analysis

A maintenance release focused on correctness fixes, reliability improvements, dependency updates, and additive configuration and integration capabilities. It contains no disclosed vulnerability details.

Source ↗

Ciliumv1.19.8Networking & MessagingTodaySep 16, 2026

ACTION 1OTHER 49View full analysis

A maintenance release focused on correctness fixes and dependency updates, with a small number of new extension points. It does not introduce broad operator-facing configuration changes.

Action needed (1)

breakingRemoval of the Ingress HostFW Policy between RevSNAT and RevDNAT
The BPF NodePort path removes the Ingress HostFW Policy between RevSNAT and RevDNAT.

Source ↗

Ciliumv1.18.14Networking & MessagingTodaySep 16, 2026

ACTION 3OTHER 33View full analysis

A maintenance release focused on bug fixes, dependency updates, and image refreshes. It also removes a datapath behavior and includes security dependency fixes that may require operator attention.

Action needed (3)

securityThe google.golang.org/grpc module, updated to v1.83.1
The google.golang.org/grpc module is updated to v1.83.1 in this release as a security dependency fix.
securityThe google.golang.org/grpc module, updated to v1.83.2
The google.golang.org/grpc module is updated to v1.83.2 in this release as a security dependency fix.
breakingThe Ingress HostFW Policy between RevSNAT and RevDNAT, removed
The Ingress HostFW Policy between RevSNAT and RevDNAT is removed in this release.

Source ↗

Crossplanev2.4.1Orchestration & ManagementYesterdaySep 15, 2026

ACTION 3OTHER 2View full analysis

A maintenance release with a package-revision handoff fix and dependency security updates. It includes the gRPC advisory GHSA-2v4p-qf9q-27wj and refreshes the Go toolchain and related dependencies.

Action needed (3)

securityhighgoogle.golang.org/grpc update for GHSA-2v4p-qf9q-27wj
google.golang.org/grpc is updated to v1.83.2 to pick up upstream fixes, including advisory GHSA-2v4p-qf9q-27wj. The update ships with the release's dependency security refresh.
securityThe Go toolchain update
The Go toolchain is updated to 1.26.7 as part of the dependency security updates. The release also updates google.golang.org/grpc to v1.83.2, golang.org/x/crypto to v0.56.0, github.com/crossplane/crossplane/apis/v2 to v2.4.0, and refreshes the lock file.
securitygolang.org/x/crypto update
golang.org/x/crypto is updated to v0.56.0 as part of the dependency security updates. The same refresh updates the Go toolchain to 1.26.7, google.golang.org/grpc to v1.83.2, and refreshes the lock file.

Source ↗

Crossplanev2.3.6Orchestration & ManagementYesterdaySep 15, 2026

ACTION 2OTHER 2View full analysis

A maintenance release fixes package-revision handoff failures and updates security-sensitive dependencies. It adds no newly announced operator configuration requirements.

Action needed (2)

securityThe golang.org/x/crypto dependency update
The golang.org/x/crypto module is updated to v0.56.0 for a security-related dependency change.
securityThe google.golang.org/grpc dependency update
The google.golang.org/grpc module is updated to v1.83.2 for a security-related dependency change.

Source ↗

Crossplanev2.2.6Orchestration & ManagementYesterdaySep 15, 2026

ACTION 3OTHER 1View full analysis

A security-focused maintenance release with updates to the Go toolchain and dependencies for upstream CV fixes. Package-revision handoffs are also corrected so incoming revisions can take control of established objects without manual intervention.

Action needed (3)

securityhighThe google.golang.org/grpc update for GHSA-2v4p-qf9q-27wj
google.golang.org/grpc is updated to v1.83.2 to pick up upstream CVE fixes, including advisory GHSA-2v4p-qf9q-27wj. The updated dependency ships in this release.
securityThe Go toolchain security update
The Go toolchain is updated to 1.26.7 to pick up upstream CVE fixes. The lock file is also refreshed.
securityThe golang.org/x/crypto security update
golang.org/x/crypto is updated to v0.56.0 to pick up upstream CVE fixes. The updated dependency ships in this release.

Source ↗

Crossplanev1.20.13Orchestration & ManagementYesterdaySep 15, 2026

ACTION 2View full analysis

A security-focused maintenance release updates the Go toolchain and dependencies. It includes upstream vulnerability fixes, including a disclosed gRPC advisory.

Action needed (2)

securityhighgoogle.golang.org/grpc update and GHSA-2v4p-qf9q-27wj fixes
The release updates google.golang.org/grpc to v1.83.2 and includes a combined set of vulnerable dependency updates for upstream CVE fixes. This includes the gRPC advisory GHSA-2v4p-qf9q-27wj.
securityGo toolchain update to 1.26.7
The release bumps the Go toolchain to 1.26.7.

Source ↗

NATSv2.14.7Networking & MessagingYesterdaySep 15, 2026

OTHER 26View full analysis

A maintenance release focused on JetStream compatibility, performance improvements, and correctness fixes. It also updates the toolchain and dependencies, with no stated operator-breaking changes.

Source ↗

Backstagev1.55.0CI/CD & App DeliveryYesterdaySep 15, 2026

ACTION 6CHECK 6PLAN 1OTHER 213View full analysis

A broad feature and maintenance release adds scaffolder recovery and credential controls, TechDocs, notification and streaming capabilities, and Kubernetes and authentication improvements. It also includes dependency and tooling security updates, a security fix, and compatibility changes that affect users of the listed resolvers, catalog integrations, MCP configuration, and task recovery.

Action needed (6)

securityModule Federation dependency updates for security
This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.
securityYarn tooling dependency updates for security
This release updates the Yarn tooling dependencies to versions that avoid known security vulnerabilities.
securityModule Federation security dependency update
This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.
securityOpenAPI generator tooling security update
This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.
securityOpenAPI generator tooling security update
This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.
breakingLocale-insensitive Unicode casing
String handling now uses locale-insensitive Unicode casing for consistent results across environments.

Check if affected (6)

securityKubernetes catalog cluster locator URL validation
Applies if you use the catalog cluster locator.
securityPull request workspace handling security fix
Applies if you use pull request workspace handling.
breakingGitHub user ID catalog lookup matching
Applies if you use GitHub user ID catalog lookups.
+ 3 more on the release page

Plan ahead (1)

deprecatedGitHub username sign-in resolver deprecation
Applies if you use the GitHub username sign-in resolver.

Source ↗

CRI-Ov1.37.0Kubernetes CoreYesterdaySep 15, 2026

ACTION 2CHECK 4OTHER 32View full analysis

A substantial feature and compatibility release for operators, with changed defaults and interfaces alongside correctness and performance improvements. It also includes identified security fixes and refreshes a broad set of dependencies.

Action needed (2)

securityhighThe CVE-2026-15809 /etc/passwd injection fix
CRI-O fixes CVE-2026-15809, which allowed a bypass of the CVE-2022-4318 fix and /etc/passwd injection through newline characters in the HOME environment variable.
securityhighThe Go toolchain, updated to 1.26.4
The Go toolchain is updated to 1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

Check if affected (4)

breakingThe insecure_registries option and --insecure-registry flag, removed
Applies if you configure insecure_registries or use --insecure-registry.
breakingThe container_level_enabled default, changed to checkpoint_only
Applies if you do not configure container_level_enabled.
breakingThe gRPC message size defaults, reduced to 16 MiB
Applies if grpc_max_send_msg_size or grpc_max_recv_msg_size is not configured.
+ 1 more on the release page

Source ↗

Linkerdedge-26.9.2Networking & MessagingYesterdaySep 15, 2026

OTHER 18View full analysis

A maintenance release focused on dependency upgrades, including proxy-init and CNI components. It does not state changes to operator behavior.

Source ↗

Jaegerv2.21.0ObservabilitySep 14, 2026

ACTION 1CHECK 4OTHER 64View full analysis

A feature-rich release with breaking API and configuration changes, expanded experimental query and storage capabilities, and many correctness fixes. It also includes routine dependency updates.

Action needed (1)

breakingThe searchdepth constraint
Query handling caps searchdepth at 10000 and rejects negative values.

Check if affected (4)

breakingRemoval of the v1 http endpoints
Applies if you use v1 http endpoints.
breakingThe ai.enable_mcp configuration, replaced by ai.mcp
Applies if you configure ai.enable_mcp.
breakingElasticsearch configuration key validation
Applicability is not stated in the release notes.
+ 1 more on the release page

Source ↗

OpenTelemetryv0.161.0ObservabilitySep 14, 2026

ACTION 5CHECK 2OTHER 9View full analysis

A maintenance release with breaking removal of deprecated APIs alongside performance and correctness fixes. It also tightens feature-gate identifier validation and updates configuration schema handling.

Action needed (5)

breakingRemoval of deprecated AddScraper
The deprecated AddScraper function is removed from pkg/scraperhelper/controller.
breakingRemoval of deprecated ZapOptions
The deprecated ZapOptions configuration is removed from pkg/service.
breakingRemoval of deprecated WithForceUnmarshaler
The deprecated WithForceUnmarshaler function is removed from pkg/xconfmap.
breakingRemoval of deprecated DefaultMetricsBuilderConfig
The deprecated DefaultMetricsBuilderConfig function is removed from cmd/mdatagen.
breakingRemoval of deprecated LoggingOptions
The deprecated LoggingOptions configuration is removed from pkg/service.

Check if affected (2)

breakingRemoval of deprecated AggregationTemporality, Duration, and SetDuration
Applies if you use AggregationTemporality, Duration, or SetDuration.
breakingReplacement of deprecated configuration watcher APIs
Applies if you use extensioncapabilities.ConfigWatcher, Extensions.NotifyConfig, or service.Settings.CollectorConf.

Source ↗

Mesheryv1.0.70Provisioning & RuntimeSep 14, 2026

OTHER 7View full analysis

A maintenance release with dependency updates, CLI and UI defect fixes, and a changed meshsync resources summary format. It introduces no newly enforced operator requirements.

Source ↗

Flatcar Container Linuxstable-4757.2.0Provisioning & RuntimeSep 14, 2026

ACTION 41OTHER 56View full analysis

A security-focused maintenance release with extensive Linux and OpenSSH vulnerability remediation, broad dependency updates, and platform and image changes. Operators should account for the dropped platform and image support and the new Vagrant 2.2.5 requirement.

Action needed (41)

securitycriticalcontainerd vulnerability remediation
containerd is updated with remediation for CVE-2026-47262, CVE-2026-50195, CVE-2026-53488, CVE-2026-53489, and CVE-2026-53492.
securitycriticalgo vulnerability remediation
go is updated with remediation for the listed vulnerabilities, including CVE-2025-61726, CVE-2025-61727, and CVE-2025-61728.
securityhighbind vulnerability remediation
bind is updated with remediation for CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677.
securityhighglib vulnerability remediation
glib is updated with remediation for CVE-2025-13601 and CVE-2025-14087.
securityhighglibc vulnerability remediation
glibc is updated with remediation for CVE-2025-15281, CVE-2026-0861, and CVE-2026-0915.
securityhighgnutls vulnerability remediation
gnutls is updated with remediation for the listed vulnerabilities, including CVE-2025-14831, CVE-2025-9820, and CVE-2026-1584.
securityhighincus vulnerability remediation
incus is updated with remediation for CVE-2026-23953.
securityhighlibtasn1 vulnerability remediation
libtasn1 is updated with remediation for CVE-2025-13151.
securityhighnvidia-drivers vulnerability remediation
nvidia-drivers is updated with remediation for the listed vulnerabilities, including CVE-2025-33219, CVE-2025-33221, and CVE-2026-24182.
securityhighpodman vulnerability remediation
podman is updated with remediation for CVE-2025-52881 and CVE-2025-9566.
securityhighsssd vulnerability remediation
sssd is updated with remediation for CVE-2025-11561 and CVE-2026-6245.
securityhighurllib3 vulnerability remediation
urllib3 is updated with remediation for CVE-2025-66418 and CVE-2025-66471.
securityhighopenssh vulnerability remediation
openssh is updated with remediation for CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, and CVE-2026-60002.
securitymediumc-ares vulnerability remediation
c-ares is updated with remediation for CVE-2025-62408.
securityhighcurl vulnerability remediation
curl is updated with remediation for CVE-2025-13034, CVE-2025-14017, CVE-2025-14524, CVE-2025-14819, CVE-2025-15079, CVE-2025-15224, CVE-2026-1965, CVE-2026-3783, CVE-2026-3784, and CVE-2026-3805.
securitymediumlibarchive vulnerability remediation
libarchive is updated with remediation for CVE-2025-60753 and CVE-2026-4426.
securitymediumlibxml2 vulnerability remediation
libxml2 is updated with remediation for CVE-2026-0989, CVE-2026-0990, CVE-2026-0992, and CVE-2026-1757.
securitymediumlibxslt vulnerability remediation
libxslt is updated with remediation for CVE-2025-10911 and CVE-2025-11731.
securitymediump11-kit vulnerability remediation
p11-kit is updated with remediation for CVE-2026-2100.
securityhighrsync vulnerability remediation
rsync is updated with remediation for the listed vulnerabilities, including CVE-2025-10158, CVE-2026-29518, and CVE-2026-41035.
securitymediumutil-linux vulnerability remediation
util-linux is updated with remediation for CVE-2025-14104 and CVE-2026-27456.
securitylowintel-microcode vulnerability remediation
intel-microcode is updated with remediation for CVE-2025-31648.
securitylowlibpcap vulnerability remediation
libpcap is updated with remediation for CVE-2025-11961 and CVE-2025-11964.
securitycriticalLinux vulnerability remediation
Linux is updated with remediation for the listed vulnerabilities, including CVE-2026-80888 and the other advisories recorded for this change.
securityhighbubblewrap vulnerability remediation
bubblewrap is updated with remediation for CVE-2026-41163.
securitymediumexpat vulnerability remediation
expat is updated with remediation for CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-41080, and CVE-2026-45186.
securityhighgnupg vulnerability remediation
gnupg is updated with remediation for CVE-2026-24881, CVE-2026-24882, and CVE-2026-24883.
securitymediumlibcap vulnerability remediation
libcap is updated with remediation for CVE-2026-4878.
securitymediumlibgcrypt vulnerability remediation
libgcrypt is updated with remediation for CVE-2026-41989.
securityhighopenssh vulnerability remediation
openssh is updated with remediation for CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, and CVE-2026-35414.
securitycriticalopenssl vulnerability remediation
openssl is updated with remediation for the listed vulnerabilities, including CVE-2026-2673, CVE-2026-28386, and CVE-2026-28387.
securitylowrunc vulnerability remediation
runc is updated with remediation for CVE-2026-41579.
securitymediumsystemd vulnerability remediation
systemd is updated with remediation for CVE-2026-40223, CVE-2026-40225, and CVE-2026-40226.
securitylowxz-utils vulnerability remediation
xz-utils is updated with remediation for CVE-2026-34743.
securitylowzlib vulnerability remediation
zlib is updated with remediation for CVE-2026-27171.
breakingEquinix Metal (Packet) support removal
Support for Equinix Metal (Packet) is dropped.
breakingRackspace support removal
Support for Rackspace, including OnMetal, is dropped.
breakingThe Oklo release codename, removed
The Oklo release codename is dropped.
breakingVMware "insecure" image removal
The VMware "insecure" image is dropped.
breakingVagrant VirtualBox image removal
The Vagrant VirtualBox image is dropped.
breakingVagrant 2.2.5 requirement
Vagrant 2.2.5 is now required.

Source ↗

Argov3.5.3CI/CD & App DeliverySep 14, 2026

OTHER 11View full analysis

A maintenance release focused on correcting health reporting, repository and synchronization behavior, UI issues, and recovery panics. It also documents signed release assets and provenance for container images and CLI binaries.

Source ↗

Argov3.4.9CI/CD & App DeliverySep 14, 2026

OTHER 9View full analysis

A maintenance bug-fix release addresses health reporting, repository cleanup, synchronization state, and UI behavior. It introduces no new operator-facing capabilities or breaking changes.

Source ↗

Dragonflyv2.5.2Storage & DataSep 14, 2026

OTHER 1View full analysis

A small maintenance release strengthens the default password-hashing cost with bcrypt. Nothing else here needs operator attention.

Source ↗

OpenCostv1.121.2ObservabilitySep 11, 2026

OTHER 16View full analysis

A maintenance release with pricing enhancements, operational fixes, dependency updates, and changed pricing-data behavior. It contains no stated security changes.

Source ↗

Backstagev1.54.7CI/CD & App DeliverySep 11, 2026

OTHER 1View full analysis

A minor maintenance release improves OAuth profile normalization when processing email verification information. It does not introduce an operator-facing configuration or behavior change.

Source ↗

cert-managerv1.21.2SecuritySep 11, 2026

ACTION 6CHECK 1OTHER 12View full analysis

A maintenance release focused on correctness and data-exposure fixes. It also includes security-related dependency updates and a stricter default for namespaced Vault authentication.

Action needed (6)

securityACME server response body limit
ACME server response bodies are capped at 16 MiB to prevent unbounded-body denial-of-service conditions.
securityChallenge.status.reason response disclosure fix
The ACME HTTP-01 self-check no longer copies the fetched response body into Challenge.status.reason. This prevents internal response contents reached through redirects from being disclosed.
securityGo 1.26.6
The release upgrades Go to 1.26.6, which includes security fixes in the Go command and several standard library packages.
securitygoogle.golang.org/grpc v1.83.2
The release updates google.golang.org/grpc to v1.83.2 to fix reported security vulnerabilities.
securitygolang.org/x/crypto v0.56.0
The release updates golang.org/x/crypto to v0.56.0 to fix reported security vulnerabilities.
breakingValidation for converted AdmissionReview requests
Validation now also applies to equivalent-converted AdmissionReview requests on non-v1 API versions. These requests could previously bypass validation.

Check if affected (1)

breakingNamespaced Vault issuer ambient credentials default
Applies if you use a namespaced Issuer with Vault AWS IAM authentication.

Source ↗

gRPCv1.84.0Networking & MessagingSep 11, 2026

ACTION 2OTHER 4View full analysis

A maintenance release that enables gRPC capabilities and observability, broadens xDS matching, removes a WRR guard, and corrects proxy hostname handling. It also updates connection scaling service configuration and server listener matching.

Action needed (2)

breakingThe v2_non_owning_waker_implementation experiment enabled
The v2_non_owning_waker_implementation experiment is enabled in the promise-based filter.
breakingThe WRR custom backend metrics guard removed
The release removes the WRR environment-variable guard for custom backend metrics.

Source ↗

OpenFeaturecore/v0.17.0CI/CD & App DeliverySep 10, 2026

ACTION 1OTHER 4View full analysis

A feature-oriented release expands FIPS, HTTP, and SSE support and makes file polling configurable. It also includes a security-related update to the gRPC dependency.

Action needed (1)

securityThe google.golang.org/grpc dependency, updated to v1.83.1
The google.golang.org/grpc module is updated to v1.83.1 in the core release.

Source ↗

OpenFeatureflagd-proxy/v0.9.9CI/CD & App DeliverySep 10, 2026

ACTION 2OTHER 1View full analysis

A security-focused maintenance release updates gRPC and resolves dependency alerts. It also adds an additional FIPS 140-3 mode.

Action needed (2)

securityThe google.golang.org/grpc module, updated to v1.83.1
The google.golang.org/grpc module is updated to v1.83.1 in this release.
securityDependabot security alerts resolved
Open Dependabot security alerts are resolved in this release.

Source ↗

OpenFeatureflagd/v0.16.3CI/CD & App DeliverySep 10, 2026

ACTION 1OTHER 4View full analysis

A feature-focused release adds FIPS 140-3, HTTP and SSE capabilities, and changes OFREP ETag behavior. It also updates gRPC for an undisclosed security fix.

Action needed (1)

securityThe google.golang.org/grpc module update
The google.golang.org/grpc module is updated to v1.83.1 for an undisclosed security fix.

Source ↗

Daprv1.17.14Orchestration & ManagementSep 10, 2026

OTHER 1View full analysis

A corrective maintenance release restores concurrent dispatch for pluggable pub/sub subscriptions. It preserves acknowledgement behavior during graceful shutdown.

Source ↗

Daprv1.16.20Orchestration & ManagementSep 10, 2026

OTHER 3View full analysis

A bug-fix release addresses Placement recovery, actor locking, and serialized pluggable pub/sub delivery. It requires no new operator configuration.

Source ↗

Kyvernov1.19.1SecuritySep 10, 2026

ACTION 2CHECK 3OTHER 22View full analysis

A security-focused maintenance release with dependency updates and fixes for policy and egress behavior. It also includes correctness changes, deprecation warning enforcement, and a narrowed policy constraint that may require operator changes.

Action needed (2)

securitycriticalGo and x/net updates for CVE-2026-39821
The release updates Go to 1.26.6 and x/net to resolve CVE-2026-39821.
securityhighGo update for CVE-2026-56853
The release updates Go to address CVE-2026-56853.

Check if affected (3)

securityPolicyException scope bypass fix for GHSA-5cjf-wwfg-pj4c
Applies if you use the PolicyException CRD.
securityapiCall.service egress blocklist bypass fix
Applies if you configure apiCall.service egress.
breakingglobalContext constraint in namespaced policies
Applies if you use globalContext in namespaced policies.

Source ↗

Helmv4.3.0Kubernetes CoreSep 9, 2026

ACTION 3CHECK 1OTHER 52View full analysis

A feature release adding new Helm capabilities and output options, alongside correctness fixes and performance improvements. It also includes dependency updates with two disclosed security-related bumps.

Action needed (3)

securitycriticalgolang.org/x/net update for GO-2026-5026
Helm updates golang.org/x/net to v0.55.0 to address GO-2026-5026.
securitymediumgo.opentelemetry.io/otel update for GO-2026-5158
Helm updates go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158.
breakingPer-file decompression size limit removal
Helm removes the per-file decompression size limit from file decompression.

Check if affected (1)

breakingOwnership verification before resource deletion
Applicability is not stated in the release notes.

Source ↗

Daprv1.18.4Orchestration & ManagementSep 9, 2026

ACTION 1OTHER 18View full analysis

A workflow-heavy maintenance release corrects reliability, state-management, signing, and pub/sub delivery defects. It also changes binary gRPC metadata filtering for output bindings, with no newly announced operator configuration requirements.

Action needed (1)

breakingBinary gRPC metadata propagation in InvokeBinding, removed
Binary gRPC metadata with keys ending in -bin is no longer copied from incoming gRPC calls into output binding component metadata for InvokeBinding.

Source ↗

Kubescapev4.0.14SecuritySep 9, 2026

OTHER 25View full analysis

A feature-rich maintenance release that adds fleet controls, filtering, new rules, and machine-readable errors. It also corrects scan, reporting, shutdown, and dependency issues, with no stated security fixes or operator action required.

Source ↗

wasmCloudv2.9.0Orchestration & ManagementSep 8, 2026

ACTION 1PLAN 1OTHER 23View full analysis

A feature release that adds plugin, runtime, concurrency, and observability capabilities. It also corrects runtime defects and enforces guest-memory limits.

Action needed (1)

breakingThe max-guest-memory limit is enforced
This release enforces the max-guest-memory limit.

Plan ahead (1)

deprecatedThe deprecated --enable-meters flag alias

Source ↗

OpenFGAv1.20.0SecuritySep 8, 2026

ACTION 1OTHER 1View full analysis

A maintenance release updates the Go toolchain and images to address a security advisory. It also fixes a ListUsers deadlock that could cause timeouts with partial results.

Action needed (1)

securitycriticalGo toolchain and images at go1.26.8
The Go toolchain and images are upgraded to use go1.26.8, addressing CVE-2026-39821 and Go advisory GO-2026-5026.

Source ↗

metal3-iov0.14.0Provisioning & RuntimeSep 8, 2026

ACTION 1PLAN 1OTHER 55View full analysis

A feature-rich release with breaking changes, new controllers, and expanded provisioning capabilities. It also includes correctness fixes and broad dependency updates.

Action needed (1)

breakingThe separate TryInit call, removed
Provisioner no longer makes a separate TryInit call in this release.

Plan ahead (1)

deprecatedThe BMH Taints field, deprecated

Source ↗

Prometheusv3.13.3ObservabilitySep 7, 2026

ACTION 1OTHER 7View full analysis

A maintenance release with security-related dependency updates and correctness fixes across shutdown handling, query matching, service discovery, and TSDB reliability. No configuration or default changes are stated.

Action needed (1)

securityhighSecurity updates for github.com/klauspost/compress and golang.org/x/crypto
The release updates github.com/klauspost/compress to v1.18.7 for GO-2026-5841 and golang.org/x/crypto to v0.55.0 for GO-2026-6303.

Source ↗

Contourv1.33.7Networking & MessagingSep 7, 2026

ACTION 3OTHER 1View full analysis

A security maintenance release updates Envoy, Go, and other dependencies to address CVEs. It is tested against Kubernetes 1.32 through 1.34, with no stated operator configuration changes.

Action needed (3)

securityThe Envoy version, updated to v1.38.4
Envoy is updated to v1.38.4 to address CVEs. The update ships in this release.
securityThe Go version, updated to 1.26.8
Go is updated to 1.26.8 to address CVEs. The update ships in this release.
securityDependency updates for CVE fixes
Dependencies are updated to address CVEs. The dependency updates ship in this release.

Source ↗

Sep 16, 2026 – Sep 7, 2026Older →

Browse by month