RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Crossplanev2.3.0Orchestration & ManagementMay 21, 2026
ACTION 14CHECK 3OTHER 20View full analysis

Crossplane v2.3.0 combines breaking API naming and path changes with new operator capabilities and correctness fixes. It also updates several Go dependencies and the Go toolchain, which matters to API consumers and builds that depend on the affected packages.

Action needed (14)

  • securityThe github.com/cloudflare/circl dependency, updated to v1.6.3

    The github.com/cloudflare/circl module is updated to v1.6.3 in Crossplane v2.3.0.

  • securityThe google.golang.org/grpc dependency, updated to v1.79.3

    The google.golang.org/grpc module is updated to v1.79.3 in Crossplane v2.3.0.

  • securityThe go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency, updated to v1.43.0

    The go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp module is updated to v1.43.0 in Crossplane v2.3.0.

  • securityThe github.com/go-git/go-git/v5 dependency, updated to v5.17.1

    The github.com/go-git/go-git/v5 module is updated to v5.17.1 in Crossplane v2.3.0.

  • securityThe github.com/go-jose/go-jose/v4 dependency, updated to v4.1.4

    The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Crossplane v2.3.0.

  • securityThe github.com/sigstore/cosign/v3 dependency, updated to v3.0.5

    The github.com/sigstore/cosign/v3 module is updated to v3.0.5 in Crossplane v2.3.0.

  • securityThe github.com/docker/cli dependency, updated to v29.2.0+incompatible

    The github.com/docker/cli module is updated to v29.2.0+incompatible in Crossplane v2.3.0.

  • securityThe github.com/sigstore/timestamp-authority/v2 dependency, updated to v2.0.6

    The github.com/sigstore/timestamp-authority/v2 module is updated to v2.0.6 in Crossplane v2.3.0.

  • securityThe Go toolchain, updated to 1.25.9

    The Go toolchain is updated to 1.25.9 in Crossplane v2.3.0.

  • securityThe github.com/moby/spdystream dependency, updated to v0.5.1

    The github.com/moby/spdystream module is updated to v0.5.1 in Crossplane v2.3.0.

  • securityThe github.com/go-git/go-git/v5 dependency, updated to v5.18.0

    The github.com/go-git/go-git/v5 module is updated to v5.18.0 in Crossplane v2.3.0.

  • securityThe github.com/in-toto/in-toto-golang dependency, updated to v0.11.0

    The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in Crossplane v2.3.0.

  • securityThe golang.org/x/net dependency, updated to v0.53.0

    The golang.org/x/net module is updated to v0.53.0 in Crossplane v2.3.0.

  • securityThe Go toolchain, updated to 1.25.10

    The Go toolchain is updated to 1.25.10 in Crossplane v2.3.0 to fix standard library CVEs.

Check if affected (3)

  • breakingThe Crossplane API dependency path, renamed

    Applies if you build external consumers of Crossplane APIs.

  • breakingThe common API package, moved

    Applies if you use the common APIs from crossplane-runtime.

  • breakingThe v1.Resource* types, renamed

    Applies if you use the old v1.Resource* types.

Source ↗
KServev0.17.1AI & MLMay 21, 2026
OTHER 2View full analysis

KServe v0.17.1 is a maintenance release with operator-facing corrections and updated release-version metadata. It includes fixes related to installation scripts and the Helm chart, with no disclosed security advisories or security-specific fixes.

Source ↗
Linkerdedge-26.5.3Networking & MessagingMay 21, 2026
OTHER 3View full analysis

This Linkerd edge release updates the OpenSSL and tower-http dependencies and ships Linkerd proxy version 2.353.0. No functional changes, security advisories, or operator actions are identified.

Source ↗
containerdv2.2.4Kubernetes CoreMay 20, 2026
ACTION 2OTHER 8View full analysis

A maintenance release with security updates, including a dependency update tied to an advisory. It also includes compatibility and runtime changes across storage, policy, sandbox, validation, and toolchain areas.

Action needed (2)

Source ↗
wasmCloudv2.2.0Orchestration & ManagementMay 20, 2026
OTHER 9View full analysis

wasmCloud v2.2.0 adds runtime, CLI, routing, API, and interface-publishing capabilities and corrects handling for musl-on-glibc systems. The release notes provided here disclose no security changes or operator actions.

Source ↗
containerdv2.0.9Kubernetes CoreMay 20, 2026
ACTION 1CHECK 1OTHER 7View full analysis

A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.

Action needed (1)

Check if affected (1)

  • breakingThe default seccomp socket policy

    Applies if you use seccomp.

Source ↗
containerdv1.7.32Kubernetes CoreMay 20, 2026
ACTION 1OTHER 5View full analysis

containerd v1.7.32 includes a disclosed security advisory alongside correctness and compatibility fixes. The release concerns users assessing security exposure or changes in runtime and configuration behavior.

Action needed (1)

Source ↗
containerdv2.3.1Kubernetes CoreMay 20, 2026
ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

  • securityhighCVE-2026-46680 correction

    The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

  • breakingThe overlayfs "rebase" capability, disabled in user namespaces

    Applies if you use overlayfs and run in a user namespace.

Plan ahead (1)

  • deprecatedTask fields in Runc options, deprecated

    Applies if you configure task fields in Runc options.

Source ↗
OpenFGAv1.16.0SecurityMay 20, 2026
ACTION 1OTHER 6View full analysis

Release v1.16.0 adds datastore timeout configuration and additional tracing output. It also fixes defects in experimental weighted_graph_check and OIDC authentication, and updates the Go toolchain for standard-library vulnerability fixes.

Action needed (1)

  • securityThe Go toolchain, updated to 1.26.3

    The toolchain now uses Go version 1.26.3 to address vulnerabilities in the Go standard library. This update ships in v1.16.0.

Source ↗
containerdapi/v1.11.1Kubernetes CoreMay 20, 2026
OTHER 1View full analysis

This containerd release corrects a defect in sandbox task API endpoints for non-runc runtimes. The recorded release material identifies the fix in the highlights and overview.

Source ↗
NATSv2.14.1Networking & MessagingMay 20, 2026
OTHER 44View full analysis

NATS v2.14.1 is a maintenance release with dependency and toolchain updates, monitoring additions, behavioral improvements, and correctness fixes. The release has no security advisories or explicitly described security vulnerabilities.

Source ↗
NATSv2.12.9Networking & MessagingMay 20, 2026
OTHER 48View full analysis

NATS v2.12.9 adds monitoring metrics and broadens acceptance of client TLS certificates with DNS subject alternate names. It also changes several operational behaviors, improves performance, and fixes defects across General, Leafnode, JetStream, Raft, storage, and MQTT functionality. No security advisories or explicitly security-related fixes are disclosed.

Source ↗
Emissary-Ingressv4.1.0Networking & MessagingMay 19, 2026
OTHER 2View full analysis

Emissary v4.1.0 updates the Envoy dependency from 1.36.2 to 1.37.2. It also fixes stale cached entries when an empty-delta snapshot is received, addressing the Istio mTLS certificate-rotation failure described in #4744.

Source ↗
Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026
ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

  • securityModule Federation packages at v2.3.3

    Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.

  • breakingThe @remixicon/react version constraint

    The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

  • securitySpecific defaults for known MCP clients

    Applies if you configure CIMD or DCR.

  • breakingThe NavItemBlueprint API, removed

    Applies if you use NavItemBlueprint.

  • breakingSidebar and legacy nav-item rendering in renderInTestApp

    Applies if you use renderInTestApp.

  • + 6 more on the release page

Plan ahead (4)

  • deprecatedThe PolicyQueryUser.identity field, deprecated

    Applies if you use PolicyQueryUser.identity.

  • deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias

    Applies if you configure EXPERIMENTAL_formDecorators.

  • deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated

    Applies if you configure catalog.stitchingStrategy.mode.

  • + 1 more on the release page
Source ↗
OpenTelemetryv0.152.1ObservabilityMay 19, 2026
CHECK 2PLAN 1OTHER 7View full analysis

A maintenance release that adds exporter in-flight request monitoring and configuration-validation APIs while correcting runtime and configuration behavior. It also changes Prometheus telemetry defaults for explicitly configured metrics and deprecates older validation APIs.

Check if affected (2)

  • breakingThe max_request_body_size limit for snappy requests

    Applies if you configure max_request_body_size.

  • breakingPrometheus exporter defaults for explicitly configured telemetry

    Applies if you configure the telemetry metrics section.

Plan ahead (1)

  • deprecatedThe xconfmap.Validator and confmap.Validate APIs

    Applies if you use xconfmap.Validator or confmap.Validate.

Source ↗
SPIREv1.15.0SecurityMay 19, 2026
OTHER 26View full analysis

SPIRE v1.15.0 adds operator capabilities, changes CLI and output behavior, and updates dependencies. It also fixes correctness issues, with no security advisory or vulnerability disclosed.

Source ↗
Keycloak26.6.2SecurityMay 19, 2026
ACTION 6CHECK 12OTHER 13View full analysis

A maintenance release with numerous disclosed security fixes, dependency updates, enhancements, and bug fixes. It also corrects forced object deletion during the operator upgrade path.

Action needed (6)

  • securityhighCVE-2026-33871: HTTP/2 CONTINUATION frame flood denial of service

    The release fixes the HTTP/2 CONTINUATION frame flood denial-of-service issue identified by CVE-2026-33871.

  • securityhighCVE-2026-33870: HTTP request smuggling through chunked extension parsing

    The release corrects the HTTP request smuggling primitive caused by chunked extension quoted-string parsing, identified by CVE-2026-33870.

  • securityhighBouncycastle updates for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598

    The release updates bouncycastle for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598.

  • securityhighCVE-2026-7504: Redirect URI validation bypass

    The release corrects the redirect URI validation bypass in Keycloak, identified by CVE-2026-7504.

  • securitymediumCVE-2026-5588: Bouncy Castle bcpkix cryptographic algorithm vulnerability

    The release updates the bcpkix modules affected by the broken or risky cryptographic algorithm vulnerability in the Bouncy Castle Crypto Package for Java, identified by CVE-2026-5588.

  • securityPermission and policy call ordering in admin/api

    The release corrects the ordering of permission and policy calls in admin/api that led to exposure of a client ID.

Check if affected (12)

Source ↗
hamiv2.9.0AI & MLMay 19, 2026
ACTION 3CHECK 3OTHER 59View full analysis

A feature and maintenance release that adds HAMi-core, Ascend and vNPU virtualization, DRA, CDI, monitoring, metrics, deployment, and debugging capabilities. It also includes scheduling, allocation, device, chart, and compatibility fixes, security updates, dependency upgrades, and removal of a deprecated scheduler policy ConfigMap.

Action needed (3)

  • securityThe tensorflow/tensorflow dependency, upgraded

    The tensorflow/tensorflow dependency was upgraded from 2.20.0rc0-gpu to 2.21.0rc0-gpu in this release.

  • securityThe tensorflow/tensorflow dependency, upgraded again

    The tensorflow/tensorflow dependency was upgraded from 2.21.0rc0-gpu to 2.21.0rc1-gpu in this release.

  • securityThe golang dependency, upgraded

    The golang dependency was upgraded for a security issue in this release.

Check if affected (3)

  • breakingThe deprecated scheduler policy configmap, removed

    Applies if you configure scheduler policy configmap.

  • breakingThe Helm nvidia.overwriteEnv default

    Applies if you use Helm.

  • breakingHost networking for the device plugin, disabled

    Applies if the device plugin runs.

Source ↗
hamiv2.8.3AI & MLMay 19, 2026
OTHER 3View full analysis

HAMi v2.8.3 is a bug-fix release. It addresses GPU memory information handling, HAMi-core monitoring, and device utilization watcher startup behavior.

Source ↗
OpenCostv1.120.2ObservabilityMay 18, 2026
ACTION 1CHECK 2OTHER 40View full analysis

A maintenance release with dependency updates, operator-visible configuration and behavior changes, new integrations and capabilities, and correctness fixes. It also includes an explicitly disclosed security-related Go dependency upgrade.

Action needed (1)

Check if affected (2)

  • breakingThe provider config source, changed

    Applies if you configure provider config.

  • breakingThe MCP_SERVER_ENABLED default, changed to false

    Applies if you use the MCP server.

Source ↗
Istio1.30.0Networking & MessagingMay 18, 2026
ACTION 1CHECK 1OTHER 33View full analysis

A feature release adds Gateway API, ambient-mode, telemetry, Helm, and operability capabilities. Authenticated XDS debug endpoints and the new default image registry are the changes most likely to affect deployment and operational configuration.

Action needed (1)

  • breakingDefault Istio image registry

    The default registry for Istio images is now registry.istio.io.

Check if affected (1)

  • breakingAuthentication required for XDS debug endpoints

    Applies if ENABLE_DEBUG_ENDPOINT_AUTH is set.

Source ↗
Istio1.29.3Networking & MessagingMay 18, 2026
ACTION 1CHECK 2OTHER 6View full analysis

A maintenance release adds Gateway API compatibility, analyzer and HBONE tuning capabilities, and fixes certificate, controller, probe, output, and authorization issues. The authorization fixes address cross-namespace configuration access and regex handling in AuthorizationPolicy.

Action needed (1)

  • securityCross-namespace access to istio.io/debug/syncz and istio.io/debug/config_dump

    Authorization is fixed so an authenticated workload cannot enumerate proxies or retrieve configuration dumps for workloads in other namespaces through istio.io/debug/syncz and istio.io/debug/config_dump.

Check if affected (2)

  • securityRegex handling in AuthorizationPolicy identity fields

    Applicability is not stated in the release notes.

  • breakingThe AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE setting and kubelet health probes

    Applies when ambient mesh pods run on AWS EKS and use Security Groups for Pods (branch ENI).

Source ↗
Istio1.28.7Networking & MessagingMay 18, 2026
ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release that adds Gateway API v1.4.1 support and new diagnostics and configuration controls while fixing several correctness issues. It also includes two described security fixes for XDS debug endpoint authorization and regex handling in AuthorizationPolicy.

Action needed (1)

  • securitySame-namespace authorization for StatusGen XDS debug endpoints

    The StatusGen-served XDS debug endpoints istio.io/debug/syncz and istio.io/debug/config_dump now enforce same-namespace authorization for non-system callers. Authenticated workloads can no longer enumerate proxies or retrieve configuration dumps for workloads in other namespaces.

Check if affected (1)

  • securityEscaped regex metacharacters in AuthorizationPolicy identity fields

    Applies if you configure source.principals or source.namespaces.

Source ↗
Litmus3.29.0ObservabilityMay 18, 2026
ACTION 1OTHER 7View full analysis

Litmus 3.29.0 includes operator-facing changes across dependencies and platform behavior. This release includes a google.golang.org/grpc update to v1.79.3 for CVE-2026-33186.

Action needed (1)

  • securitycriticalThe google.golang.org/grpc dependency, updated for CVE-2026-33186

    The release updates google.golang.org/grpc to v1.79.3. The dependency update addresses CVE-2026-33186 in Litmus 3.29.0.

Source ↗
The Update Framework (TUF)v7.0.0SecurityMay 18, 2026
ACTION 1CHECK 1PLAN 1View full analysis

A release focused on a security fix and API evolution. It tightens the Updater() contract and begins preparation for removal of an existing module.

Action needed (1)

Check if affected (1)

  • breakingThe Updater() bootstrap argument, now required

    Applies if you use Updater().

Plan ahead (1)

  • deprecatedPreparation for removal of securesystemslib.hash

    Applies if you use securesystemslib.hash.

Source ↗
Buildpacksv0.40.6CI/CD & App DeliveryMay 16, 2026
OTHER 3View full analysis

This release updates the lifecycle bundled into newly created builders and corrects trusted-builder inspection. It also adds a trusted Heroku builder, with a future recommendation change announced.

Source ↗
Daprv1.17.7Orchestration & ManagementMay 15, 2026
CHECK 1OTHER 19View full analysis

Dapr v1.17.7 is a corrective release focused on workflow, scheduler, actor, networking, and pub/sub reliability defects. It also adds workflow payload metrics, changes scheduler defaults, adds a scheduler flag, and updates github.com/dapr/kit.

Check if affected (1)

  • breakingThe actor drainOngoingCallTimeout constraint

    Applies if an application supplies an actor drainOngoingCallTimeout that meets or exceeds the daprd-side placement dissemination timeout, which defaults to 30 seconds.

Source ↗
Linkerdedge-26.5.2Networking & MessagingMay 15, 2026
ACTION 2OTHER 32View full analysis

A release that changes the default sidecar mode and promotes native sidecars to GA. It also fixes correctness issues, adds configurable timestamp handling, addresses eleven disclosed CVEs, and updates numerous dependencies.

Action needed (2)

Source ↗
Buildpacksv0.40.5CI/CD & App DeliveryMay 15, 2026
OTHER 3View full analysis

This release includes a bundled lifecycle version change and updates to Go and other Go dependencies. The remaining release-note entries are headings or upgrade prerequisites.

Source ↗
Helmv3.21.0Kubernetes CoreMay 14, 2026
ACTION 1OTHER 10View full analysis

Helm v3.21.0 is a maintenance release with dependency updates and fixes to chart and OCI handling. It also includes a security fix in the opentelemetry packages.

Action needed (1)

  • securityThe opentelemetry packages, upgraded for CVE patches

    Helm v3.21.0 upgrades the opentelemetry packages to patch CVEs.

Source ↗
Helmv4.2.0Kubernetes CoreMay 14, 2026
ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

  • securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394

    Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

  • securityPlugin version path traversal fix

    Applies if you use the Plugin extension.

Plan ahead (1)

  • deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated

    Applies if you use --hide-notes or --render-subchart-notes.

Source ↗
Ciliumv1.19.4Networking & MessagingMay 13, 2026
ACTION 2CHECK 1OTHER 46View full analysis

A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github.com/moby/spdystream dependency.

Action needed (2)

  • securityThe github.com/moby/spdystream module update

    The github.com/moby/spdystream module is updated to v0.5.1.

  • breakingService-label filtering for EndpointSlice watches

    The loadbalancer/reflectors component filters EndpointSlice watches by service labels.

Check if affected (1)

  • breakingLabel filtering for EndpointSlices

    Applies if you set --k8s-service-proxy-name.

Source ↗
Ciliumv1.17.16Networking & MessagingMay 13, 2026
ACTION 1CHECK 1OTHER 23View full analysis

A maintenance release with an enforced policy behavior change, bug fixes, new metrics, and Helm image overrides. It also updates dependencies and container images and refreshes container image manifests.

Action needed (1)

  • securityThe github.com/moby/spdystream dependency update

    The github.com/moby/spdystream module is updated to v0.5.1 in v1.17.16.

Check if affected (1)

  • breakingCiliumLocalRedirectPolicy addressMatcher override behavior

    Applies if you use addressMatcher in CiliumLocalRedirectPolicy and do not enable --enable-lrp-address-matcher-override=true.

Source ↗
Ciliumv1.18.10Networking & MessagingMay 13, 2026
ACTION 1OTHER 29View full analysis

Cilium v1.18.10 contains correctness fixes, Helm support for overriding images, and dependency and image updates. The github.com/moby/spdystream update is marked as a security update, but no advisory identifier is provided.

Action needed (1)

  • securityThe github.com/moby/spdystream module update to v0.5.1

    Cilium v1.18.10 updates the github.com/moby/spdystream module to v0.5.1 as an undisclosed security update.

Source ↗
Jaegerv2.18.0ObservabilityMay 13, 2026
ACTION 2OTHER 23View full analysis

A release with breaking removals, API and metric changes, bug corrections, and experimental capabilities. It also adds storage, MCP, UI, and tracing functionality, with no security advisories or security-specific fixes disclosed.

Action needed (2)

  • breakingThe min step api in metricstore, removed

    The min step api was removed from metricstore in this release.

  • breakingThe non-standard health MCP tool, removed

    The non-standard health MCP tool was removed from jaegermcp in this release.

Source ↗
Argov3.2.12CI/CD & App DeliveryMay 13, 2026
PLAN 1OTHER 2View full analysis

A maintenance release that closes the 3.2 series and marks it as end of life. It also contains an operator-visible bug fix and a dependency update.

Plan ahead (1)

  • deprecatedThe 3.2 release series reaches end of life

    Applies if you use the 3.2 release series.

Source ↗
Argov3.3.10CI/CD & App DeliveryMay 12, 2026
ACTION 1OTHER 5View full analysis

This release combines bug fixes with dependency and toolchain updates. The Go update to 1.25.9 addresses CVEs and concerns deployments using this release.

Action needed (1)

  • securityThe Go toolchain, updated to 1.25.9

    The Go toolchain is updated to 1.25.9 on release-3.3 to resolve CVEs.

Source ↗
Argov3.4.2CI/CD & App DeliveryMay 12, 2026
OTHER 5View full analysis

Argo CD v3.4.2 is a maintenance release with bug fixes, dependency updates, and corrected secret handling in server-side diff results. It contains no listed security advisories, and no operator action beyond upgrading is identified.

Source ↗
← NewerOlder →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023