AI-analyzed release notes for CNCF graduated and incubating projects.
OpenFeature core/v0.15.5 is a maintenance release with operator-relevant corrections and a security-related dependency update. The security announcement does not identify a specific advisory in the release text.
Action needed (1)
securityOpen Dependabot security alerts resolved
Open Dependabot security alerts were resolved in the OpenFeature core release.
This release resolves open Dependabot security alerts in the flagd proxy. The release note does not identify which vulnerabilities or dependencies were fixed.
Action needed (1)
securityDependabot security alerts resolved
The flagd-proxy/v0. release resolves open Dependabot security alerts. The release note does not identify the affected dependencies or vulnerabilities.
flagd/v0.15.5 is a maintenance release with operator-facing corrections and a value update. No security advisories or explicit security issues are identified.
Source ↗v3.3.9 is a maintenance release with a disclosed security fix and a go version update to resolve CVEs. It also includes bug fixes in the release.
Action needed (2)
securitycriticalGHSA-3v3m-wc6v-x4x3 security fix
This release fixes the vulnerability identified by GHSA-3v3m-wc6v-x4x3.
securityThe go version update for CVE resolution
The go version is bumped to resolve CVEs in v3.3.9.
Version v3. includes a disclosed security fix and additional correctness and dependency updates. The security fix is the release change that concerns users evaluating whether to upgrade.
Action needed (1)
securitycriticalSecurity fix for GHSA-3v3m-wc6v-x4x3
Version v3. contains a security fix for the vulnerability identified by GHSA-3v3m-wc6v-x4x3.
OPA v1.16.0 adds URI built-ins, Data API metadata support, testing and WASM capabilities, along with broader Rego and schema support. It also changes formatting, logging, server, TLS, socket, storage, and dependency behavior, but includes a shutdown regression, so users should skip v1.16.0 and upgrade directly to v1.16.1.
Action needed (1)
breakingHTML index page query form removed
OPA v1.16.0 drops the HTML index page query form.
A feature release adds JetStream, leafnode, configuration, and protocol capabilities alongside fixes. Operator attention is needed for the narrowed MQTT retained-message subject constraint and ACL updates when domain-aware acknowledgements and flow control are enabled; the Go toolchain version also changes.
Check if affected (1)
breakingThe retained-message subject constraint
Applies if you use retained messages.
A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.
Action needed (3)
securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.
Check if affected (12)
securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
Plan ahead (4)
deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
v1.17.2 contains correctness fixes and a security-related Alpine base-image dependency update. The alpine update requires upgrading to receive the new base image.
Action needed (1)
securityThe alpine base image, updated to alpine:3.
The base image alpine has been updated from alpine:3. to alpine:3. to address security concerns. The update ships in v1.17.2.
Karmada v1.16.5 is described as a maintenance release with operator-facing bug fixes and a base image version update. The recorded changes address reconciliation, scheduling events and errors, Job replica completion assignment, and the alpine image version.
A maintenance release includes corrected operator and scheduler behavior, along with an updated Alpine base image. The Alpine update addresses security concerns.
Action needed (1)
securityThe alpine base image, updated
The base image alpine was updated from alpine:3. to alpine:3. to address security concerns. The update ships in the release.
This release adds and changes API and runtime capabilities, removes a sandbox metadata field, and updates a dependency. No security advisories or vulnerabilities are disclosed.
Check if affected (1)
breakingThe Container sandbox metadata field, removed
Applies if you use Container in API specs.
A security maintenance release with fixes affecting three Backstage catalog packages. The affected packages are @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, and @backstage/plugin-catalog-unprocessed-entities.
Check if affected (1)
securitySecurity fixes for Backstage catalog packages
Applies if you use any of @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, or @backstage/plugin-catalog-unprocessed-entities.
A release with operator-facing fixes, new capabilities, API and configuration changes, and dependency updates. It also includes fixes for CVE-2026-32597 in PyJWT and CVE-2026-30922 in pyasn1.
Action needed (3)
securityhighCVE-2026-32597 PyJWT validation fix
PyJWT crit header validation was fixed for CVE-2026-32597.
securityhighCVE-2026-30922 pyasn1 fix
The pyasn1 dependency was updated to address CVE-2026-30922 and its denial-of-service vulnerability.
breakingRequired MaxReplicas field
MaxReplicas is now required and must use the int32 type.
Check if affected (2)
breakingRemoval of the scheduler cert-hash restart annotation
Applies if you configure cert-hash.
breakingPYTHONPATH blocked by ISVC and ServingRuntime webhooks
Applies if you configure PYTHONPATH.
A substantial feature and maintenance release with new operator capabilities plus configuration, Helm, and CLI improvements. It also includes defect, output, dependency, and security fixes, including remediation for several CVE-related issues.
Action needed (4)
securityhighIntermediate certificate limit for CVE-2026-32280
Intermediate certificates are limited to mitigate CVE-2026-32280 in this release.
securityhighGo toolchain upgraded to 1. for CVE-2026-32283
The Go toolchain is upgraded to 1. to fix CVE-2026-32283.
securitymediumgo-tuf/v2 upgraded to v2. for CVE-2026-24686
go-tuf/v2 is upgraded to v2. to fix CVE-2026-24686.
securityStandard library CVE fixes
Standard library CVEs are fixed in this release.
Check if affected (2)
breakingRestricted ConfigMap access for namespaced policies
Applies if you use namespaced policies.
breakingFinalizers and uninstall workarounds removed
Applies if uninstall runs.
This redirect release contains no operator-facing changes. It consists of headings or navigational text rather than changes to Kubeflow behavior or configuration.
Source ↗Microcks 1.14.0 adds asynchronous request and tracing support, corrects operation-method handling, and updates shipped dependencies. The release concerns deployments or integrations that use these capabilities or depend on the updated platform components.
Source ↗This is an operator-facing release with updates to configuration and runtime behavior. No security vulnerability or advisory is disclosed; the security and TLS changes describe configuration and behavior without naming an exploitable flaw.
Source ↗Rook v1.19.5 includes operational behavior changes, defect corrections, a dependency update, and new CSI configuration support. The release note also mentions security and deployment-related changes, but no explicit vulnerability or advisory is disclosed.
Source ↗A release with API and configuration contract changes, new capabilities, deprecations, and bug fixes. It includes transport, telemetry, generated configuration, and data-handling updates, with no disclosed security advisories or security-specific fixes.
Check if affected (2)
breakingRelative replace paths in generated Collector source
Applies if you use the generated Collector source.
breakingNamed Config. field
Applies if you use Config..
Plan ahead (1)
deprecatedDefaultMetricsBuilderConfig deprecation
Applies if you use DefaultMetricsBuilderConfig.
This release corrects a pub/sub graceful-shutdown defect in Dapr. Messages arriving during subscription shutdown are held instead of rejected, so the broker can redeliver them rather than diverting them to dead-letter queues.
Source ↗A maintenance release with a dependency update, correctness fixes, and new operator-facing capabilities. The MCP server now requires explicit opt-in when MCP_SERVER_ENABLED is not configured.
Check if affected (1)
breakingThe MCP_SERVER_ENABLED default, changed to false
Applies if MCP_SERVER_ENABLED is not configured.
A release that removes older CRD API versions, changes defaults and configuration locations, and adds Kafka and HTTP Bridge capabilities. Monitoring configurations and standalone Topic Operator setups may require updates.
Action needed (2)
breakingThe UseConnectBuildWithBuildah feature gate, enabled by default
The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default.
breakingThe /metrics endpoint, moved to the HTTP management interface
The /metrics endpoint is no longer available on the regular HTTP interface, which uses port 8080 by default. It is now available on the HTTP management interface on port 8081.
Check if affected (4)
breakingOlder CRD API versions, removed
Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.
breakingThe Open Policy Agent (OPA) authorizer plugin, no longer bundled
Applies if you use the Open Policy Agent (OPA) authorizer plugin.
breakingLegacy TLS environment variables, ignored
Applies if you set any of STRIMZI_TLS_ENABLED, STRIMZI_TLS_AUTH_ENABLED, STRIMZI_PUBLIC_CA, STRIMZI_TRUSTSTORE_LOCATION, STRIMZI_TRUSTSTORE_PASSWORD, STRIMZI_KEYSTORE_LOCATION, or STRIMZI_KEYSTORE_PASSWORD.
This release contains an operator-relevant defect fix for the device monitor. The fix addresses device-monitor behavior on v2.8.1.
Source ↗A security-focused maintenance release fixes two vulnerabilities in node attestation and join token handling. Operators should use this release to receive these fixes.
Check if affected (2)
securityThe aws_iid attestation identity verification
Applies if you use the aws_iid server node attestor plugin.
securityJoin token data store deletion
Applicability is not stated in the release notes.
This is a security and correctness fix release for SPIRE node attestation. It addresses forged EC2 identity handling in aws_iid and concurrent join-token attestation behavior.
Check if affected (1)
securityCorrected aws_iid EC2 identity verification
Applies if you use the aws_iid server node attestor plugin.
A maintenance release with a security fix, correctness fixes, a performance improvement, and dependency and toolchain manifest updates. Most changes take effect through the release itself without additional operator action.
Action needed (1)
securityBearer JWT disclosure fix in /connz
The /connz monitoring endpoint no longer discloses bearer JWTs. The fix ships in the NATS monitoring endpoint.
A maintenance release updates the Go toolchain and corrects NATS server defects. It includes fixes for bearer credential disclosure through monitoring and for redaction of route and cluster URL secrets.
Check if affected (2)
securityThe /connz endpoint no longer discloses bearer JWTs
Applies if you use the /connz monitoring endpoint.
securityMonitoring redaction of route and cluster URL secrets
Applies if you pass route and cluster URL secrets as command line arguments.
A security maintenance release with corrections for credential exposure, request decoding validation, and stored cross-site scripting. Advisory identifiers are provided for the addressed defects, and the fixes ship in this release.
Check if affected (3)
securityhighAzureAD remote write OAuth client_secret exposure fix
Applies if you use AzureAD remote write.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
securitymediumOld UI heatmap chart le label escaping
Applies if you use the old UI heatmap chart.
This release updates the Go toolchain alongside changes to authorization behavior. The Go update addresses standard library vulnerabilities documented in the Go 1.26.2 release notes.
Action needed (1)
securityThe Go toolchain version, updated to 1.
The toolchain Go version is updated to 1. to address Go standard library vulnerabilities documented in the Go 1.26.2 release notes.
A security-focused release with fixes for exposed OAuth secrets and stored XSS. Remote read and write request validation now rejects snappy-compressed payloads whose declared decoded length exceeds the decode limit.
Check if affected (4)
securityhighAzureAD remote write client_secret exposure fixed
Applies if you use AzureAD remote write.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
securitymediumOld UI heatmap chart le label escaping
Applies if you use UI.
This is primarily a security-focused Flatcar release with a large set of disclosed Linux fixes. It also includes a QEMU launcher performance correction and updates to Linux and ca-certificates dependencies.
Action needed (1)
securitycriticalLinux security fixes
Linux is updated with fixes for the disclosed advisories, including CVE-2023-52435, the CVE-2025-* and CVE-2026-* advisories listed for this release. The fixes ship in Flatcar lts-4081..
A security- and maintenance-focused release with updates to Linux and bundled components, along with dependency updates. It also corrects minimal-initrd regressions and changes service startup, SSH defaults, kernel-module availability, and other operator-visible behavior and layout.
Action needed (18)
securitycriticalLinux security updates
Linux was updated with security fixes associated with advisories including CVE-2024-56757, CVE-2025-71239, and CVE-2026-31788.
securityhighcurl security updates
curl was updated with fixes for CVE-2025-10148 and CVE-2025-9086.
securityhighexpat security update
expat was updated with a fix for CVE-2025-59375.
securityhighgnupg security updates
gnupg was updated with fixes for CVE-2025-68972 and CVE-2025-68973.
securityhighGo security updates
go was updated with security fixes associated with CVE-2025-47910, CVE-2025-47912, CVE-2025-58183, and related advisories.
securityhighintel-microcode security updates
intel-microcode was updated with fixes associated with CVE-2024-28956, CVE-2024-43420, CVE-2025-20012, and related advisories.
securityhighlibxslt security updates
libxslt was updated with fixes for CVE-2025-7424 and CVE-2025-7425.
securityhighnvidia-drivers security updates
nvidia-drivers was updated with fixes for CVE-2025-23280, CVE-2025-23282, CVE-2025-23300, and related advisories.
securityhighopenssl security updates
openssl was updated with fixes for CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232.
securityhighPAM security updates
pam was updated with fixes for CVE-2024-10041, CVE-2024-10963, CVE-2024-22365, and CVE-2025-6020.
securitymediumbinutils security updates
binutils was updated with fixes for CVE-2025-5244, CVE-2025-5245, and CVE-2025-8225.
securitymediumcoreutils security update
coreutils was updated with a fix for CVE-2025-5278.
securitymediumlibpcre2 security update
libpcre2 was updated with a fix for CVE-2025-58050.
securitymediumnet-tools security update
net-tools was updated with a fix for CVE-2025-46836.
securitylowopenssh security updates
openssh was updated with fixes for CVE-2025-61984 and CVE-2025-61985.
securitylibxml2 update
libxml2 was updated to libxml2-20250908.
breakingOpenSSH algorithm configuration defaults
Ciphers, MACs, and KexAlgorithms were dropped from the sshd configuration. OpenSSH upstream defaults are used instead.
breakingReduced first-stage initrd kernel modules
The set of kernel modules available in the first initrd is reduced.
Check if affected (1)
breakingAutomatic startup for overlaybd sysext services
Applies if you use the overlaybd sysext.
A feature and maintenance release that adds Store Gateway, federation, overrides, caching, metric, and query capabilities while graduating several experimental features. It also changes defaults and configuration names, updates dependencies, and fixes correctness, memory, panic, and data-corruption defects.
Action needed (1)
breakingThe blocks storage bucket index default
Blocks storage now enables the bucket index by default through -blocks-storage.. Disabling it with -blocks-storage. is not recommended for production.
Check if affected (1)
breakingThe Distributor type and unit label flag
Applies if you configure either -distributor. or -distributor. for remote write v2 and OTLP requests.
Plan ahead (3)
breakingThe Ruler API flag rename
Applies if you configure -experimental..
breakingThe Alertmanager API flag rename
Applies if you configure -experimental..
breakingThe Users Scanner user index update configuration
Applies if you configure either -*. or clean_up_interval.
This release adds the Val map type, Linux glibc GPU builds, and updates to wasmtime and its rustls dependency. It also corrects pooling allocator probing and includes a security update for rustls-webpki.
Action needed (1)
securityrustls-webpki security update, RUSTSEC-2026-0049
The release includes a security update for rustls-webpki, addressing RUSTSEC-2026-0049.
KubeVirt v1.7.3 is an operator-focused maintenance release with defect corrections and behavior changes. The available assessment discloses no security advisories or security-specific fixes.
Source ↗KubeVirt v1.6.5 contains bug fixes and behavior corrections across VM lifecycle, migration, storage, export, metrics, and virt-handler operation. The release has no disclosed security advisories or operator setup changes.
Source ↗This Linkerd edge release contains correctness fixes, proxy and proxy-init/CNI updates, and dependency version changes. No security advisories or security-specific flaws are disclosed.
Source ↗This release updates the Go toolchain in Crossplane to 1.. The change addresses undisclosed standard-library CVEs.
Action needed (1)
securityThe Go toolchain, updated to 1.
Crossplane v1.20.7 updates the Go toolchain to 1.. The update addresses undisclosed standard-library CVEs.
A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.
Action needed (1)
securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.
Check if affected (6)
securityURL encoding for query_parameter_mutations values
Applies if you configure query_parameter_mutations.
securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
breakingExplicit max_early_data_bytes configuration
Applies if you configure upstream_connect_mode with a value other than IMMEDIATE and do not configure max_early_data_bytes.
Plan ahead (1)
deprecatedThe enforce_rsa_key_usage option, deprecatedremoval date not announced
Applies if you configure enforce_rsa_key_usage.
