AI-analyzed release notes for CNCF graduated and incubating projects.
A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.
Check if affected (1)
securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.
This Linkerd edge release, edge-26., updates dependencies and components across the project. The release notes contain no explicit security advisories or security claims.
This release contains two security updates whose affected vulnerabilities are not identified. It also adds experimental incremental updates for gRPC synchronization.
Action needed (1)
securityThe vulnerability-updates security update
OpenFeature Core v0.15.2 includes a security update for vulnerability-updates.
This release contains security updates for flagd-proxy/v0.. The available notes do not identify the affected vulnerabilities or describe their scope.
Action needed (2)
securityThe vulnerability-updates entry for issue #1933
The vulnerability-updates entry records a security update for flagd-proxy/v0., tracked in issue #1933. The notes do not describe the affected vulnerability.
securityThe vulnerability-updates entry for issue #1934
The vulnerability-updates entry records a security update for flagd-proxy/v0., tracked in issue #1934. The notes do not describe the affected vulnerability.
flagd v0.15.2 includes two undisclosed security updates and a new experimental gRPC incremental-update capability. The experimental addition concerns deployments that use gRPC synchronization.
Action needed (2)
securityThe vulnerability-updates security update for issue #1933
flagd v0.15.2 includes the vulnerability-updates security update linked to issue #1933.
securityThe vulnerability-updates security update for issue #1934
flagd v0.15.2 includes the vulnerability-updates security update linked to issue #1934.
Falco 0.43.1 updates build component versions. The release note discloses no security changes.
Source ↗A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.
Action needed (1)
securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.
Check if affected (2)
securityhighPlugin verification when . is missing
Applies if you use plugins.
securityhighPlugin metadata version path traversal
Applies if you use plugins.
This release updates the Go dependency and toolchain to address multiple disclosed CVEs. It concerns deployments that rely on the release's bundled Go version.
Action needed (1)
securitycriticalThe Go toolchain, updated to 1.
The release updates the Go toolchain to 1. to address CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281.
This release updates the Go dependency to address multiple disclosed CVEs. It concerns deployments that receive their Go runtime or builds from this release.
Action needed (1)
securitycriticalThe Go dependency, upgraded to 1.
The release upgrades Go to 1. to address CVE-2026-32282, CVE-2026-32289, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281. The update ships in this release.
This release updates the Go toolchain used to build OPA binaries and images. It also includes multiple security fixes in that Go version.
Action needed (1)
securityThe Go toolchain, updated to 1.26.2
The Go version used to build OPA binaries and images is updated to 1.. This Go version contains multiple security fixes.
A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.
Action needed (6)
securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.
Check if affected (7)
securityWorkflows admin permission boundaries
Applies if you use Workflows.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
Plan ahead (1)
deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.
Release 0.15.1 fixes a memory leak caused by unbounded metrics cardinality and updates a dependency for an undisclosed security fix. The dependency update ships in the core v0.15.1 release.
Action needed (1)
securityThe github. dependency update
The github. module is updated to v4.1.4 for a security fix. This change ships in core v0.15.1.
This release includes a security update to the github. dependency. The release note does not disclose the nature of the vulnerability.
Action needed (1)
securitygithub. updated to v4.1.4
The github. module is updated to v4.1.4 in flagd-proxy v0.9.3 as a security fix. The note does not disclose the nature of the vulnerability.
This release fixes RPC flag defaulting, metrics-server process handling, and unbounded metrics cardinality. It also updates a dependency for an undisclosed security fix, which is the main consideration for users evaluating the release.
Action needed (1)
securityThe github. dependency, updated to v4.1.4
The github. module is updated to v4.1.4 in flagd/v0. for an undisclosed security fix.
Flux v2.8.5 is a maintenance release with bug fixes, clearer error reporting, added verification and authentication configuration, and updated toolkit components. No security advisories or explicitly described security vulnerabilities are present.
Source ↗This release includes an operator-facing bug fix for OTLP HTTP tracing when insecure: true is used. No change entry is displayed here.
Flux v2.8.4 includes fixes for Windows support and --source validation, along with updates to Flux dependencies. These changes concern users of the affected commands and dependency consumers.
This is a patch release for Backstage with operator-relevant correctness fixes. The recorded note tail points to fixes for OAuth 2.0 metadata URL handling, the legacy-frontend-plugin template name, and permissions on the scaffolder plugin's /. endpoint.
Istio 1.27.9 is a defect-fix release focused on operator and networking behavior. The recorded note tail includes fixes for startup handling, authorization matching, gateway restarts, TLS route hostname constraints, and intermittent proxy errors.
Source ↗This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.
Action needed (1)
securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.
Check if affected (1)
breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
Plan ahead (2)
deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
A release with Windows artifacts, broader guest and template configuration support, and changed vz audio handling. It also updates the bundled nerdctl distribution and dependencies, including security updates in BuildKit and CNI plugins that are obtained by upgrading.
Check if affected (1)
securityBuildKit and CNI plugins security updates
Applies if you use BuildKit or CNI plugins.
This Linkerd release includes proxy correctness fixes, operator-visible configuration changes, and added multicluster resources. It also updates dependencies and component versions, with no security advisories or explicitly described vulnerabilities.
Source ↗A security maintenance release fixes seven disclosed vulnerabilities. It also upgrades Quarkus and corrects an error caused by requests without a Host header.
Action needed (1)
securitymediumCVE-2026-1002 static handler component cache
CVE-2026-1002 fixes a flaw in the io. static handler component cache that could deny access to static files.
Check if affected (6)
securityhighCVE-2026-4634 scope processing
Applies if you use Scope Processing.
securityhighCVE-2026-4636 UMA policy resource injection
Applies if you use UMA.
securityhighCVE-2026-3872 OIDC redirect URI validation
Applies if you use OIDC.
A broad release with new service discovery, PromQL, TSDB, and UI capabilities, alongside performance, dependency, output, and correctness changes. It also deprecates legacy Hetzner discovery labels and corrects TSDB retention-time handling.
Check if affected (1)
breakingThe storage. unit handling
Applies if you configure storage..
Plan ahead (2)
deprecatedThe __meta_hetzner_datacenter label, deprecatedremoval date not announced
Applies if you use __meta_hetzner_datacenter.
deprecatedThe Hetzner Cloud datacenter location labels, deprecated
Applies if you use __meta_hetzner_hcloud_datacenter_location or __meta_hetzner_hcloud_datacenter_location_network_zone.
CRI-O v1.33.11 contains no operator-facing changes in the supplied release material. No specific flags, fields, resources, metrics, or advisories are identified for this version.
Source ↗CRI-O v1.35.2 is an operator-facing maintenance release focused on configuration and runtime behavior. It concerns deployments using artifact stores, pinned images, image pulls, or the affected metrics paths.
Source ↗CRI-O v1.34.7 contains no operator-facing change details in the release note. There are no specific changes to assess for this release.
Source ↗This release adds a Host pod reconciler and winget packaging, upgrades the wasmtime dependency, and changes install-script behavior. The install-script changes apply to both scripts and include fixes for the stable v2 release.
Source ↗A maintenance release with changes to authorization behavior and an etcdctl endpoint command regression. The recorded release notes also include headings and documentation updates.
A maintenance release with changes to etcdserver access and an etcdctl command regression. The recorded changes do not include item details for this release.
Source ↗A maintenance release with permission and etcdctl regression fixes. The recorded changes do not include details for individual release-note entries.
This release changes fractional bucketing behavior in flagd. The provided release information does not describe the operator setup affected by the change.
Source ↗A fractional bucketing update changes pseudorandom assignments without changing the API. Consistent assignments require all providers to be updated.
Check if affected (1)
breakingFractional pseudorandom bucketing assignments
Applies if you use providers.
Karmada v1.17.1 is an ordinary bug-fix release. It includes no identified security advisories or operator actions.
Source ↗Karmada v1.16.4 is a maintenance release focused on operator-facing defect corrections. It targets reliability in certificate rotation, upgrades, and workload evacuation.
Source ↗Karmada v1.15.7 is a maintenance release focused on operator-facing bug fixes. The release notes emphasize corrections to operational behavior in Karmada components.
Source ↗This release focuses on operator correctness, with changes to status. handling, an option to disable status validation, and fixes for apply-once resource reconciliation and applied-resource tracking. It also updates the debug webhook script as setup tooling.
Jaeger v2.17.0 contains bug fixes, performance improvements, and new or expanded experimental capabilities. It also changes query and configuration behavior. No security advisories or explicitly security-related flaws are disclosed.
Source ↗A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.
Action needed (1)
securitycriticalThe google. dependency and CVE-2026-33186 resolution
The affected google. dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.
Check if affected (2)
breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
breakingStructural validation for . topics
Applies if you configure ..
A release that narrows supported environments and installation paths while adding storage, attestation, GPU, API, signature, and image-handling capabilities. It also updates guest and image handling, including sealed-secret signatures, cosign signatures with newlines, in-memory LUKS headers, and improved Vault/OpenBao support.
Check if affected (5)
breakingGo support in CDH removed
Applies if you use CDH.
breakingCanonical TDX Tech preview support removed
Applies if you use Canonical TDX Tech preview.
breakingUbuntu version requirement
Applies if you use Ubuntu 24. or 25..
Plan ahead (1)
deprecatedpacker images support, planned for removalremoval date not announced
Applies if you use packer images.
