RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
cert-managerv1.20.0SecurityMar 10, 2026
ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

  • securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729

    Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.

  • breakingIssuer reference kind and group defaults, reverted

    The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

  • securityPotential cert-manager controller panic from cached DNS responses

    Applicability is not stated in the release notes.

  • breakingThe OtherNames feature, enabled by default

    Applies if you use the OtherNames feature.

  • breakingDefault container user and group IDs

    Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).

  • + 1 more on the release page
Source ↗
Harborv2.13.5Storage & DataMar 10, 2026
ACTION 1OTHER 5View full analysis

Bearer tokens issued before project creation are rejected. The release also updates dependencies and components and removes payload data from the configuration audit log.

Action needed (1)

  • securityRejection of bearer tokens issued before project creation

    The security enforcement rejects bearer tokens issued before project creation.

Source ↗
Harborv2.14.3Storage & DataMar 10, 2026
ACTION 1OTHER 7View full analysis

This release updates base images, dependencies, and Trivy components, and changes the audit-log payload. It also rejects bearer tokens issued before project creation.

Action needed (1)

  • securityBearer tokens issued before project creation rejected

    The security fix rejects bearer tokens issued before project creation.

Source ↗
Operator Frameworkv1.42.1Orchestration & ManagementMar 9, 2026
ACTION 1OTHER 7View full analysis

This release focuses on dependency maintenance, including a security-related Go update, along with a grace-period behavior change. No operator setup changes are explicitly required beyond upgrading to obtain the security fix.

Action needed (1)

  • securityGo dependency updates for CVE remediation

    The release updates go and its dependencies to address CVEs. The change ships in operator-framework v1.42.1.

Source ↗
Daprv1.17.1Orchestration & ManagementMar 9, 2026
OTHER 4View full analysis

Dapr v1.17.1 is a maintenance release focused on runtime behavior in the operator path. The noted fixes cover workflow cleanup, bulk subscription timing, WASM component registration, and placement dissemination overhead.

Source ↗
Argov3.3.3CI/CD & App DeliveryMar 9, 2026
CHECK 1OTHER 5View full analysis

A maintenance release with a compatibility update for cluster version labels and several ordinary defect corrections. The compatibility update concerns Application Sets that fetch clusters based on Kubernetes version.

Check if affected (1)

  • breakingThe argocd.argoproj.io/kubernetes-version format, changed

    Applies if argocd.argoproj.io/auto-label-cluster-info and argocd.argoproj.io/kubernetes-version are configured.

Source ↗
NATSv2.12.5Networking & MessagingMar 9, 2026
CHECK 3OTHER 65View full analysis

A maintenance release with fixes for two CVEs, many correctness issues, expanded JetStream configuration capabilities, and dependency updates. Operators of clustered deployments should review the documented regression affecting stream updates and the changed max_conns behavior.

Check if affected (3)

  • securityCVE-2026-29785 fix for leafnode compression

    Applies if leafnode compression is enabled.

  • securityCVE-2026-27889 fix for WebSockets

    Applies if WebSockets are enabled.

  • breakingThe max_conns server configuration value

    Applies if you configure max_conns in the server configuration.

Source ↗
NATSv2.11.14Networking & MessagingMar 9, 2026
CHECK 2OTHER 7View full analysis

A maintenance release with two security fixes, a Go toolchain version change, and several WebSockets correctness fixes. The WebSockets changes cover compressed frame negotiation, protocol validation, connection upgrades, frame validation, compressor state, and empty compressed buffers.

Check if affected (2)

  • securityhighCVE-2026-29785 fix for leafnode compression

    Applies if CVE-2026-29785 is present and leafnode compression is enabled.

  • securityhighCVE-2026-27889 fix for WebSockets

    Applies if CVE-2026-27889 is present and WebSockets is enabled.

Source ↗
Open Policy Agent (OPA)v1.14.1SecurityMar 9, 2026
ACTION 1OTHER 3View full analysis

OPA v1.14.1 is a patch release focused on bug fixes and dependency updates. It includes dependency work related to the Go standard library and common package vulnerabilities.

Action needed (1)

  • securityGolang standard library dependency updates

    This patch release collects two bug fixes and dependency updates for the Golang standard library and common package vulnerabilities. The change ships in OPA v1.14.1.

Source ↗
Dragonflyv2.4.2Storage & DataMar 9, 2026
ACTION 1CHECK 1OTHER 19View full analysis

A feature and maintenance release that expands configuration and scheduler capabilities while changing configuration controls and the priorities type. Dependency versions are updated, and no security advisories or explicitly described vulnerabilities are mentioned.

Action needed (1)

  • breakingThe priorities type, changed to int32

    The priorities type changed from string to int32 in v2.4.2.

Check if affected (1)

  • breakingThe Enable flag, removed from seedPeer

    Applies if you configure Enable.

Source ↗
Jaegerv2.16.0ObservabilityMar 7, 2026
ACTION 1CHECK 2OTHER 5View full analysis

A release with breaking configuration and API changes, a Go 1.25.7 requirement, new capabilities, and bug and performance fixes. No security advisories or security-specific fixes are identified.

Action needed (1)

  • breakingGo 1.25.7 requirement

    The codebase now requires Go 1.25.7, with Go version consistency enforced across the codebase.

Check if affected (2)

  • breakingLegacy response format of the remote sampling endpoint, removed

    Applies if you use the remote sampling endpoint.

  • breakingtraces.topic renamed to traces.topics

    Applies if you configure traces.topic.

Source ↗
Daprv1.16.10Orchestration & ManagementMar 6, 2026
ACTION 1OTHER 4View full analysis

This release corrects Avro publishing and WASM component registration defects, improves Avro publishing performance, and updates the Go and OpenTelemetry SDK dependencies. The Go update includes security fixes, while the OpenTelemetry update is presented without a disclosed security issue.

Action needed (1)

  • securityThe Go 1.25.7 update

    Go 1.25.7 ships security fixes for the go command and crypto/tls package, plus compiler and crypto/x509 bug fixes.

Source ↗
CoreDNSv1.14.2Kubernetes CoreMar 6, 2026
ACTION 1CHECK 2OTHER 7View full analysis

A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.

Action needed (1)

Check if affected (2)

  • securityhighThe rewrite and acl ordering, CVE-2026-26017

    Applies if you use both rewrite and acl.

  • securityhighplugin/loop query name generation, CVE-2026-26018

    Applies if plugin/loop runs.

Source ↗
Linkerdedge-26.3.1Networking & MessagingMar 6, 2026
OTHER 37View full analysis

This release adds tap authorization support for X-Remote-Extra- headers and introduces inbound HTTP and gRPC response-duration metrics. It also corrects tap authorization and non-mTLS logging behavior, alongside proxy and dependency upgrades. No security advisory or vulnerability is disclosed.

Source ↗
Strimzi0.51.0Networking & MessagingMar 6, 2026
ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

  • securityhighCVE-2026-27133 and CVE-2026-27134 security fixes

    Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.

  • breakingThe ServerSideApplyPhase1 feature gate default

    The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

  • breakingKubernetes version support

    Applies if you use Kubernetes 1.27, 1.28, or 1.29.

  • breakingKafka 4.0.0 and 4.0.1 support

    Applies if you use Kafka 4.0.0 or 4.0.1.

Plan ahead (1)

  • deprecatedThe ingress listener type deprecation

    Applies if you configure the ingress listener type.

Source ↗
Keycloak26.5.5SecurityMar 5, 2026
CHECK 4View full analysis

This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.

Check if affected (4)

  • securityhighCVE-2026-3047 SAML broker authentication bypass

    Applies if you use SAML broker and configure a disabled SAML client.

  • securityhighCVE-2026-3009 disabled identity provider enforcement

    Applies if you configure Disabled Identity Provider.

  • securityhighCVE-2026-2603 disabled SAML IdP broker login

    Applies if you configure Disabled SAML IdP.

  • + 1 more on the release page
Source ↗
Backstagev1.48.4CI/CD & App DeliveryMar 4, 2026
CHECK 1View full analysis

Backstage v1.48.4 is a security-fix release affecting three Backstage packages. Operators using these packages are the audience for this update.

Check if affected (1)

  • securitySecurity fixes for three Backstage packages

    Applies to users of @backstage/plugin-techdocs-node, @backstage/integration, or @backstage/plugin-scaffolder-backend.

Source ↗
SPIREv1.14.2SecurityMar 3, 2026
CHECK 2View full analysis

Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.

Check if affected (2)

  • securityThe http_challenge server node attestor plugin, SSRF issue fixed

    Applies if you use http_challenge.

  • securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed

    Applies if you use x509pop.

Source ↗
SPIREv1.13.4SecurityMar 3, 2026
CHECK 2View full analysis

A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.

Check if affected (2)

  • securityThe http_challenge server node attestor plugin, SSRF issue corrected

    Applies if you use the http_challenge server node attestor plugin.

  • securityThe x509pop server node attestor plugin, CPU consumption issue corrected

    Applies if you use the x509pop server node attestor plugin.

Source ↗
CRI-Ov1.33.10Kubernetes CoreMar 3, 2026
OTHER 1View full analysis

A maintenance release fixes a correctness bug in high performance hook IRQ SMP affinity disabling. A late container deletion could otherwise affect IRQ SMP affinity for other containers.

Source ↗
CRI-Ov1.35.1Kubernetes CoreMar 3, 2026
OTHER 3View full analysis

CRI-O v1.35.1 adds TLS configuration options and corrects pull and container-runtime defects. The release also includes dependency manifest updates, which are not separately described operator-facing changes.

Source ↗
Karmadav1.16.3Orchestration & ManagementFeb 28, 2026
OTHER 8View full analysis

Karmada v1.16.3 contains operator-facing defect corrections and a base-image dependency update. No security advisories or security-specific fixes are disclosed.

Source ↗
Karmadav1.15.6Orchestration & ManagementFeb 28, 2026
OTHER 8View full analysis

Karmada v1.15.6 is a maintenance release focused on operator-relevant bug fixes in scheduling, controller behavior, and resource quota handling. It also updates the Alpine base image from alpine:3.23.2 to alpine:3.23.3.

Source ↗
Karmadav1.14.10Orchestration & ManagementFeb 28, 2026
OTHER 8View full analysis

This is a maintenance release for Karmada with corrections across operator components and an updated Alpine base image. No security advisories or security-specific fixes are disclosed.

Source ↗
Karmadav1.17.0Orchestration & ManagementFeb 28, 2026
CHECK 4PLAN 3OTHER 34View full analysis

A feature and maintenance release adds workload affinity and anti-affinity scheduling, operator and API capabilities, and Helm encryption at rest. It also includes controller and scheduler fixes, dependency and image updates, and deprecations and removals.

Check if affected (4)

  • breakingnamespace validation for spec.resourceSelectors

    Applies if you use PropagationPolicy or OverridePolicy.

  • breakingStricter GroupByLabelKey validation in WorkloadAffinity

    Applies if you configure GroupByLabelKey in WorkloadAffinity.

  • breakingUpdated default Kubernetes and ETCD images

    Applicability is not stated in the release notes.

  • + 1 more on the release page

Plan ahead (3)

  • deprecatedThe --cluster-lease-duration flag, deprecatedremoval date not announced

    Applies if you use --cluster-lease-duration.

  • deprecatedThe --cluster-lease-renew-interval-fraction flag, deprecatedremoval date not announced

    Applies if you use --cluster-lease-renew-interval-fraction.

  • deprecatedEtcd.Local.InitImage in Karmada Init Configuration, deprecatedremoval date not announced

    Applies if you configure Etcd.Local.InitImage in Karmada Init Configuration.

Source ↗
Daprv1.17.0Orchestration & ManagementFeb 27, 2026
ACTION 9CHECK 3PLAN 2OTHER 151View full analysis

A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.

Action needed (9)

  • securityGo cryptography dependency updates

    The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.

  • securityGo vulnerability fix

    A vulnerability in Go is fixed.

  • securityRoot-only UID check

    The UID check now checks only the root UID.

  • securityHTTP path matching and invocation auto-registration

    HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.

  • securityThe golang.org/x/crypto dependency, updated

    The golang.org/x/crypto dependency is bumped.

  • securityThe github.com/docker/docker dependency, updated

    The github.com/docker/docker dependency is bumped.

  • securitySecurity fixes

    Security fixes ship in the release.

  • securityThe github.com/coreos/go-oidc/v3 dependency, updated

    The github.com/coreos/go-oidc/v3 dependency is bumped.

  • securityNATS vulnerability fix

    A vulnerability in NATS is fixed.

Check if affected (3)

  • securityPlacement authorization for Dapr actor types

    Applies if you use Placement.

  • securityCloudflare worker vulnerability fix

    Applies if you use the Cloudflare worker.

  • breakingScheduler resources removed from the Helm chart

    Applies if you use the Helm chart.

Plan ahead (2)

  • deprecatedAlpha Bulk PubSub APIs and app callback deprecation

    Applies if you use /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.

  • deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated

    Applies if you use OnBulkTopicEventAlpha1.

Source ↗
Fluxv2.8.1CI/CD & App DeliveryFeb 27, 2026
OTHER 5View full analysis

Flux v2.8.1 is a maintenance release focused on operator-relevant defect fixes and updates to Flux dependencies and components. No security advisories are disclosed.

Source ↗
Vitessv22.0.4Storage & DataFeb 27, 2026
CHECK 2OTHER 14View full analysis

A maintenance release with security fixes in backup restore behavior, along with routine bug fixes, a Go toolchain dependency update, and a performance improvement. The backup changes affect manifest-based external decompression and protection against path traversal during restores.

Check if affected (2)

  • securitycriticalBackup restore path traversal protection

    Applies if you use backup storage.

  • securityhighManifest-based external decompression default, changed

    Applies if you use an external decompressor command and do not pass --external-decompressor-use-manifest.

Source ↗
Vitessv23.0.3Storage & DataFeb 27, 2026
CHECK 2OTHER 12View full analysis

A security-focused maintenance release with changes to backup and restore behavior, bug fixes, and additional hardening. Backup MANIFEST handling now requires explicit opt-in for compressor commands, and restore blocks path traversal through MANIFEST files.

Check if affected (2)

  • securityLoading compressor commands from MANIFEST, opt-in

    Applies if you use --external-decompressor-use-manifest.

  • securityPath traversal through backup MANIFEST on restore blocked

    Applies if backupengine runs.

Source ↗
Kubernetesv1.32.13Kubernetes CoreFeb 26, 2026
OTHER 1View full analysis

A maintenance release updates the Kubernetes build toolchain to Go 1.24.13. The recorded change concerns how Kubernetes is built, with no operator-facing feature change described.

Source ↗
Open Policy Agent (OPA)v1.14.0SecurityFeb 26, 2026
ACTION 1CHECK 1OTHER 21View full analysis

This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.

Action needed (1)

  • securityhighThe go.opentelemetry.io dependencies, updated for GHSA-9h8m-3fm2-qjrq

    The go.opentelemetry.io dependencies include the fix for GHSA-9h8m-3fm2-qjrq.

Check if affected (1)

  • breakingThe --h2c flag with Unix domain socket support

    Applies if you use --h2c with unix domain socket (UDS).

Source ↗
Backstagev1.48.3CI/CD & App DeliveryFeb 26, 2026
OTHER 2View full analysis

Version v1.48.3 is a correctness-fix release for Backstage. It fixes MUI module resolution by correcting the @mui/material/styles shared dependency key and fixes entity page tab groups so they follow the configured ordering.

Source ↗
Prometheusv3.10.0ObservabilityFeb 26, 2026
CHECK 1OTHER 29View full analysis

This release adds Prometheus capabilities and image/build options, changes defaults and outputs, improves performance, and fixes correctness defects. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

  • breakingExpanded alert annotations hidden by default

    Applies if you use the UI on the /alerts page.

Source ↗
OpenKruisev1.8.3CI/CD & App DeliveryFeb 25, 2026
CHECK 1View full analysis

OpenKruise v1.8.3 includes a constraint change for probe host configuration. Existing configurations that rely on previously accepted host values may require changes.

Check if affected (1)

  • breakingThe probe host field, restricted

    Applies if your probe configurations use the host field.

Source ↗
OpenKruisev1.7.5CI/CD & App DeliveryFeb 25, 2026
CHECK 1View full analysis

A focused release change restricts the host field in probes. The section heading carries no operator-facing change.

Check if affected (1)

  • breakingProbe host field restriction

    Applies if host is configured.

Source ↗
Rookv1.19.2Storage & DataFeb 24, 2026
CHECK 1OTHER 10View full analysis

This release includes operator-facing behavior and API updates, along with default, image, and dependency changes. It also contains an internal build-tooling update and fixes for storage and gateway handling.

Check if affected (1)

  • breakingDefault gateway topology spread constraints for nvmeof

    Applies if you use nvmeof.

Source ↗
← NewerOlder →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023