Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

cert-managerv1.21.1SecurityJul 29, 2026

ACTION 4OTHER 4View full analysis

cert-manager v1.21.1 is a maintenance release with fixes for regressions and updates to dependencies affected by reported security vulnerabilities. The dependency updates concern all installations, while the regression fixes address controller behavior and require no setup change.

Action needed (4)

securityThe golang.org/x/text dependency, updated to v0.40.0
The golang.org/x/text dependency is updated to v0.40.0 to fix a reported security vulnerability.
securityThe google.golang.org/grpc dependency, updated to v1.82.1
The google.golang.org/grpc dependency is updated to v1.82.1 to fix a reported security vulnerability.
securityThe github.com/google/cel-go dependency, updated to v0.29.0
The github.com/google/cel-go dependency is updated to v0.29.0 to fix a reported security vulnerability.
securityThe go.opentelemetry.io/otel dependency, updated to v1.44.0
The go.opentelemetry.io/otel dependency is updated to v1.44.0 to fix a reported security vulnerability.

Ciliumv1.20.0Networking & MessagingJul 29, 2026

ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

securitygoogle.golang.org/grpc v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in the main branch.
securitygoogle.golang.org/grpc v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.
securityhelm.sh/helm/v4 v4.1.4
The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.
securitygithub.com/cloudflare/circl v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3.
securitygithub.com/go-jose/go-jose/v4 v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.
securitygithub.com/moby/spdystream v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1.
breakingcni.customConf CNI configuration version
The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.

Check if affected (28)

securitytbid traffic host namespace handling
Applies if you use tbid traffic.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
+ 25 more on the release page

Plan ahead (6)

deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[].subnet or interfaces[].cidr.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
+ 3 more on the release page

Thanosv0.42.3ObservabilityJul 29, 2026

OTHER 1View full analysis

This release contains a receive shutdown regression correction. Blocks are uploaded before TSDB shutdown completes, preserving upload behavior during shutdown.

Knativeknative-v1.23.0Orchestration & ManagementJul 29, 2026

OTHER 5View full analysis

Knative v1.23.0 expands platform support with generic ephemeral volumes, startup-probe validation, and IPv6 handling for autoscaler and activator behavior. It also corrects WebSocket hijack state tracking, with no security advisories or operator actions identified.

wasmCloudv2.6.0Orchestration & ManagementJul 28, 2026

ACTION 1OTHER 36View full analysis

A feature and maintenance release that adds runtime, plugin, service, component, and pooling capabilities while changing the default NATS behavior. It also includes dependency updates and fixes for runtime and observability defects.

Action needed (1)

breakingThe NATS consumer-group default
NATS now uses consumer groups by default in the release.

Rookv1.20.3Storage & DataJul 28, 2026

OTHER 11View full analysis

A maintenance release with improvements to Helm charts, custom resource support, networking, monitoring, and storage behavior. It also includes correctness fixes across scheduling, reconciliation, endpoint handling, account deletion, and logging.

Rookv1.19.8Storage & DataJul 28, 2026

ACTION 1OTHER 4View full analysis

v1.19.8 is a maintenance release with a security-related dependency update and behavioral improvements. The recorded dependency change updates the vulnerable go text package from v0.37 to a newer version.

Action needed (1)

securityThe go text package, updated from v0.37
The go text package is updated from v0.37 to the latest version because v0.37 has a vulnerability. This dependency update ships in v1.19.8.

Confidential Containersv0.22.0SecurityJul 28, 2026

CHECK 6OTHER 20View full analysis

A release with a breaking authentication change and several operator-visible removals, alongside new integrations, APIs, and configuration capabilities. No security fixes or advisory identifiers are disclosed.

Check if affected (6)

breakingKBS client admin-token authentication
Applies if you use the KBS client.
breakingThe CAA docker provider, removed
Applies if you use the CAA docker provider.
breakingThe Fedora-based mkosi-built CAA podvm image, removed
Applies if you use the Fedora-based mkosi-built CAA podvm image.
+ 3 more on the release page

OpenFeaturecore/v0.16.1CI/CD & App DeliveryJul 27, 2026

ACTION 2OTHER 8View full analysis

This release combines ordinary bug fixes with security-related updates. It also improves blob/HTTP synchronization, with no announced operator-facing removals, deprecations, or default changes.

Action needed (2)

securityThe google.golang.org/grpc module update to v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in core v0.16.1.
securityThe vulnerability-updates update
vulnerability-updates is updated in core v0.16.1.

OpenFeatureflagd-proxy/v0.9.7CI/CD & App DeliveryJul 27, 2026

ACTION 2OTHER 3View full analysis

A maintenance release with a bug-fix heading, a new server timeout setting, dependency updates, and security-related updates. The google.golang.org/grpc update requires upgrading.

Action needed (2)

securityThe google.golang.org/grpc module, updated to v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 as a security-related dependency change.
securityThe vulnerability-updates dependency update
The release updates vulnerability-updates as a security-related dependency change.

OpenFeatureflagd/v0.16.1CI/CD & App DeliveryJul 27, 2026

ACTION 3OTHER 5View full analysis

flagd/v0.16.1 combines bug fixes with security dependency updates and a configurable sync-server capability. The security notes do not include advisory identifiers or flaw details, while the sync-server changes include server timeouts and configurable gRPC keepalive enforcement.

Action needed (3)

securitySecurity dependency updates
Security dependencies are updated in flagd/v0.16.1.
securityThe google.golang.org/grpc module update
The google.golang.org/grpc module is updated to v1.82.1 in flagd/v0.16.1.
securityVulnerability updates
Vulnerability updates are included in flagd/v0.16.1 as a security change.

Dragonflyv2.5.1Storage & DataJul 27, 2026

OTHER 20View full analysis

Dragonfly v2.5.1 adds scheduler and statistics capabilities while correcting runtime and scheduling behavior. It also updates dependencies and changes digest validation to reject non-hex encoded values; no security advisories or explicitly described vulnerabilities are present.

Linkerdedge-26.7.2Networking & MessagingJul 24, 2026

OTHER 31View full analysis

Linkerd edge-26.7.2 contains no functional changes. It updates runtime, build, and development dependencies, with no security advisories disclosed or referenced.

etcdv3.7.1Kubernetes CoreJul 23, 2026

ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

securityhighThe google.golang.org/grpc dependency update
The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.

etcdv3.6.14Kubernetes CoreJul 23, 2026

ACTION 5OTHER 5View full analysis

A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.

Action needed (5)

securitycriticalThe golang.org/x/net dependency update
The golang.org/x/net dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.
securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8
An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3
The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.
securityhighThe google.golang.org/grpc dependency update
The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default value
The default value for snapshotLimitByte is set to a reasonable value in this release.

etcdv3.5.33Kubernetes CoreJul 23, 2026

ACTION 5OTHER 5View full analysis

A maintenance release with correctness and security fixes, timeout behavior changes, and dependency and toolchain updates. It also updates the build toolchain used to compile binaries.

Action needed (5)

securityhighWatch response authorization for key ranges
The watch authorization issue is fixed: a user with read permission on one key could no longer receive watch responses for every key starting from that key. The fix addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener
A tlsHandshakeTimeout is set for tlsListener. The change addresses GHSA-6vch-q96h-7gc3.
securityhighThe golang.org/x/net dependency, updated to v0.56.0
The golang.org/x/net dependency is updated to v0.56.0 to address GO-2026-5942.
securityhighThe golang.org/x/text dependency, updated to v0.39.0
The golang.org/x/text dependency is updated to v0.39.0 to address GO-2026-5970.
securityhighThe google.golang.org/grpc dependency, updated to 1.82.1
The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.

Fluxv2.9.3CI/CD & App DeliveryJul 23, 2026

OTHER 6View full analysis

Flux v2.9.3 is a maintenance release with correctness fixes, updated dependencies, and a newly included component in the OCI artifact. No security advisories are disclosed.

Crossplanev2.3.4Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 5View full analysis

This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.

Action needed (7)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.3.4 updates the github.com/sigstore/rekor module to v1.5.2 for security fixes.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.3.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6 for security fixes.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.3.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0 for security fixes.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.3.4 updates the github.com/sigstore/sigstore-go module to v1.2.0 for security fixes.
securityCombined security dependency updates
Crossplane v2.3.4 includes combined security updates for grpc, golang.org/x/net, and golang.org/x/text.
securityThe golang.org/x/text module update to v0.39.0
Crossplane v2.3.4 updates the golang.org/x/text module to v0.39.0 for security fixes.
securityThe golang.org/x/net module update to v0.56.0
Crossplane v2.3.4 updates the golang.org/x/net module to v0.56.0 for security fixes.

Crossplanev2.2.4Orchestration & ManagementJul 23, 2026

ACTION 5OTHER 2View full analysis

Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.

Action needed (5)

securityThe github.com/sigstore/rekor module update to v1.5.2
Crossplane v2.2.4 updates the github.com/sigstore/rekor module to v1.5.2.
securityThe github.com/sigstore/cosign/v3 module update to v3.0.6
Crossplane v2.2.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6.
securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0
Crossplane v2.2.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0.
securityThe github.com/sigstore/sigstore-go module update to v1.2.0
Crossplane v2.2.4 updates the github.com/sigstore/sigstore-go module to v1.2.0.
securityCombined grpc, x/net, and x/text dependency updates
Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.

Crossplanev2.1.8Orchestration & ManagementJul 23, 2026

ACTION 7OTHER 1View full analysis

Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.

Action needed (7)

securityThe github.com/sigstore/rekor module at v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in Crossplane v2.1.8.
securityThe github.com/sigstore/timestamp-authority/v2 module at v2.1.0
The github.com/sigstore/timestamp-authority/v2 module is updated to v2.1.0 in Crossplane v2.1.8.
securityThe github.com/sigstore/cosign/v2 module at v2.6.3
The github.com/sigstore/cosign/v2 module is updated to v2.6.3 in Crossplane v2.1.8.
securityThe Go toolchain at 1.25.12
The Go toolchain is updated to 1.25.12 in Crossplane v2.1.8.
securityThe github.com/sigstore/sigstore-go module at v1.2.0
The github.com/sigstore/sigstore-go module is updated to v1.2.0 in Crossplane v2.1.8.
securityCombined grpc, x/net, and x/text dependency updates
Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.
securityThe golang.org/x/text module at v0.39.0
The golang.org/x/text module is updated to v0.39.0 in Crossplane v2.1.8.

Crossplanev1.20.11Orchestration & ManagementJul 23, 2026

ACTION 4OTHER 1View full analysis

A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.

Action needed (4)

securityThe github.com/sigstore/rekor module, updated to v1.5.2
The github.com/sigstore/rekor module is updated to v1.5.2 in the release-1.20 line.
securityThe Go toolchain, updated to 1.25.12
The Go toolchain is updated to 1.25.12 in the release-1.20 line.
securityThe alpine Docker tag, updated to v3.24
The alpine Docker tag is updated to v3.24 in the release-1.20 line.
securitySecurity updates for grpc, x/net, and x/text
Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.

Kubernetesv1.36.3Kubernetes CoreJul 23, 2026

OTHER 10View full analysis

A maintenance release with dependency updates and correctness fixes across scheduling, kubelet behavior, server-side apply, and kubeadm. It also includes a Go 1.26.5 build update, with no disclosed security advisories.

Kubernetesv1.35.7Kubernetes CoreJul 22, 2026

OTHER 6View full analysis

A maintenance release with fixes to kubeadm join and etcd learner promotion, reduced kubelet logging for missing optional annotations, and restored Cri-api JSON encoding compatibility. It also updates the build toolchain to Go 1.25.12.

Kubernetesv1.34.10Kubernetes CoreJul 22, 2026

PLAN 1OTHER 7View full analysis

A maintenance release with kubeadm and kubelet behavior corrections, a changed kubeadm timeout default, and a deferred Kubelet deprecation removal. It also includes a toolchain dependency update and no identified security advisories.

Plan ahead (1)

deprecatedKubelet configurations flags deprecation removal timelineremoval planned in 1.38
Applies if you configure Kubelet's configurations flags.

Kubescapev4.0.11SecurityJul 22, 2026

CHECK 1OTHER 31View full analysis

A feature and maintenance release that adds scanning, reporting, export, MCP, vulnerability-adaptor, and policy capabilities while correcting air-gapped, exception, scan, SARIF, and image-scan behavior. deploy-library now uses the embedded VAP bundle by default.

Check if affected (1)

breakingThe deploy-library bundle source
Applies if you use deploy-library.

Tektonv1.14.1CI/CD & App DeliveryJul 22, 2026

OTHER 1View full analysis

This release contains a pipeline validation defect correction. The recorded change allows result variable references in Pipeline task parameters, while no itemized release changes are provided here.

gRPCv1.83.0Networking & MessagingJul 22, 2026

CHECK 1View full analysis

This release includes a security-related default change in TLS key exchange. The change affects deployments that use TLS key exchange.

Check if affected (1)

securityPost-Quantum Cryptography as the default for TLS key exchange
Applies when TLS key exchange is used.

Linkerdedge-26.7.1Networking & MessagingJul 21, 2026

ACTION 1CHECK 1OTHER 58View full analysis

This release tightens Gateway API and service-port handling and corrects tracing identity construction. It also updates dependencies and shipped components, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

breakingUndefined service port requests disallowed
The destination component now disallows requests to service ports that are not defined.

Check if affected (1)

breakingGateway API checks during Helm installation
Applies when you use Helm.

Daprv1.18.2Orchestration & ManagementJul 21, 2026

ACTION 3OTHER 18View full analysis

A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.

Action needed (3)

securitymediumgithub.com/go-chi/chi/v5 updated for CVE-2025-69725
github.com/go-chi/chi/v5 is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo.mongodb.org/mongo-driver and github.com/dapr/components-contrib updates
go.mongodb.org/mongo-driver is updated to v1.17.7, and the github.com/dapr/components-contrib dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.

Limav2.2.0Kubernetes CoreJul 21, 2026

CHECK 3OTHER 18View full analysis

An experimental feature release adds guest, CLI, template, VM-driver, and device capabilities. It also changes the Windows default driver and socket_vmnet access constraint, removes a host dependency, and updates nerdctl.

Check if affected (3)

breakingThe default VM driver, from wsl2 to qemu
Applies if you do not configure the VM driver.
breakingThe socket_vmnet access constraint
Applies if you use socket_vmnet.
breakingThe almalinux-kitten template, moved to experimental/
Applies if you use almalinux-kitten.

OpenTelemetryv0.157.0ObservabilityJul 21, 2026

CHECK 1PLAN 1OTHER 11View full analysis

This release adds configuration and feature-gate capabilities, corrects defects, changes histogram bucket values, and introduces the configstorage module. It also removes or deprecates API symbols, with no security issues or advisories identified.

Check if affected (1)

breakingThe BalancerName function, removed
Applies if you use BalancerName.

Plan ahead (1)

deprecatedThe WithForceUnmarshaler option, deprecated
Applies if you use WithForceUnmarshaler.

metal3-iov0.13.2Provisioning & RuntimeJul 21, 2026

OTHER 5View full analysis

This release restores a previously missing permission and updates the CAPI, Go, cert-manager, and etcd dependencies. No security advisories or security-specific fixes are disclosed.

metal3-iov0.12.6Provisioning & RuntimeJul 21, 2026

OTHER 3View full analysis

This release restores delete permission on secrets and updates the CAPI dependency and Go toolchain version. No security advisories or operator actions are specified.

OpenCostv1.121.0ObservabilityJul 20, 2026

CHECK 1OTHER 14View full analysis

This release combines new cost data and collection capabilities with operational updates. Endpoint access defaults change, and the release includes corrections across pricing, pagination, request handling, providers, and serialization.

Check if affected (1)

breakingEndpoint defaults, deactivated without an admin token
Applies if you use endpoints without setting an admin token.

KubeVelav1.11.0CI/CD & App DeliveryJul 20, 2026

CHECK 3OTHER 67View full analysis

A release with operator-facing authorization and credential-handling fixes, alongside new Helm, CUE, and workflow capabilities. It also adds validation improvements and dependency updates.

Check if affected (3)

securityExplicit authorization for vela-system definitions
Applies if you use vela-system definitions.
securityCredential redaction for Terraform module remote URLs
Applies if you configure Terraform module remote URLs.
breakingUndeclared parameter validation in application definitions
Applies if you use application definitions.

Jaegerv2.20.0ObservabilityJul 20, 2026

ACTION 1CHECK 3PLAN 1OTHER 27View full analysis

A release with backend compatibility removals, forced migrations, new configuration and CLI capabilities, and correctness fixes across storage, extensions, and related components. It does not disclose security advisories or security-specific flaws.

Action needed (1)

breakingTemplate creation through esclient
Template creation moves to esclient, and legacy mapping rendering is retired.

Check if affected (3)

breakingSupport for elasticsearch v6, removed
Applies if you use elasticsearch v6.
breakingThe jaegermcp extension, merged into jaegerquery
Applies if you use the jaegermcp extension.
breakingExpired stable feature gates, removed
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedThe legacy flag, deprecated
Applies if you use legacy flag.

Thanosv0.42.2ObservabilityJul 17, 2026

View full analysis

Thanos v0.42.2 contains no reported operator-facing changes. There are no release-note updates that affect configuration, operation, or user-visible behavior.

Ciliumv1.19.6Networking & MessagingJul 16, 2026

CHECK 1OTHER 46View full analysis

A maintenance release with numerous correctness fixes, Gateway API and telemetry additions, dependency and image updates, and internal behavior changes. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingHelm handling of hostFirewall.enabled disablement
Applies when you use Helm to disable hostFirewall.enabled, toggling it from true to false.

Ciliumv1.18.12Networking & MessagingJul 16, 2026

OTHER 20View full analysis

Cilium v1.18.12 adds Gateway access-log configuration and BYOCNI loopback support. It also fixes policy, startup, Gateway validation, IPAM, and metric-label defects, while updating shipped images and dependencies; no security advisories or security-specific flaws are disclosed.

Ciliumv1.17.18Networking & MessagingJul 16, 2026

OTHER 10View full analysis

Cilium v1.17.18 contains ordinary correctness fixes, a new BYOCNI loopback capability, and dependency and image updates. No security advisories or operator actions are identified.

← NewerJul 29, 2026 – Jul 16, 2026Older →

Browse by month