RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Ciliumv1.17.18Networking & MessagingJul 16, 2026
OTHER 10View full analysis

Cilium v1.17.18 contains ordinary correctness fixes, a new BYOCNI loopback capability, and dependency and image updates. No security advisories or operator actions are identified.

Source ↗
Thanosv0.42.1ObservabilityJul 16, 2026
OTHER 1View full analysis

This release corrects overly small timeouts in the Receiver's Shipper component. The available release information does not include a recorded change item to describe in more detail.

Source ↗
Istio1.29.6Networking & MessagingJul 16, 2026
OTHER 5View full analysis

Istio 1.29.6 is a correctness-focused maintenance release. The fixes address ambient traffic draining, HBONE capability propagation, ambient CNI responsiveness, Istiod memory use, and cross-network traffic through east-west gateways.

Source ↗
Istio1.30.3Networking & MessagingJul 16, 2026
OTHER 14View full analysis

Istio 1.30.3 is a maintenance release focused on operator-facing updates, performance work, and defect corrections. The listed release material includes fixes across certificate rotation, ambient mode, waypoint routing, multicluster behavior, and Istiod scalability.

Source ↗
KubeEdgev1.23.1Provisioning & RuntimeJul 15, 2026
CHECK 1OTHER 7View full analysis

A feature and behavior release that adds Windows and device-management capabilities, changes edge database and node-querying behavior, and updates the Kubernetes dependency. Device status retrieval now uses the new DeviceStatus CRD.

Check if affected (1)

  • breakingThe DeviceStatus CRD for device status retrieval

    Applies if you use the DeviceStatus CRD.

Source ↗
KubeEdgev1.22.2Provisioning & RuntimeJul 15, 2026
OTHER 10View full analysis

KubeEdge v1.22.2 combines defect corrections with new operator-facing capabilities, Beehive restart-policy support, device-model API changes, and an upgrade to Kubernetes v1.31.12. No security advisories or security-specific fixes are disclosed.

Source ↗
KubeEdgev1.21.2Provisioning & RuntimeJul 15, 2026
CHECK 6PLAN 1OTHER 10View full analysis

This release combines correctness fixes with changes to node-job behavior, operator capabilities, and command workflows. It introduces configuration updates for edge nodes, which are disabled by default and require an EdgeCore restart; no security advisories are identified.

Check if affected (6)

  • breakingThe v1alpha2 NodeUpgradeJob and ImagePrePullJob defaults

    Applies if you use NodeUpgradeJob or ImagePrePullJob.

  • breakingNode-job switching constraint

    Applies if you use NodeUpgradeJob or ImagePrePullJob.

  • breakingThe taskManager node-job module, disabled by default

    Applies if EdgeCore is running.

  • + 3 more on the release page

Plan ahead (1)

  • deprecatedThe v1alpha1 NodeUpgradeJob and ImagePrePullJob jobs, deprecated

    Applies if you use NodeUpgradeJob or ImagePrePullJob.

Source ↗
Litmus3.31.0ObservabilityJul 15, 2026
ACTION 1OTHER 9View full analysis

Release 3.31.0 contains a dependency update addressing vulnerabilities in graphql/server. It also includes correctness fixes across probes, GraphQL, authentication, infrastructure, and experiment handling.

Action needed (1)

  • securityDependencies in graphql/server updated

    Dependencies in graphql/server are updated to fix vulnerabilities. The update ships in Release 3.31.0.

Source ↗
KServev0.18.1AI & MLJul 15, 2026
OTHER 1View full analysis

KServe v0.18.1 is a maintenance release with a Helm chart defect fix identified in the release metadata. No individual change details are available here.

Source ↗
Envoyv1.39.0Networking & MessagingJul 14, 2026
CHECK 11OTHER 50View full analysis

A broad release with operator-facing changes across configuration, protocols, extensions, networking, and observability. Security fixes address multiple identified CVEs and a GHSA, while changed defaults, stricter input validation, and removed functionality may affect existing deployments.

Check if affected (11)

  • securityhighHTTP/2 header limits and flood protection

    Applies if you use HTTP/2.

  • securityhighHTTP/3 QPACK and content-length security fixes

    Applies if you use HTTP/3.

  • securityhighAdditional protocol, parser, formatter, and decompression security fixes

    Applies if you use DNS query validation, JSON nesting limits, PROXY protocol TLV, the formatter, TCP StatsD, TLS SAN, or Zstd decompression.

  • + 8 more on the release page
Source ↗
Backstagev1.53.0CI/CD & App DeliveryJul 14, 2026
ACTION 1CHECK 12PLAN 3OTHER 259View full analysis

A substantial mixed feature and maintenance release adds backend, frontend, catalog, authentication, webhook, and TechDocs capabilities alongside dependency updates and defect fixes. It also includes operator-visible changes to APIs, configuration validation, OpenAPI tooling, and MCP transport behavior; no security advisories or security-specific fixes are disclosed.

Action needed (1)

  • breakingOpenAPI breaking change detection with oasdiff

    @useoptic/optic and @useoptic/openapi-utilities have been replaced with oasdiff for OpenAPI breaking change detection.

Check if affected (12)

  • breakingSchema loading rejects invalid imports

    Applicability is not stated in the release notes.

  • breakingThe package schema openapi init and repo schema openapi test commands, removed

    Applies if you use package schema openapi init or repo schema openapi test.

  • breakingMutually exclusive userGroupMember.path and user.filter configuration

    Applies if you configure both userGroupMember.path and user.filter.

  • + 9 more on the release page

Plan ahead (3)

  • deprecatedOpaque entity header extension point deprecation

    Applies if you use the opaque entity header extension point.

  • deprecatedDynamic Client Registration deprecation warning

    Applies if you enable Dynamic Client Registration.

  • deprecatedStable auth.clientIdMetadataDocuments configuration

    Applies if you configure auth.clientIdMetadataDocuments or auth.experimentalClientIdMetadataDocuments.

Source ↗
Buildpacksv0.40.8CI/CD & App DeliveryJul 13, 2026
CHECK 1OTHER 3View full analysis

A maintenance release rebuilds the pack on Go 1.25.12 to address two disclosed standard library security issues. It also updates several dependencies and includes a newer default lifecycle version.

Check if affected (1)

  • securityhighGo 1.25.12 standard library rebuild for GO-2026-4970 and GO-2026-5856

    Applies if you use 1.25.11 -> 1.25.12.

Source ↗
Fluxv2.9.2CI/CD & App DeliveryJul 13, 2026
OTHER 3View full analysis

Flux v2.9.2 includes an operator-relevant regression fix for Kustomizations whose openapi.path points to a URL, along with dependency and toolkit component updates. CRD description corrections are documentation-only.

Source ↗
wasmCloudv2.5.2Orchestration & ManagementJul 10, 2026
OTHER 5View full analysis

wasmCloud v2.5.2 adds asynchronous PostgreSQL support and WIT and wkg configuration resolution. It also improves HTTP recognition and default capability backend handling, while including dependency and internal tooling updates.

Source ↗
Daprv1.16.17Orchestration & ManagementJul 10, 2026
OTHER 1View full analysis

Dapr v1.16.17 fixes Scheduler handling for actor reminder and job names and actor IDs that were accepted at the API edge but rejected by stricter DNS-1123 validation. It also corrects the related validation error and actor metadata handling, with no operator action required beyond upgrading.

Source ↗
CoreDNSv1.14.6Kubernetes CoreJul 10, 2026
OTHER 4View full analysis

This release changes dependency composition and CoreDNS behavior. It adds a forward plugin directive and expands secondary-plugin zone support, while also addressing a non-64-bit build defect through a dependency adjustment.

Source ↗
Kyvernov1.18.2SecurityJul 10, 2026
ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with operator-relevant fixes and behavior changes, plus security work in the 1.18 release line. It includes namespace-boundary enforcement for generators and security dependency updates.

Action needed (1)

  • securitySecurity dependency updates

    Security dependency updates from #16340 are backported to release-1.18.

Check if affected (1)

  • securityNamespace-boundary enforcement in generator.apply()

    Applies if you use generator.apply().

Source ↗
CoreDNSv1.14.5Kubernetes CoreJul 10, 2026
ACTION 1CHECK 1OTHER 30View full analysis

A release with operator-visible behavior corrections, new capabilities, configuration changes, and updated defaults. The changes span CoreDNS core behavior and multiple plugins, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

  • breakingGo TLS defaults in core

    The core component uses Go TLS defaults in this release.

Check if affected (1)

  • breakingDefault truncate amount for bare truncate

    Applies if you configure truncate.

Source ↗
containerdv2.3.3Kubernetes CoreJul 10, 2026
CHECK 2OTHER 7View full analysis

A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.

Check if affected (2)

  • breakingThe CreateContainer constraint for stopped sandboxes

    Applies if you use CreateContainer when the sandbox is not running.

  • breakingThe erofs default mkfs block size

    Applies if you use erofs across platforms.

Source ↗
containerdv2.2.6Kubernetes CoreJul 9, 2026
ACTION 1OTHER 3View full analysis

A maintenance release with CRI and image-distribution fixes. The CRI constraint on CreateContainer requests may require action, while the other fixes take effect through the upgrade.

Action needed (1)

  • breakingCreateContainer rejection for stopped sandboxes

    The CRI now rejects CreateContainer requests when the sandbox is not running. This constraint ships in containerd v2.2.6.

Source ↗
containerdv2.0.11Kubernetes CoreJul 9, 2026
OTHER 2View full analysis

containerd v2.0.11 fixes content storage pollution by limiting the fallback used during reference resolution. It also updates the Go toolchain to 1.26.5 and 1.25.12.

Source ↗
Helmv3.21.3Kubernetes CoreJul 9, 2026
ACTION 1OTHER 1View full analysis

This release includes a security-related dependency cleanup and a dependency update. The github.com/containerd/containerd dependency moves from 1.7.32 to 1.7.33.

Action needed (1)

  • securityThe containerd v1 dependency, removed

    The containerd v1 dependency is removed in Helm v3.21.3 to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.

Source ↗
Helmv4.2.3Kubernetes CoreJul 9, 2026
OTHER 1View full analysis

Helm v4.2.3 is a maintenance release that updates the third-party dependency golang.org/x/crypto from 0.53.0 to 0.54.0. The remaining release content concerns release navigation and a general upgrade recommendation.

Source ↗
SPIREv1.15.2SecurityJul 9, 2026
ACTION 2CHECK 1OTHER 32View full analysis

A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.

Action needed (2)

  • securityMigration from github.com/docker/docker to github.com/moby/moby

    Dependencies from github.com/docker/docker were migrated to their github.com/moby/moby equivalents to resolve CVEs. The migration ships in this release.

  • breakingRPC metrics from agent health check loopback calls

    Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.

Check if affected (1)

  • breakingJWT-SVID serving by the delegated API

    Applies if you use the delegated API for admin or downstream entries.

Source ↗
Argov3.4.5CI/CD & App DeliveryJul 9, 2026
OTHER 8View full analysis

v3.4.5 is a maintenance release focused on correctness fixes and dependency updates. No security advisory or vulnerability is disclosed.

Source ↗
Flatcar Container Linuxstable-4593.2.4Provisioning & RuntimeJul 9, 2026
ACTION 1OTHER 2View full analysis

This Flatcar release is a security update focused on fixes for disclosed Linux vulnerabilities. It also updates the Linux and ca-certificates dependencies.

Action needed (1)

Source ↗
Flatcar Container Linuxlts-4081.3.9Provisioning & RuntimeJul 9, 2026
ACTION 1OTHER 2View full analysis

This Flatcar release is a security update with fixes for Linux issues identified by CVE advisories. It also updates Linux and ca-certificates.

Action needed (1)

Source ↗
Prometheusv3.5.5ObservabilityJul 9, 2026
ACTION 1OTHER 1View full analysis

Prometheus v3.5.5 includes a Go 1.25.12 toolchain change and a disclosed security fix in the UI. The security fix concerns the sanitize-html dependency and CVE-2026-53606.

Action needed (1)

  • securitymediumThe sanitize-html dependency update for CVE-2026-53606

    The Prometheus UI updates sanitize-html to v2.17.5 to fix CVE-2026-53606.

Source ↗
Keycloak26.7.0SecurityJul 9, 2026
ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

  • securityPre-account takeover attack exposure

    The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

Plan ahead (4)

  • deprecatedThe V1 API, deprecated

    Applies if you use V1.

  • deprecatedThe Require Discoverable Credential option, deprecated

    Applies if you configure the Require Discoverable Credential option.

  • deprecatedThe Twitter IDP implementation, deprecated

    Applies if you use the Twitter IDP implementation.

  • + 1 more on the release page
Source ↗
TiKVv8.5.7Storage & DataJul 9, 2026
ACTION 1CHECK 1OTHER 41View full analysis

A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.

Action needed (1)

  • securityThird-party dependency upgrades for TiKV 8.5

    TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.

Check if affected (1)

  • breakingInvalid max_ts updates rejected by default

    Applies if you do not set storage.max-ts.action-on-invalid-update.

Source ↗
cert-managerv1.21.0SecurityJul 8, 2026
CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

  • securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258

    Applies if you use the cert-manager-edit aggregate ClusterRole.

  • breakingObjectReference API removal

    Applies if you use ObjectReference in an API.

  • breakingPrometheus ServiceMonitor and PodMonitor Helm value removal

    Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.

  • + 2 more on the release page

Plan ahead (2)

  • deprecatedGateway API controller configuration fields

    Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.

  • deprecatedServerSideApply feature gate deprecation

Source ↗
etcdv3.7.0Kubernetes CoreJul 8, 2026
ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if you configure --listen-client-http-urls.

Source ↗
Thanosv0.42.0ObservabilityJul 8, 2026
ACTION 1CHECK 4OTHER 19View full analysis

A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.

Action needed (1)

  • securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186

    The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.

Check if affected (4)

  • securityReceive tenant ID validation

    Applies if you run Receive.

  • breakingQuery-Frontend time_taken field renamed to time_taken_ms

    Applies if you run Query-Frontend.

  • breaking--shipper.ignore-unequal-block-size flag removed

    Applies if you configure --shipper.ignore-unequal-block-size.

  • + 1 more on the release page
Source ↗
gRPCv1.82.1Networking & MessagingJul 8, 2026
CHECK 1View full analysis

A dependency-focused release raises the minimum supported Python protobuf version. The headings contain no operator-facing changes.

Check if affected (1)

  • breakingThe Python protobuf dependency lower bound, raised

    Applies if you use Python.

Source ↗
Tektonv1.6.5CI/CD & App DeliveryJul 8, 2026
ACTION 1View full analysis

This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.

Action needed (1)

  • securityGo 1.25.10 dependency update

    Go is updated to 1.25.10 for CVE remediation in this release.

Source ↗
Tektonv1.9.6CI/CD & App DeliveryJul 8, 2026
ACTION 3View full analysis

Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang.org packages, with no specific advisory identifiers or vulnerability details in the note.

Action needed (3)

  • securityGo 1.25.10 update

    Go is updated to 1.25.10 for CVE remediation in v1.9.6.

  • securitygolang.org/x/crypto v0.52.0 update

    golang.org/x/crypto is updated to v0.52.0 for CVE remediation in v1.9.6.

  • securitygolang.org/x/net v0.55.0 update

    golang.org/x/net is updated to v0.55.0 for CVE remediation in v1.9.6.

Source ↗
Rookv1.20.2Storage & DataJul 7, 2026
OTHER 11View full analysis

Rook v1.20.2 includes dependency updates, behavioral changes, and fixes across Ceph, CSI, core, security, and storage operations. The release also tightens the manager NetworkPolicy to ingress-only; no vulnerability or advisory is disclosed.

Source ↗
Artifact Hubv1.23.0CI/CD & App DeliveryJul 7, 2026
View full analysis

Version v1.23.0 contains no recorded changes for artifact-hub. The release note does not identify any project change that requires a user-facing description.

Source ↗
← NewerOlder →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023