This is a maintenance release centered on configuration and generated-code behavior. It also changes an existing builder flag's effect on module regeneration and addresses runtime and validation issues.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
KEDA v2.20.1 is a maintenance release focused on operator-visible correctness. The documented fixes affect concurrent scaling behavior and scaler-watch event reporting.
Source ↗
A maintenance release with fixes for correctness defects and a change to the default availability of the error_flatten experiment. It also includes an internal implementation change with no operator-facing impact.
Check if affected (1)
breakingThe
error_flattenexperiment, enabled in OSSApplicability is not stated in the release notes.
A security-focused maintenance release updates the Go toolchain used to build official OPA binaries to address two disclosed standard-library vulnerabilities affecting OPA's HTTP handler and crypto builtins. Users who build their own binaries or images manage the Go version themselves.
Action needed (1)
securitymediumThe
Go 1.build toolchain update26. 4 OPA is built with
Go 1.in this release. The update fixes standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins, identified as26. 4 GO-2026-5037andGO-2026-5039.
This Crossplane release combines dependency maintenance with a new CLI check for upgrade readiness. The check scans a live v1.x control plane for features removed or changed in Crossplane v2 and reports what would break before an upgrade.
Action needed (1)
securityThe
golang.module, updated toorg/x/net v0.55. 0 The
golang.module is updated toorg/x/net v0.in Crossplane55. 0 v1.. The release note marks this dependency update as security-related, but does not identify a specific vulnerability.20. 9
A maintenance release with operator-facing security fixes and configuration changes across ingestion, distribution, and status pages. It also includes fixes for request handling, authentication, configuration exposure, gossip limits, and client and runtime panics.
Check if affected (3)
securityStored XSS protection in
Alertmanagerand Store Gateway status pagesApplies if you run
Alertmanageror Store Gateway.security
WrappedHistogramnative histogram size limitApplies if you use native histograms.
breakingDecompressed gzip output limit for
ParseProtoReaderand OTLP ingestionApplies if you use the OTLP ingestion path.
OpenFGA v1.17.1 combines correctness fixes with security-related Go toolchain and image dependency updates. The security updates address Go standard library vulnerabilities in the toolchain and released images.
Action needed (2)
securityThe
Gotoolchain, updated to1.26. 4 OpenFGA v1.17.1 updates the
Gotoolchain version to1.to address26. 4 Gostandard library vulnerabilities.security
grpc-health-probeupdated tov0.4. 52 Released images update
grpc-health-probetov0., rebuilt with4. 52 Go 1., so they no longer ship the Go standard library vulnerabilities addressed by this update.26. 4
Linkerd edge-26.6.1 fixes an HTTP body size-limit defect and updates several dependencies and the proxy component. No security advisories or security-specific flaws are described.
Source ↗
A maintenance release with a security fix for Envoy and operator-relevant correctness fixes across Istio ambient, gateway, routing, and CNI behavior. It also adds automatic fallback from the nftables backend to iptables when the bundled nft binary lacks JSON support.
Action needed (1)
securityhighCVE-2026-47774
Envoymemory exhaustion fixCVE-2026-47774 fixes an
Envoymemory exhaustion issue in which specially crafted HTTP/2 requests could bypass request header size accounting and trigger excessive memory use. The fix ships inEnvoy.
A maintenance release with a disclosed Envoy denial-of-service fix and additional correctness fixes. The security fix addresses memory exhaustion from specially crafted HTTP/2 requests, while the other corrections do not require setup changes.
Action needed (1)
securityhighThe
Envoydenial-of-service vulnerability CVE-2026-47774, fixedCVE-2026-47774 fixes an
Envoydenial-of-service vulnerability in which specially craftedHTTP/2requests could cause excessive memory consumption. The fix accounts for cookie header bytes during request header size validation and limits total decoded header size inHPACKprocessing.
A maintenance release with an Envoy denial-of-service security fix, defect corrections, new operator-facing capabilities, a dependency update, and removal of a feature-gate guard. The security fix addresses disclosed advisory CVE-2026-47774.
Action needed (1)
securityhighCVE-2026-47774
Envoydenial-of-service fixThe fix addresses CVE-2026-47774 in
Envoy, where specially crafted HTTP/2 requests could exhaust process memory because decoded header size was not fully limited during request validation.
Check if affected (1)
breaking
PILOT_ENABLE_ALPHA_GATEWAY_APIguard removed fromListenerSetApplies if you use the
ListenerSetAPI.
A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.
Action needed (1)
securityhigh
nghttp2patch for CVE-2026-27135The
nghttp2dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.
Check if affected (4)
securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 and do not enable
envoy..reloadable_features. http2_include_cookies_in_limits securityOAuth2 HMAC verification timing side-channel fix
Applies if you use
oauth2.breakingRouter transport-failure reason response body
Applies if you use the router and do not enable
envoy..reloadable_features. hide_transport_failure_reason_in_response_body - + 1 more on the release page
A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.
Action needed (2)
securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where
lodashwas vulnerable to code injection.securitymediumCVE-2026-42581
NettyHTTP/1.0 smuggling sanitizationCVE-2026-42581 is addressed in
Netty, correcting HTTP/1.0TEandCLcoexistence that bypassed smuggling sanitization.
Check if affected (15)
securitymediumCVE-2026-7500 account API access control
Applies if you use
account/api.securitymediumCVE-2026-8922 OIDC token introspection
notBeforehandlingApplies if you use
oidc.securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use
authentication/webauthn.- + 12 more on the release page
A maintenance release focused on security and correctness fixes. The remaining heading-only items have no operator-facing changes.
Action needed (1)
securityhighnghttp2 CVE-2026-27135 patch
The
nghttp2CVE-2026-27135 patch is applied in the release.
Check if affected (2)
securityhighHTTP/2 header list limits and cookie accounting
Applies if you use HTTP/2.
securityOAuth2 HMAC verification timing
Applies if you use oauth2.
Envoy v1.36.7 is a security-focused update with changes to HTTP/2 handling and OAuth2 authentication. It also includes an nghttp2 security patch, so deployments using these components are directly affected.
Action needed (1)
securityhighThe nghttp2 CVE-2026-27135 patch
Envoy
v1.applies the36. 7 nghttp2patch for CVE-2026-27135 in its HTTP/2 handling.
Check if affected (2)
securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 with configured header list or request-header limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use the OAuth2 filter.
Envoy v1.35.11 is a security-focused release with fixes in HTTP/2, OAuth2, and nghttp2. It also includes ordinary bug fixes and new statistics capabilities, while the security changes are the ones that require upgrading.
Action needed (1)
securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.35.11 applies the nghttp2 patch for CVE-2026-27135.
Check if affected (2)
securityhighHTTP/2 header limits and cookie accounting
Applies if you use HTTP/2 request header limits.
securityOAuth2 HMAC verification timing protection
Applies if you use OAuth2 HMAC verification.
A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.
Action needed (2)
securitycritical
google.update to 1.79.3golang. org/grpc The
google.dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.golang. org/grpc securitySymlink traversal fix in the
VMExportdirectory handlerThe
VMExportdirectory handler is fixed to prevent symlink traversal.
Plan ahead (1)
deprecatedDeprecated
kubevirt_vm_created_totalandkubevirt_vm_created_by_pod_totalrecording rulesApplies if you use
kubevirt_vm_created_totalorkubevirt_vm_created_by_pod_total.
KubeVirt v1.7.4 includes correctness fixes and behavior changes affecting PCI topology and IPv6 migration. It also updates the gRPC dependency to address CVE-2026-33186.
Action needed (1)
securitycriticalThe
google.dependency update for CVE-2026-33186golang. org/grpc KubeVirt v1.7.4 updates
google.to versiongolang. org/grpc 1.to remediate CVE-2026-33186.79. 3
KubeVirt v1.6.6 includes a dependency update for CVE-2026-33186. The recorded change affects the gRPC dependency shipped with this release.
Action needed (1)
securitycritical
google.update for CVE-2026-33186golang. org/grpc KubeVirt v1.6.6 bumps
google.to remediate CVE-2026-33186.golang. org/grpc
This release adds API and storage capabilities, updates API query naming and defaults, and includes correctness fixes. No security advisories or security-specific fixes are disclosed.
Action needed (1)
breakingThe
searchdepthdefault in the trace-summaries endpointThe default for
searchdepthchanged in the trace-summaries endpoint.
Version v2.3.0 adds workload configuration and telemetry capabilities while correcting wash and runtime defects. It also changes RBAC scope support and updates dependencies, including security patches and reported advisory fixes.
Action needed (2)
securityThe
wasmtime44.0.2 security patchThe release updates
wasmtimeto 44.0.2 as a security patch.securityReported dependency security advisories
The dependency set includes patches for reported security advisories.
This release contains no operator-facing changes in the provided release information. There are no recorded updates to assess for CRI-O v1.35.4.
Source ↗This release contains operator-facing corrections to container status image references and to debug logging for List* RPC calls. The recorded changes address a correctness issue after CRI-O restarts and reduce log verbosity to improve performance.
cri-o v1.34.9 fixes two correctness defects. The remaining listed headings do not describe operator-facing changes.
Source ↗This cri-o release, v1.33.13, contains a documented operator-facing correctness fix. The fix addresses a race condition that could cause cri-o to report exit code 255 when a container exits quickly.
Source ↗
containerd v2.1.8 includes a disclosed security correction identified by CVE-2026-46680 and GHSA-fqw6-gf59-qr4w. The release also contains operator-facing runtime and snapshotter changes in its broader changelog.
Action needed (1)
securityhighCVE-2026-46680 security correction
containerd v2.1.8 includes a correction for CVE-2026-46680, associated with GHSA-fqw6-gf59-qr4w.
A breaking release for CSI configuration also changes unused CRUSH rule handling and supported Kubernetes versions. It adds storage and object-store capabilities, including SSE-S3 with Vault Agent authentication, object-store account management, and encrypted OSD disk expansion.
Check if affected (2)
breakingCeph CSI operator for driver settings
Applies if you configure CSI driver settings.
breaking
ROOK_DELETE_UNUSED_CRUSH_RULESdefaultApplies if the Ceph mgr is running.
OpenFGA v1.17.0 adds configurable trace sampling and changes cache key generation. The release concerns deployments that configure tracing or depend on cache key behavior.
Action needed (1)
securityTLV-based cache key generation
OpenFGA v1.17.0 redesigns cache key generation with
TLVbinary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.
This release adds an API capability and updates the Go toolchain. It also contains correctness and performance fixes across protocol handling, monitoring, clustering, and stream and consumer operations.
Source ↗NATS v2.12.10 combines a new client API capability with correctness fixes across protocol handling, monitoring, clustering, and storage. It also changes stream and consumer constraints and scale-down behavior, removes a filestore check, and updates the Go toolchain.
Source ↗
A broad maintenance and feature release combines bug fixes with new capabilities, configuration options, and platform support. It also changes defaults, tightens operational constraints, and removes V2 Backing Images.
Check if affected (5)
breaking
V2 Backing ImagesremovalApplies if you use
V2 Backing Images.breakingThe
data-engine-cpu-maskdefault, changedApplies if you do not configure
data-engine-cpu-mask.breakingLive migration constraint for older CLI API versions
Applies if you use an engine image with a CLI API version older than 12.
- + 2 more on the release page
This release contains dependency upgrades with embedded correctness fixes. The recorded changes do not include item-level details beyond those upgrades.
Source ↗knative-v1.21.3 is a maintenance release for Knative. It includes a correction for a non-constant format string error and updates to project dependencies. No security advisories or security-specific flaws are identified.
Source ↗
A maintenance release with server and tooling fixes, an expanded maintenance-status access rule, and a Go toolchain dependency update. The documented fixes concern operators who depend on the prior maintenance restriction or the corrected server and build behavior.
Source ↗A maintenance release with correctness fixes and dependency updates. The golang. update addresses GO-2026-5026.
Action needed (1)
securitycriticalThe
golang.dependency update fororg/x/crypto GO-2026-5026The
golang.dependency is updated toorg/x/crypto v0.to address52. 0 GO-2026-5026.
A maintenance release that ends support for the v3. line and updates the Go toolchain used to compile binaries. No further patches will be issued for v3..
Plan ahead (1)
deprecatedThe
v3.line, end of support4
This release corrects a workflow retention purge failure for Azure Cosmos DB when the customStatus row is absent. Affected workflows recover automatically after upgrading to v1.17.9, with no manual scheduler intervention required.
Core v0.16.0 changes disabled-flag evaluations from returning an error to succeeding with reason DISABLED; resolved values remain unchanged and still use the caller-provided default. The compatibility change affects consumers that inspect reason or errorCode, call flagd directly over gRPC or OFREP, or import core/pkg/model.
flagd v0.16.0 changes evaluation of disabled flags. Disabled flags now resolve successfully with reason=DISABLED instead of returning a FLAG_DISABLED error.
This release adds scalers, configuration options, metrics, authentication modes, and compatibility improvements. Operators with custom RBAC need to account for the Kubernetes events API migration, and users of removed scaler settings need to update their configurations.
Check if affected (7)
securityCredential headers on cross-host redirects and HTTPS downgrades
Applicability is not stated in the release notes.
breaking
ScaledObjectname length validationApplies when a
ScaledObjectname exceeds 63 characters.breakingPositive
unprocessedEventThresholdvaluesApplies if you configure a non-positive
unprocessedEventThreshold.- + 4 more on the release page
Plan ahead (1)
deprecatedThe
buildId,selectAllActive, andselectUnversionedsettings, deprecatedApplies if you configure
buildId,selectAllActive, orselectUnversioned.