Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Limav2.1.2Kubernetes CoreJun 1, 2026

CHECK 1PLAN 1OTHER 34View full analysis

A feature and maintenance release with CLI and template changes, QEMU behavior updates, and fixes across drivers, hostagent, shell, and guest support. It also includes a deprecation, while no security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingQEMU 2MB OVMF images dropped by openSUSE
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedThe _LIMA_QEMU_UEFI_IN_BIOS flag, deprecated
Applies if you configure _LIMA_QEMU_UEFI_IN_BIOS.

Volcanov1.15.0Orchestration & ManagementJun 1, 2026

ACTION 4CHECK 2OTHER 83View full analysis

A feature and operational-hardening release that adds alpha scheduling capabilities, new scheduler and Helm configuration, and fixes scheduler and integration stability issues. Operators should review Kubernetes and DRA compatibility requirements, the changed DRA default, and the disclosed denial-of-service and Prometheus security fixes.

Action needed (4)

securitymediumPrometheus dependency update for GHSA-vffh-x6r8-xx99
Updates github.com/prometheus/prometheus to address stored XSS advisory GHSA-vffh-x6r8-xx99.
securitymediumAdmission webhook request body limits
The admission webhook now limits request bodies, fixing the denial-of-service risk identified by CVE-2026-44247 and GHSA-8wxp-xxp2-rcgx.
breakingDRA scheduling integration default
DRA scheduling integration is enabled by default.
breakingDRA scheduling integration default behavior
DRA scheduling integration is enabled by default to align with Kubernetes 1.34 and later behavior. Set predicate.DynamicResourceAllocationEnable to false to disable it.

Check if affected (2)

breakingOpt-in SchedulingGatesQueueAdmission
Applies if you enable SchedulingGatesQueueAdmission.
breakingOpt-in gang-aware preemption and reclamation
Applies if you configure gangPreempt and gangReclaim and do not configure preempt or reclaim.

Karmadav1.17.3Orchestration & ManagementMay 30, 2026

OTHER 4View full analysis

Karmada v1.17.3 is a maintenance release focused on operator-relevant bug fixes. The remaining release material consists of headings without standalone operator-facing changes.

Karmadav1.16.6Orchestration & ManagementMay 30, 2026

OTHER 3View full analysis

Karmada v1.16.6 is a maintenance release with operator-focused bug fixes. The note tail indicates fixes in cluster resource watching, scheduling under resource pressure, and transient cluster client failures, with no disclosed security advisories or security-specific fixes.

Karmadav1.15.9Orchestration & ManagementMay 30, 2026

OTHER 2View full analysis

Karmada v1.15.9 is a bug-fix release for operator-facing behavior. It addresses delayed resource reflection after recovered clusters reconnect in karmada-search and prevents transient ClusterClientSetFunc failures from immediately setting a cluster to Ready=False in karmada-controller-manager.

Karmadav1.18.0Orchestration & ManagementMay 30, 2026

ACTION 1CHECK 9OTHER 35View full analysis

A feature and maintenance release that adds overflow scheduling and scheduling overcommit protection, along with API, default, constraint, metric, and flag changes. It also includes a security-related alpine base-image update and numerous defect corrections.

Action needed (1)

securityThe alpine base image update
The alpine base image has changed from alpine:3.23.3 to alpine:3.23.4 to address security concerns.

Check if affected (9)

breakingThe overflowAffinities field
Applies if you configure overflowAffinities.
breakingStricter clusterTolerations operator validation
Applies if you set spec.placement.clusterTolerations with Lt or Gt.
breakingThe operator's default verbosity level
Applies if you run the operator.
+ 6 more on the release page

Linkerdedge-26.5.5Networking & MessagingMay 29, 2026

OTHER 3View full analysis

This Linkerd release contains dependency version updates. No functional or security changes are stated, and the dependency updates are applied as part of the release without operator setup changes.

OpenFeaturecore/v0.15.8CI/CD & App DeliveryMay 29, 2026

OTHER 1View full analysis

This release contains an operator-facing bug fix. The documented fix addresses a panic when an S3 URI includes a query string.

OpenFeatureflagd/v0.15.7CI/CD & App DeliveryMay 29, 2026

OTHER 1View full analysis

This release contains an operator-facing bug fix for flagd. It addresses a panic when an S3 URI includes a query string.

OpenCostv1.120.3ObservabilityMay 29, 2026

ACTION 1CHECK 1OTHER 51View full analysis

A maintenance release with dependency updates, correctness fixes, and new cloud and query capabilities. Configuration and output behavior also change, along with a Go dependency upgrade for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Action needed (1)

securityhighGo dependency upgrades for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986
Go dependencies are upgraded for GHSA-xmrv-pmrh-hhx2 and CVE-2026-34986.

Check if affected (1)

breakingThe MCP_SERVER_ENABLED default is false
Applies if you do not configure MCP_SERVER_ENABLED.

Backstagev1.51.1CI/CD & App DeliveryMay 29, 2026

OTHER 4View full analysis

Backstage v1.51.1 is a maintenance release focused on corrected defects and package dependency behavior. The available release information indicates fixes in query handling, GitLab repository retrieval, runtime dependency classification, and Microsoft Graph group-member filtering.

Confidential Containersv0.21.0SecurityMay 29, 2026

ACTION 1PLAN 4OTHER 16View full analysis

A release with Trustee, KBS, attestation, and platform-support changes, plus a security advisory fix. It also deprecates several CAA components and images planned for removal in 0.22.

Action needed (1)

securityGHSA-84rc-2q4r-45pc advisory fix
The release patches GHSA-84rc-2q4r-45pc in the guest components.

Plan ahead (4)

deprecatedpacker-built CAA podvm image deprecationdeprecated since 0.17 · removal planned in 0.22
Applies if you use the packer-built CAA podvm image.
deprecatedCAA docker provider deprecationdeprecated since 0.20 · removal planned in 0.22
Applies if you use the CAA docker provider.
deprecatedFedora-based mkosi-built CAA podvm image deprecationdeprecated since 0.20 · removal planned in 0.22
Applies if you use the Fedora-based mkosi-built CAA podvm image.
+ 1 more on the release page

Linkerdedge-26.5.4Networking & MessagingMay 29, 2026

OTHER 15View full analysis

This release updates dependencies and component versions across Linkerd. It also corrects resource labels in policy-k8s outbound indexer logs.

gRPCv1.81.0Networking & MessagingMay 29, 2026

OTHER 4View full analysis

grpc v1.81.0 fixes three correctness issues and changes the default state of the error_flatten experiment. It also includes an internal SSL implementation change with no stated operator impact.

Kubescapev4.0.9SecurityMay 29, 2026

ACTION 3CHECK 3OTHER 105View full analysis

A broad maintenance release with correctness fixes, new CLI and reporting capabilities, anonymization updates, a performance improvement, added validation, and dependency refreshes. It also includes security fixes alongside changes to output and push defaults.

Action needed (3)

securityDependency updates for security advisories
Dependencies are updated to address security advisories.
securityEnvFrom clearing in container data removal
removeContainersData now clears EnvFrom to prevent secret name leakage.
securityEnv[].ValueFrom clearing in container data removal
removeContainersData and removeEphemeralContainersData now clear Env[].ValueFrom.

Check if affected (3)

security/v1/results access control hardening
Applies if you use /v1/results.
breakingThe pdf/html output default changed to file output
Applies if you use pdf/html output.
breakingThe push default changed to opt-in
Applies if you use push.

Daprv1.17.8Orchestration & ManagementMay 28, 2026

CHECK 1OTHER 1View full analysis

A maintenance release corrects a workflow retentioner defect and constrains forwarded-host handling during Sentry OIDC discovery. The discovery change affects deployments that use Sentry OIDC.

Check if affected (1)

securityConstrained X-Forwarded-Host use during Sentry OIDC discovery
Applies if you use Sentry OIDC.

Cloud Custodian0.9.51.0SecurityMay 28, 2026

CHECK 1OTHER 90View full analysis

This is a broad operator-focused multi-cloud release with additions and extensions across AWS, Azure, and especially GCP. It also includes defect fixes and dependency updates, with no security advisories or explicit vulnerability disclosures noted.

Check if affected (1)

breakingThe json-diff filter for aws.iam-access-key, removed
Applies if your policies use the json-diff filter on aws.iam-access-key.

SPIREv1.15.1SecurityMay 28, 2026

CHECK 1OTHER 2View full analysis

SPIRE v1.15.1 includes a security correction for Azure IMDS node attestation. The release also updates the golang.org/x/net and golang.org/x/crypto dependencies.

Check if affected (1)

securityAzure IMDS node attestation validation
Applies if you use the azure_imds server node attestor plugin.

OpenFeaturecore/v0.15.7CI/CD & App DeliveryMay 28, 2026

OTHER 1View full analysis

This release is labeled as containing new features, but the supplied release note does not describe a specific operator-facing change. No detailed feature behavior or affected component is stated.

OpenFeatureflagd-proxy/v0.9.6CI/CD & App DeliveryMay 28, 2026

OTHER 1View full analysis

This release adds support for custom headers in the OpenFeature flagd proxy. The recorded changes do not include a specific implementation item for this release.

OpenFeatureflagd/v0.15.6CI/CD & App DeliveryMay 28, 2026

OTHER 1View full analysis

This release adds support for custom headers in flagd. The remaining release-note entry is a heading without a recorded change detail.

SPIREv1.14.7SecurityMay 28, 2026

CHECK 1OTHER 2View full analysis

SPIRE v1.14.7 fixes a security vulnerability in Azure IMDS node attestation. It also updates the Go toolchain to 1.26.3 and updates three dependencies.

Check if affected (1)

securityThe azure_imds node attestor validation is corrected
Applies if you use the azure_imds server node attestor plugin.

Contourv1.33.5Networking & MessagingMay 28, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a security fix for invalid HTTPProxy configurations and an update to golang.org/x/net. It also updates the Go toolchain to 1.25.10 and is tested against Kubernetes 1.32 through 1.34.

Action needed (1)

securitycriticalgolang.org/x/net updated to v0.55.0, CVE-2026-39821
Contour v1.33.5 updates golang.org/x/net to v0.55.0. The change addresses CVE-2026-39821.

Check if affected (1)

securitymediumInvalid HTTPProxy configuration rejected, GHSA-g3xr-5w5j-w4q4
Applies if you configure HTTPProxy with a fallback certificate and enable JWT verification.

Prometheusv3.12.0ObservabilityMay 28, 2026

ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

breakingConcurrent fgprof profile rejection
The API rejects concurrent fgprof profiles.

Check if affected (3)

securityRemote Write decoded-length constraint
Applies if you use Remote Write.
securityPlaintext secret exposure in STACKIT SD
Applies if you use STACKIT SD.
breakingDecompressed body-size limit for OTLP write requests
Applies if you use OTLP.

OpenFGAv1.16.1SecurityMay 28, 2026

ACTION 1OTHER 3View full analysis

OpenFGA v1.16.1 includes a third-party dependency update for multiple CVEs in the Go standard library. It also corrects defects in the experimental weighted_graph_check behavior.

Action needed (1)

securityThe grpc-health-probe dependency update
grpc-health-probe is updated to v0.4.50 to address multiple CVEs in the Go standard library.

Open Policy Agent (OPA)v1.17.0SecurityMay 28, 2026

OTHER 22View full analysis

OPA v1.17.0 adds improved negation semantics, decision-log rule labels, published schemas, and API capabilities. It also includes correctness and performance improvements, removes two dependencies, and upgrades several others.

Argov3.3.11CI/CD & App DeliveryMay 28, 2026

ACTION 1OTHER 6View full analysis

Argo CD v3.3.11 contains bug fixes and a UI dependency update addressing CVE-2026-41240. The release concerns deployments using the affected UI dependency.

Action needed (1)

securitymediumThe redoc/dompurify dependency, updated to v3.4.0
The /ui dependency redoc/dompurify is updated to v3.4.0 to address CVE-2026-41240.

Argov3.4.3CI/CD & App DeliveryMay 28, 2026

CHECK 1OTHER 8View full analysis

A maintenance release with several correctness fixes across Argo CD and a UI dependency update addressing CVE-2026-41240. The recorded fixes cover CLI, UI, Git, controller startup, and resource handling.

Check if affected (1)

securitymediumThe redoc/dompurify dependency, upgraded for CVE-2026-41240
Applies if you use redoc/dompurify in /ui.

Rookv1.19.6Storage & DataMay 27, 2026

ACTION 1OTHER 8View full analysis

This release includes a security-related dependency update in CI. The change affects builds that use golang.org/x/net.

Action needed (1)

securitycriticalThe golang.org/x/net dependency, updated to v0.55.0
CI updates golang.org/x/net from its previous version to v0.55.0 to fix GO-2026-5026.

Rookv1.18.11Storage & DataMay 27, 2026

OTHER 4View full analysis

Rook v1.18.11 changes OSD installation and liveness probe behavior, corrects CSI priority-class handling, and updates a third-party dependency. No security issue is disclosed.

Flatcar Container Linuxstable-4593.2.2Provisioning & RuntimeMay 27, 2026

ACTION 1OTHER 2View full analysis

Flatcar stable-4593.2.2 is a maintenance release with Linux security fixes. It also updates Linux to 6.12.91 and ca-certificates to 3.124.

Action needed (1)

securitycriticalLinux security fixes
Linux security fixes for CVE-2024-36476, CVE-2024-39282, CVE-2024-53681, CVE-2024-54031, CVE-2024-57795, CVE-2024-57801, CVE-2024-57802, CVE-2024-57841, CVE-2024-57844, CVE-2024-57857, CVE-2024-57882, CVE-2024-57883, CVE-2024-57884, CVE-2024-57885, CVE-2024-57886, CVE-2024-57887, CVE-2024-57888, CVE-2024-57889, CVE-2024-57890, CVE-2024-57891, CVE-2024-57892, CVE-2024-57893, CVE-2024-57894, CVE-2024-57895, CVE-2024-57896, CVE-2024-57897, CVE-2024-57898, CVE-2024-57899, CVE-2024-57900, CVE-2024-57901, CVE-2024-57902, CVE-2024-57903, CVE-2024-57930, CVE-2024-57931, CVE-2024-57932, CVE-2024-57933, CVE-2024-57934, CVE-2024-57935, CVE-2024-57936, CVE-2024-57937, CVE-2024-57938, CVE-2024-58237, CVE-2025-21629, CVE-2025-21630, CVE-2026-43490, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43502, CVE-2026-43503, CVE-2026-46300, and CVE-2026-46333 ship in Flatcar stable-4593.2.2.

Flatcar Container Linuxlts-4081.3.8Provisioning & RuntimeMay 27, 2026

ACTION 1OTHER 1View full analysis

This Flatcar LTS release contains Linux security fixes identified by CVEs, plus ca-certificates and Linux component updates. It is most relevant to deployments tracking the lts-4081.3.8 release.

Action needed (1)

securitycriticalLinux security fixes for CVE-2026-43316
Linux receives security fixes associated with the listed CVEs, including CVE-2026-43316. The update ships in Flatcar LTS lts-4081.3.8.

Falco0.44.0SecurityMay 26, 2026

ACTION 1CHECK 5OTHER 34View full analysis

A release that removes several supported engines and outputs and restricts falco-webui access. It also adds rule and configuration capabilities, includes defect fixes and dependency updates, and discloses no security advisory.

Action needed (1)

breakinggRPC server support, removed
gRPC server support is removed in this release.

Check if affected (5)

securityPlugin library path traversal prevention
Applies if you configure the plugin library path.
breakingThe gRPC output, removed
Applies if you use the gRPC output.
breakingThe gVisor engine, removed
Applies if you use the gVisor engine.
+ 2 more on the release page

OpenTelemetryv0.153.0ObservabilityMay 25, 2026

CHECK 3OTHER 14View full analysis

This release updates configuration and metadata handling, with new schema and configuration capabilities and several API and feature-gate maturity changes. It also fixes Snappy memory corruption and fatal errors.

Check if affected (3)

breakingThe pdata.useCustomProtoEncoding feature gate, removed
Applies if you use pdata.useCustomProtoEncoding.
breakingDefault reaggregation_enabled behavior
Applies if you run cmd/mdatagen.
breakingStricter feature_gates validation
Applies if you configure feature_gates in metadata.yaml.

Crossplanev2.3.1Orchestration & ManagementMay 22, 2026

ACTION 1CHECK 13OTHER 1View full analysis

A maintenance release includes dependency updates and security fixes in golang.org/x/crypto. The fixes cover SSH, SSH agent, and known-hosts behavior.

Action needed (1)

securitygolang.org/x/crypto updated to v0.52.0
The release updates the golang.org/x/crypto module to v0.52.0.

Check if affected (13)

securitycriticalUnenforced invoking key constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
securitycriticalDropped invoking agent constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
securitycriticalServer deadlock on unexpected responses in golang.org/x/crypto/ssh
Applies if you use golang.org/x/crypto/ssh.
+ 10 more on the release page

Crossplanev1.20.8Orchestration & ManagementMay 22, 2026

ACTION 7OTHER 1View full analysis

Crossplane v1.20.8 is a dependency and toolchain maintenance release. It updates several modules and the Go version, with the recorded dependency changes addressing security fixes, and also bumps crossplane-runtime to v1.20.8.

Action needed (7)

securityThe github.com/docker/cli module, updated to v29.2.0+incompatible
The github.com/docker/cli module is updated to v29.2.0+incompatible in the release-1.20 branch.
securityThe golang.org/x/net module, updated to v0.53.0
The golang.org/x/net module is updated to v0.53.0 in the release-1.20 branch.
securityThe github.com/in-toto/in-toto-golang module, updated to v0.11.0
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module, updated to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in the release-1.20 branch.
securityThe Go toolchain, updated to 1.25.10
Go is updated to 1.25.10 to fix standard-library CVEs in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module, updated to v5.19.1
The github.com/go-git/go-git/v5 module is updated again, to v5.19.1, in the release-1.20 branch.
securityThe golang.org/x/crypto module, updated to v0.52.0
The golang.org/x/crypto module is updated to v0.52.0 in the release-1.20 branch.

OpenFeaturecore/v0.15.6CI/CD & App DeliveryMay 22, 2026

View full analysis

This release contains no described operator-facing changes. No release-note details are provided for this version.

Crossplanev2.1.6Orchestration & ManagementMay 22, 2026

ACTION 6CHECK 1OTHER 1View full analysis

A security-focused maintenance release updates Go and several dependencies, including a fix for an HTTP/2 transport infinite-loop vulnerability. The Go and dependency version increases require upgrading; no configuration migration or deprecation is announced.

Action needed (6)

securityThe go.opentelemetry.io/otel module update
The go.opentelemetry.io/otel module is updated to v1.41.0 in this release.
securityThe github.com/in-toto/in-toto-golang module update
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in this release.
securityThe github.com/go-git/go-git/v5 module update to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in this release.
securityGo 1.25.10
Go is updated to 1.25.10 to fix standard library CVEs.
securityThe github.com/go-git/go-git/v5 module update to v5.19.1
The github.com/go-git/go-git/v5 module is updated to v5.19.1 in this release.
securityThe golang.org/x/crypto module update
The golang.org/x/crypto module is updated to v0.52.0 in this release.

Check if affected (1)

securityhighThe golang.org/x/net HTTP/2 transport infinite loop
Applicability is not stated in the release notes.

Crossplanev2.2.2Orchestration & ManagementMay 22, 2026

ACTION 5OTHER 1View full analysis

Crossplane v2.2.2 is a dependency and toolchain maintenance release with security-focused updates. It concerns deployments and builds that rely on the updated Go toolchain and modules.

Action needed (5)

securitygithub.com/in-toto/in-toto-golang updated to v0.11.0
Crossplane v2.2.2 updates the github.com/in-toto/in-toto-golang module to v0.11.0. The update ships in the release-2.2 line.
securitygithub.com/go-git/go-git/v5 updated to v5.19.0
Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.0. The update ships in the release-2.2 line.
securityGo 1.25.10 update for standard-library CVEs
Crossplane v2.2.2 updates Go to 1.25.10 to fix standard-library CVEs. The toolchain update ships in the release-2.2 line.
securitygithub.com/go-git/go-git/v5 updated to v5.19.1
Crossplane v2.2.2 updates the github.com/go-git/go-git/v5 module to v5.19.1. The update ships in the release-2.2 line.
securitygolang.org/x/crypto updated to v0.52.0
Crossplane v2.2.2 updates the golang.org/x/crypto module to v0.52.0. The update ships in the release-2.2 line.

wasmCloudv2.2.1Orchestration & ManagementMay 21, 2026

OTHER 2View full analysis

This release corrects the runtime operator's generated and Helm RBAC permissions. The fixes cover finalizer updates needed for garbage collection and permissions for resources used by reconcilers; no security advisory or security flaw is disclosed.

← NewerJun 1, 2026 – May 21, 2026Older →

Browse by month