# RATATOSK Daily AI analysis of CNCF release notes: breaking changes, security patches, and what to do about them. Search and filters (by project, category, or period) are available in the web UI: https://ratatosk.io/en/releases ## Recent releases - [Keycloak 26.8.1](https://ratatosk.io/en/releases/keycloak/26.8.1) — A security-focused maintenance release with vulnerability fixes across authentication, administration, identity brokering, authorization, token exchange, and observability. It also updates vulnerable `jackson-databind` and `simple-git` dependencies and includes further corrections in clustering, organizations, token handling, and HTTP processing. (2026-10-13) [action 7, check 21] - [Envoy v1.39.4](https://ratatosk.io/en/releases/envoy/v1.39.4) — A maintenance release fixes concurrency races in route and shared configuration handling. It also corrects Prometheus native histogram bucket indices; no operator configuration changes are stated. (2026-10-12) - [Strimzi 1.3.0](https://ratatosk.io/en/releases/strimzi/1.3.0) — A behavior-changing release tightens Kubernetes and CRD requirements, changes feature-gate defaults, and removes Kaniko from Connect image builds. It also adds early-access cluster security and cert-manager integrations, newer Kafka and HTTP Bridge support, service-account token mounts, and dashboard updates; no security fixes are disclosed. (2026-10-12) [action 4, check 1, plan 1] - [Envoy v1.38.7](https://ratatosk.io/en/releases/envoy/v1.38.7) — A maintenance release with a disclosed security dependency update and fixes for concurrency and metrics correctness. No operator configuration changes are announced. (2026-10-12) [action 1] - [Envoy v1.37.9](https://ratatosk.io/en/releases/envoy/v1.37.9) — A maintenance release with a disclosed security dependency update and fixes for concurrency bugs. It contains no announced operator configuration changes. (2026-10-12) [action 1] - [Envoy v1.36.13](https://ratatosk.io/en/releases/envoy/v1.36.13) — A security maintenance release updates Wasmtime and fixes several race conditions in AWS request signing, AWS Lambda, local rate limiting, and secret distribution. It introduces no newly enforced configuration or behavioral requirements. (2026-10-12) [action 1] - [KubeVirt v1.9.1](https://ratatosk.io/en/releases/kubevirt/v1.9.1) — A maintenance release focused on correctness fixes and dependency updates. It includes fixes across guest behavior, storage, migration, hardware handling, and deployment configuration, with no disclosed security changes. (2026-10-12) - [Open Policy Agent (OPA) v1.21.2](https://ratatosk.io/en/releases/opa/v1.21.2) — A maintenance release with updated Go and networking dependencies and security advisory pointers. It also corrects encoded-slash handling in basic authorization policy input and the Data API. (2026-10-12) - [Argo v3.5.5](https://ratatosk.io/en/releases/argo/v3.5.5) — A maintenance release with correctness fixes and dependency updates. It does not intentionally change operator setup or security behavior. (2026-10-12) - [Argo v3.3.16](https://ratatosk.io/en/releases/argo/v3.3.16) — A maintenance release focused on bug fixes and dependency updates, with no stated changes requiring operator reconfiguration. (2026-10-12) - [Argo v3.4.11](https://ratatosk.io/en/releases/argo/v3.4.11) — A maintenance release focused on correctness fixes and dependency updates. No operator-facing configuration or compatibility changes are called out. (2026-10-12) - [Meshery v1.0.71](https://ratatosk.io/en/releases/meshery/v1.0.71) — A maintenance release removes an adapter and corrects server, CLI, and UI behavior. No security changes are disclosed. (2026-10-11) [action 1, check 1] - [Dapr v1.18.7](https://ratatosk.io/en/releases/dapr/v1.18.7) — A maintenance release focused on correctness, with fixes for sidecar crashes, data races, resource leaks, request mix-ups, and excessive logging. It does not introduce operator-facing configuration changes. (2026-10-09) - [NATS v2.15.1](https://ratatosk.io/en/releases/nats/v2.15.1) — A maintenance release focused on correctness and performance, with a legacy gateway behavior removed and new limits and validations that may affect existing configurations. It also includes fixes across authentication, account and subscription handling, configuration reloads, clustering, storage, consumers, and client operations. (2026-10-09) [check 5] - [NATS v2.14.8](https://ratatosk.io/en/releases/nats/v2.14.8) — A maintenance release focused on correctness and performance. It removes a legacy gateway capability and tightens related ingress behavior, alongside fixes across authentication, configuration, routing, and stream handling. (2026-10-09) [action 1, check 2] - [Harbor v2.15.4](https://ratatosk.io/en/releases/harbor/v2.15.4) — A patch release that restores private-network webhook behavior by default and changes legacy signer handling. It also updates the bundled Trivy, Trivy adapter, and Distribution components, with no disclosed security changes. (2026-10-09) [check 3] - [Dapr v1.18.5](https://ratatosk.io/en/releases/dapr/v1.18.5) — A corrective maintenance release focused on workflow reliability, scheduler stability, messaging delivery guarantees, observability, and shutdown behavior. It also adds configuration options for event handling and checkpoint frequency. (2026-10-08) - [Argo v3.4.10](https://ratatosk.io/en/releases/argo/v3.4.10) — A maintenance release with routine dependency updates, bug fixes, and improved release provenance for container images and CLI binaries. It also includes an undisclosed coordinated security fix that requires an upgrade. (2026-10-06) [action 1] - [Argo v3.5.4](https://ratatosk.io/en/releases/argo/v3.5.4) — A maintenance release with several correctness fixes, a coordinated security fix, and a small logging enhancement. It has no documented operator-facing breaking changes. (2026-10-06) [action 1] - [OpenFGA v1.22.0](https://ratatosk.io/en/releases/openfga/v1.22.0) — A feature and maintenance release adds MySQL read-replica support, updates dependencies, and raises the minimum Go version. It also corrects SQL timestamp reporting and includes a gRPC update for `GO-2026-6443`. (2026-10-06) [action 1, check 3] - [Rook v1.21.0](https://ratatosk.io/en/releases/rook/v1.21.0) — A breaking release changes Helm chart and Ceph defaults and removes automatic setup for some resources and images. It also adds storage and object-management capabilities, so chart references, kernel compatibility, new NFS installs, and custom CSI image settings may need review. (2026-10-06) [check 4] - [Envoy v1.39.3](https://ratatosk.io/en/releases/envoy/v1.39.3) — A security maintenance release fixes two Envoy filter crashes. The fixes include safer handling of CONNECT requests without a `:path` header. (2026-10-06) [check 2] - [Envoy v1.38.6](https://ratatosk.io/en/releases/envoy/v1.38.6) — A security maintenance release fixes two request-triggered crashes in Envoy filters. One unsafe request pattern is rejected with HTTP 400. (2026-10-06) [check 2] - [Envoy v1.37.8](https://ratatosk.io/en/releases/envoy/v1.37.8) — A security maintenance release fixes crashes in the Envoy `oauth2` and `api_key_auth` filters. The `oauth2` filter now rejects requests without a `:path` header with HTTP `400`, while the other fix covers a specific `hide_credentials` and query key source configuration. (2026-10-06) [check 2] - [Jaeger v2.22.0](https://ratatosk.io/en/releases/jaeger/v2.22.0) — This release adds span search and pagination, promotes several feature gates, and includes numerous correctness fixes. It introduces no disclosed security changes. (2026-10-06) [action 1] - [Envoy v1.36.12](https://ratatosk.io/en/releases/envoy/v1.36.12) — A security maintenance release fixes two Envoy filter crash vulnerabilities. The `oauth2` filter now rejects malformed requests without a `:path` header with HTTP `400`. (2026-10-06) [check 2] - [Harbor v2.15.3](https://ratatosk.io/en/releases/harbor/v2.15.3) — A security-focused maintenance release with numerous vulnerability fixes, dependency updates, and defensive limits. It also includes routine correctness, logging, and dependency maintenance changes. (2026-10-06) [action 16, check 1] - [Linkerd edge-26.10.1](https://ratatosk.io/en/releases/linkerd/edge-26.10.1) — A maintenance release focused on dependency updates and a proxy version update. It does not state any changes to operator behavior. (2026-10-05) - [Lima v2.2.1](https://ratatosk.io/en/releases/lima/v2.2.1) — A maintenance release focused on correctness, compatibility, performance, and template updates. It also changes a minimum toolchain requirement and a QEMU/HVF default, so those environments may require attention. (2026-10-03) [action 1, check 2] - [Prometheus v3.13.4](https://ratatosk.io/en/releases/prometheus/v3.13.4) — A security-focused maintenance release updates a vulnerable Go dependency and refreshes UI npm dependencies. It also includes fixes for rollback compatibility, native histogram corruption, and failing scrapes. (2026-10-02) [action 2] - [wasmCloud v2.10.3](https://ratatosk.io/en/releases/wasmcloud/v2.10.3) — A maintenance release with dependency updates and correctness fixes for workload and plugin state cleanup. It includes fixes for state that outlived unbind, failed-stop cleanup, plugin unbind handling, and storage recreation, with no announced operator configuration changes. (2026-10-02) - [CRI-O v1.36.7](https://ratatosk.io/en/releases/cri-o/v1.36.7) — Nothing here needs operator attention. (2026-10-02) - [CRI-O v1.34.15](https://ratatosk.io/en/releases/cri-o/v1.34.15) — Nothing here needs operator attention. (2026-10-02) - [CRI-O v1.35.10](https://ratatosk.io/en/releases/cri-o/v1.35.10) — Nothing here needs operator attention. (2026-10-02) - [CRI-O v1.37.2](https://ratatosk.io/en/releases/cri-o/v1.37.2) — A maintenance release that updates the release bundle SBOM format and raises the required `bom` validation-tool version. No security change is stated. (2026-10-02) [action 1, check 1] - [Cloud Custodian 0.9.53.0](https://ratatosk.io/en/releases/cloud-custodian/0.9.53.0) — A feature-rich release expands resource and action coverage across AWS, Azure, GCP, Kubernetes, and core functionality. It also includes correctness fixes and behavior changes in existing AWS and Kubernetes integrations. (2026-10-01) [action 2] - [wasmCloud v2.10.2](https://ratatosk.io/en/releases/wasmcloud/v2.10.2) — A maintenance release covering runtime, gateway, registry, and logging correctness, along with dependency updates. No operator reconfiguration is stated. (2026-10-01) - [Envoy v1.39.2](https://ratatosk.io/en/releases/envoy/v1.39.2) — A security and packaging release that fixes a remotely exploitable TLS denial of service and removes Debian bullseye packaging. It also refreshes the Ubuntu build and distroless Docker base images without noted runtime configuration changes. (2026-10-01) [action 1, check 1] - [Envoy v1.38.5](https://ratatosk.io/en/releases/envoy/v1.38.5) — A security and packaging maintenance release with a BoringSSL fix for a remotely exploitable denial-of-service issue. It also removes Debian bullseye packaging and includes internal release-build updates. (2026-10-01) [action 2] - [Envoy v1.37.7](https://ratatosk.io/en/releases/envoy/v1.37.7) — A maintenance release with a BoringSSL fix for remote denial of service during TLS handshakes and the removal of Debian bullseye packaging. The fix does not apply to FIPS BoringSSL builds. (2026-10-01) [action 1, check 1] - [Vitess v24.0.4](https://ratatosk.io/en/releases/vitess/v24.0.4) — A security-focused maintenance release tightens TLS revocation and table ACL enforcement, removes a legacy `vtctld` HTTP surface, and includes compatibility changes for upgrades and Go package users. It also changes lz4 compression semantics and adds operational gRPC connection metrics. (2026-10-01) [action 6, check 1, plan 1] - [Vitess v23.0.7](https://ratatosk.io/en/releases/vitess/v23.0.7) — A security-focused maintenance release closes TLS certificate revocation, table ACL, and legacy HTTP API attack surfaces. It also changes compression behavior, strengthens statement permission checks, and removes or deprecates `vtctld` interfaces that may affect compatible clients and Go package users. (2026-10-01) [action 6, plan 1] - [Envoy v1.36.11](https://ratatosk.io/en/releases/envoy/v1.36.11) — A security-focused maintenance release fixes a remotely exploitable TLS denial-of-service issue in `BoringSSL`. Debian 11 packaging is no longer shipped, and the FIPS build remains unpatched for the TLS issue. (2026-10-01) [action 2] - [Flux v2.9.6](https://ratatosk.io/en/releases/flux/v2.9.6) — A patch release focused on controller correctness, cache and reconciliation fixes, safer error redaction, and an opt-in feature gate. It does not require mandatory operator configuration changes. (2026-10-01) - [Tekton v1.17.0](https://ratatosk.io/en/releases/tekton/v1.17.0) — A feature and maintenance release that adds opt-in observability and parameter support. It also corrects several issues, including a Windows script-injection defense gap, and refreshes dependencies. (2026-10-01) [action 1] - [Keycloak 26.8.0](https://ratatosk.io/en/releases/keycloak/26.8.0) — A security-focused release with broad fixes across identity brokering, OIDC, OID4VCI, SCIM, LDAP, session handling, and credential policies. It also changes brute-force detection to persist data in the database by default, adds administration and deployment capabilities, and deprecates several compatibility, clustering, and session features. (2026-10-01) [action 21, check 64, plan 10] - [Keycloak 26.7.5](https://ratatosk.io/en/releases/keycloak/26.7.5) — A security-focused maintenance release with CVE fixes across authentication and authorization flows, along with updates to affected dependencies. It also contains correctness and stability fixes, including a new client-role requirement for Identity Provider management in the admin UI. (2026-09-30) [action 4, check 11] - [Volcano v1.15.3](https://ratatosk.io/en/releases/volcano/v1.15.3) — A focused maintenance release fixes scheduler quota accounting and PodGroup/node handling defects. It adds no new operator-facing features. (2026-09-30) - [Volcano v1.13.5](https://ratatosk.io/en/releases/volcano/v1.13.5) — A small correctness-focused maintenance release fixes stale `PodGroup` annotation updates. Recreated Pods no longer receive updates that could leave them Pending with a deleted `PodGroup`. (2026-09-30) - [Volcano v1.14.6](https://ratatosk.io/en/releases/volcano/v1.14.6) — A maintenance release focused on correcting PodGroup handling and scheduler stability. It prevents stale PodGroup updates from affecting recreated Pods and avoids nil-pointer panics during incremental scheduler snapshot updates. (2026-09-30)