# CloudNativePG v1.29.3

> Storage & Data · 2026-09-23

A maintenance release with failover, recovery, observability, and cleanup fixes, along with a webhook validation correction and a vulnerable dependency update. Users on the 1.29 series are outside support and need a newer supported minor release.

## Action needed
- **[security · high]** The `google.golang.org/grpc` dependency update for CVE-2026-84304
  - Updated `google.golang.org/grpc` to v1.83.1. The update fixes CVE-2026-84304 and GHSA-vp52-pcj8-j9qc, involving gRPC-Go heap memory exhaustion through HTTP/2 DATA frame fragmentation.
- **[security]** Webhook extension-path validation
  - Webhook validation now rejects an absolute extension path containing an embedded `..` traversal instead of accepting it based only on the raw path. This prevents the resolved path from escaping the extension's mount point at runtime.

## Check if affected
- **[breaking]** The 1.29.x release line, ended
  - Applies if you use the 1.29 series.
  - This is the final release in the 1.29.x series. The 1.29 series is no longer supported, and newer minor versions are the supported release line.

## Other recorded changes
- 38 (defect_corrected 29, added 3, value_changed 2, default_changed 2, renamed 1, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/cloudnativepg/v1.29.3)

[Original release notes](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.3)