# CloudNativePG v1.30.1

> Storage & Data · 2026-09-23

A maintenance release focused on correctness and failover reliability. It includes recovery and lifecycle fixes, a PostgreSQL image update, and security fixes.

## Action needed
- **[security · high]** The `google.golang.org/grpc` dependency, updated
  - The `google.golang.org/grpc` dependency was updated to v1.83.1. The update fixes `CVE-2026-84304` and `GHSA-vp52-pcj8-j9qc`, involving gRPC-Go heap memory exhaustion through HTTP/2 DATA frame fragmentation.

## Check if affected
- **[security]** Extension path validation
  - Applies if you configure an extension path.
  - The webhook now rejects absolute extension paths containing `..` traversal instead of checking only the raw path. This prevents the resolved path from escaping the extension's mount point at runtime.
- **[breaking]** The default PostgreSQL operand image, updated
  - Applies if you do not configure the PostgreSQL operand image.
  - The default PostgreSQL operand image is now `18.6-system-trixie`. This default ships for PostgreSQL operands without a configured image.

## Other recorded changes
- 38 (defect_corrected 31, added 3, value_changed 3, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/cloudnativepg/v1.30.1)

[Original release notes](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.30.1)