# CRI-O v1.37.2

> Kubernetes Core · 2026-10-02

A maintenance release that updates the release bundle SBOM format and raises the required `bom` validation-tool version. No security change is stated.

## Action needed
- **[breaking]** Release bundle SBOM format
  - Release bundle SBOMs now use SPDX 3.0.1 JSON-LD and the `.spdx.json` suffix instead of SPDX 2.3 tag-value files with the `.spdx` suffix.

## Check if affected
- **[breaking]** `bom` validation version requirement
  - Applicability is not stated in the release notes.
  - Validating the release bundle SBOMs with `bom` requires version 0.8.0 or later.

[Full analysis](https://ratatosk.io/en/releases/cri-o/v1.37.2)

[Original release notes](https://github.com/cri-o/cri-o/releases/tag/v1.37.2)