# KEDA v2.21.0

> Orchestration & Management · 2026-09-23

A feature-rich release with new scalers, scaling behavior, metrics, and authentication options. It also includes breaking changes, security fixes, and broad dependency updates, so compatibility and upgrade requirements need review.

## Action needed
- **[security]** The `github.com/google/cel-go` module at v0.29.0
  - This release updates the `github.com/google/cel-go` module to v0.29.0.
- **[security]** The `github.com/google/cel-go` module at v0.30.0
  - This release updates the `github.com/google/cel-go` module to v0.30.0.
- **[security]** The `github.com/klauspost/compress` module at v1.18.7
  - This release updates the `github.com/klauspost/compress` module to v1.18.7.
- **[security]** The `github.com/prometheus/prometheus` module at v0.311.3
  - This release updates the `github.com/prometheus/prometheus` module to v0.311.3.
- **[security]** The `github.com/valyala/fasthttp` module at v1.70.0
  - This release updates the `github.com/valyala/fasthttp` module to v1.70.0.
- **[security]** The `golang.org/x/crypto` module at v0.56.0
  - This release updates the `golang.org/x/crypto` module to v0.56.0.
- **[security]** The `golang.org/x/mod` module at v0.40.0
  - This release updates the `golang.org/x/mod` module to v0.40.0.
- **[security]** The `golang.org/x/net` module at v0.56.0
  - This release updates the `golang.org/x/net` module to v0.56.0.
- **[security]** The `google.golang.org/grpc` module at v1.82.1
  - This release updates the `google.golang.org/grpc` module to v1.82.1.
- **[security]** Prometheus v0.312.0 with CVE fixes
  - The Prometheus dependency is updated to v0.312.0 to fix CVEs.
- **[breaking]** The `scaleOnInFlight` default
  - KEDA 2.21 adds `scaleOnInFlight`, with a default of `true`. Queue length now includes unfinished jobs already assigned to an agent.

## Check if affected
- **[security]** Explicit service account token audiences for `TriggerAuthentication` and `ClusterTriggerAuthentication`
  - Applies if you use `TriggerAuthentication` or `ClusterTriggerAuthentication`.
  - KEDA now enforces explicit service account token audiences for `TriggerAuthentication` and `ClusterTriggerAuthentication`. The change addresses CVE-2026-77524 and GHSA-637c-6jxx-4rwm.
- **[breaking]** Removal of deprecated Temporal scaler settings
  - Applies if the Temporal scaler configures `buildId`, `selectAllActive`, or `selectUnversioned`.
  - The Temporal scaler no longer accepts the deprecated `buildId`, `selectAllActive`, and `selectUnversioned` settings.

## Plan ahead
- **[deprecated]** The `Liiklus Scaler` deprecation
  - Applies if you use the `Liiklus Scaler`.
  - removal date not announced
  - KEDA deprecates the `Liiklus Scaler` because its upstream project is unmaintained. Removal is planned for a later KEDA release.

## Other recorded changes
- 90 (value_changed 34, defect_corrected 32, added 20, constraint_changed 4)

[Full analysis](https://ratatosk.io/en/releases/keda/v2.21.0)

[Original release notes](https://github.com/kedacore/keda/releases/tag/v2.21.0)