# SPIRE v1.16.0

> Security · 2026-11-05

A substantial feature and behavior release with experimental capabilities, new integrations, and broad correctness and performance fixes. It also changes behavior in ways that affect some existing attestors, plugins, and configuration setups, including security-related removals and breaking defaults.

## Check if affected
- **[security]** The mountinfo fallback, removed from the container locator
  - Applies if you use the `docker` or `k8s` workload attestor.
  - The mountinfo fallback has been removed from the container locator used by the `docker` and `k8s` workload attestors because it could be forged.
- **[breaking]** Agent SPIFFE IDs under `/spire/agent`
  - Applies if you use external plugins or configure `agent_path_template`.
  - Agent SPIFFE IDs must now reside under `/spire/agent`; attestations that produce other IDs fail unless the experimental `allow_nonconforming_agent_ids` configuration is set.
- **[breaking]** Rootless Podman attestation requirement
  - Applies if you use rootless Podman with the `docker` workload attestor and do not configure `use_rootless_podman`.
  - Rootless Podman workload attestation now requires the `use_rootless_podman` option in the `docker` workload attestor.
- **[breaking]** Broker API JWT-SVID service for admin and downstream entries
  - Applies if you use the Broker API for admin or downstream entries.
  - The Broker API no longer serves JWT-SVIDs for admin or downstream entries.
- **[breaking]** The `journal_id` column in `ca_journals`
  - Applies if you configure `disable_migration`.
  - The `ca_journals` table in the `sql` datastore gains a `journal_id` column reserved for future use. Deployments with `disable_migration` set are affected by this schema migration.
- **[breaking]** The `use_sync_authorized_entries` agent option, removed
  - Applies if you configure `use_sync_authorized_entries`.
  - The `use_sync_authorized_entries` agent option has been removed.

## Plan ahead
- **[deprecated]** Notifier plugins, deprecated in favor of BundlePublisher plugins
  - Applies if you use Notifier plugins.
  - Notifier plugins are deprecated in favor of BundlePublisher plugins.
- **[deprecated]** OIDC Discovery Provider certificate sections, deprecated
  - Applies if you configure `acme` or `serving_cert_file`.
  - The `acme` and `serving_cert_file` sections in the OIDC Discovery Provider are deprecated in favor of `serving_cert_source`.

## Other recorded changes
- 40 (added 18, defect_corrected 13, value_changed 6, constraint_changed 2, default_changed 1)

[Full analysis](https://ratatosk.io/en/releases/spire/v1.16.0)

[Original release notes](https://github.com/spiffe/spire/releases/tag/v1.16.0)