Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Kubernetesv1.37.0Kubernetes CoreAug 26, 2026

ACTION 6CHECK 35PLAN 5OTHER 403View full analysis

A feature-rich major API release with new capabilities, scheduling and node improvements, maturity promotions, and correctness and performance fixes. Upgrade planning includes API and feature-gate removals, deprecated interface cleanup, and SELinux and kubelet configuration changes that may require manifest, client, or cluster adjustments.

Action needed (6)

securityMalformed object deletion admission handling
An edge case that could allow malformed object deletion to bypass admission and graceful deletion of well-formed objects is removed.
breakingThe WatchListCompression default
This behavior is enabled by default and can be disabled with the WatchListCompression feature gate.
breakingThe EtcdRangeStream feature gate
The EtcdRangeStream feature gate is enabled by default and promoted to Beta.
breakingThe AllowUnsafeMalformedObjectDeletion feature gate
The AllowUnsafeMalformedObjectDeletion feature gate is promoted to Beta and enabled by default. List errors for objects that cannot be read from storage include the first underlying cause in the error message.
breakingThe PodLevelResourceManagers default
The PodLevelResourceManagers feature gate is disabled by default because of issues found before release.
breakingkube-scheduler list-type attribute evaluation
kube-scheduler evaluates list-type attributes, the .includes function, and CEL macros even when the ListTypeAttributes feature gate is disabled. This prevents errors during rolling upgrades or when the feature gate is toggled.

Check if affected (35)

securitykubeconfig migration permissions
Applies if you configure a kubeconfig file for migration.
breakingThe SELinuxMount default
Applies if your cluster has SELinux enabled.
breakingThe Workload-Aware Scheduling API types
Applies if you use scheduling.k8s.io/v1alpha2 or scheduling.k8s.io/v1beta1.
+ 32 more on the release page

Plan ahead (5)

deprecatedThe kube-proxy ipvs modedeprecated since v1.35
Applies if you run kube-proxy's ipvs mode.
deprecatedThe v1alpha1 DRAResourceHealth APIremoval planned in v1.40
Applies if you use the v1alpha1 DRAResourceHealth API.
deprecatedThe kubectl run --filename and -f flags
Applies if you configure --filename or -f.
+ 2 more on the release page

wasmCloudv2.8.0Orchestration & ManagementAug 25, 2026

ACTION 1CHECK 1OTHER 16View full analysis

A feature-and-maintenance release adds async messaging and host/runtime controls. It also changes defaults, refreshes dependencies, and includes a disclosed security dependency fix.

Action needed (1)

securityThe h2 dependency update for RUSTSEC-2026-0258
The h2 dependency is bumped to 0.4.17 for RUSTSEC-2026-0258. The update ships in this release.

Check if affected (1)

breakingEmbedder OCI and socket defaults
Applies if you use the embedder subsystem.

Backstagev1.54.5CI/CD & App DeliveryAug 25, 2026

OTHER 4View full analysis

A maintenance release focused on correctness fixes for catalog ownership references, filtering, and software template rendering. It requires no operator action.

Linkerdedge-26.8.4Networking & MessagingAug 25, 2026

OTHER 3View full analysis

A maintenance release with two correctness fixes and a Go toolchain dependency update. It also improves TLSRoute compatibility across Gateway API versions.

OpenFGAv1.19.0SecurityAug 25, 2026

CHECK 1OTHER 18View full analysis

A maintenance release with dependency updates, correctness fixes, logging changes, and an internal streaming optimization. Previously persisted malformed models now fail with ErrInvalidModel on a cache miss instead of running degraded.

Check if affected (1)

breakingMalformed RelationReference models rejected on cache miss
Applicability is not stated in the release notes.

metal3-iov0.13.3Provisioning & RuntimeAug 25, 2026

OTHER 7View full analysis

A maintenance release with RBAC permission additions, dependency and toolchain updates, and a pinned Ironic version for end-to-end testing. Existing operators do not need to take action.

metal3-iov0.12.7Provisioning & RuntimeAug 25, 2026

OTHER 5View full analysis

A maintenance release with dependency and toolchain updates, plus expanded deletion permission for HostUpdatePolicies. No security changes are disclosed.

Backstagev1.54.4CI/CD & App DeliveryAug 24, 2026

View full analysis

Nothing here needs operator attention.

CRI-Ov1.35.7Kubernetes CoreAug 24, 2026

ACTION 1View full analysis

A security maintenance release fixes a vulnerability involving newline handling in the HOME environment variable. The fix addresses a bypass that could allow /etc/passwd injection.

Action needed (1)

securityhighCVE-2026-15809 newline handling in HOME
Fixes CVE-2026-15809, which allowed /etc/passwd injection through newline characters in the HOME environment variable. The check now matches actual newline bytes instead of the literal string "\n".

CRI-Ov1.36.4Kubernetes CoreAug 24, 2026

OTHER 2View full analysis

A small maintenance release adds per-container targeting for CPU load balancing, IRQ load balancing, and CPU quota annotations. It also fixes a CRI-O crash during pod sandbox statistics collection when a container cgroup is cleaned up during teardown.

Backstagev1.54.3CI/CD & App DeliveryAug 22, 2026

View full analysis

Nothing here needs operator attention.

Linkerdedge-26.8.3Networking & MessagingAug 21, 2026

OTHER 26View full analysis

A maintenance release focused primarily on dependency version updates across the project. The Linkerd proxy is updated to v2.366.0, with no security advisories or operator-enforced breaking changes described.

Crossplanev1.20.12Orchestration & ManagementAug 21, 2026

ACTION 5OTHER 3View full analysis

A maintenance release with security-related dependency and toolchain updates, along with routine dependency and runtime version changes. No advisory identifiers are stated.

Action needed (5)

securityVulnerable dependency fixes
Vulnerable dependencies were updated in the release-1.20 branch.
securityVulnerable dependency updates
Vulnerable dependencies were updated in the release-1.20 branch.
securityThe github.com/go-git/go-git/v5 module update
The github.com/go-git/go-git/v5 module was updated to version v5.19.2 in the release-1.20 branch.
securityThe golang.org/x/mod module update
The golang.org/x/mod module was updated to version v0.40.0 in the release-1.20 branch.
securityThe Go toolchain version 1.25.13
The Go toolchain was updated to version 1.25.13 in the release-1.20 branch.

Crossplanev2.2.5Orchestration & ManagementAug 21, 2026

ACTION 1OTHER 2View full analysis

A maintenance release corrects binary checksum generation and deletion-protection indexing, and updates dependencies for upstream CVE fixes. The changes affect release verification, webhook deletion checks, and the dependency set shipped with the release.

Action needed (1)

securityDependency security updates
The release updates cel-go, golang.org/x/mod, sigstore-go, and go-git, along with a combined set of vulnerable dependency updates, to pick up upstream CVE fixes. It also bumps crossplane-runtime to v2.2.4, which carries its own security dependency updates.

Crossplanev2.3.5Orchestration & ManagementAug 21, 2026

ACTION 4OTHER 4View full analysis

A maintenance release that corrects checksum handling and an ambiguous Usage index key, alongside security-sensitive dependency updates and build dependency changes. The dependency updates require upgrading; no operator configuration migration is stated.

Action needed (4)

securityThe golang.org/x/mod dependency update
The golang.org/x/mod dependency is updated in this release.
securityThe github.com/sigstore/sigstore-go module update
The github.com/sigstore/sigstore-go module is updated to v1.2.1 in this release.
securityThe github.com/google/cel-go module update
The github.com/google/cel-go module is updated to v0.30.0 in this release.
securityThe crossplane-runtime dependency update
The crossplane-runtime dependency is updated to v2.3.4 in this release.

SPIREv1.15.3SecurityAug 21, 2026

OTHER 22View full analysis

This release adds attestors, plugins, configuration options, and CLI/API capabilities. It also updates dependencies and includes behavior changes and defect fixes, with no security advisories or explicitly described vulnerabilities.

hamiv2.10.0AI & MLAug 21, 2026

ACTION 3CHECK 7OTHER 195View full analysis

A substantial operator-focused maintenance release with broad bug and behavior fixes, alongside new scheduling, device, configuration, and observability capabilities. It also updates security-relevant dependencies and the runtime/toolchain while removing obsolete functionality that may affect compatibility and configuration.

Action needed (3)

securitytensorflow/tensorflow upgraded to 2.21.0rc0-gpu
The tensorflow/tensorflow dependency is upgraded from 2.20.0rc0-gpu to 2.21.0rc0-gpu.
securitytensorflow/tensorflow upgraded to 2.21.0rc1-gpu
The tensorflow/tensorflow dependency is upgraded from 2.21.0rc0-gpu to 2.21.0rc1-gpu.
securitygolang security upgrade
The golang runtime is upgraded to address a security issue.

Check if affected (7)

breakingDRA components removed from the HAMi main chart
Applies if you use DRA components in the HAMi main chart.
breakingWebhook denial of privileged containers
Applies if you use the webhook.
breakingDeprecated scheduler policy configmap removed
Applies if you configure the deprecated scheduler policy configmap.
+ 4 more on the release page

Rookv1.20.6Storage & DataAug 20, 2026

CHECK 2OTHER 1View full analysis

A maintenance release with a Ceph security advisory, a disabled Rook manager module, and clearer CephX fallback errors. Users of Ceph are advised to upgrade, while CephX key fallback failures now report the actual error.

Check if affected (2)

securityCeph CVE-2025–30156 upgrade advisory
Applies if you depend on Ceph.
breakingThe rook mgr module, disabled
Applies if you enable the rook mgr module.

Rookv1.19.10Storage & DataAug 20, 2026

ACTION 1CHECK 1OTHER 2View full analysis

This release calls attention to a Ceph security advisory and disables the Rook manager module. It also updates CephCluster warning handling and reports the actual error when CephX key fallback fails.

Action needed (1)

breakingThe rook mgr module, disabled
The rook mgr module is disabled in this release.

Check if affected (1)

securityhighCeph CVE-2025-30156 advisory
Applies if you depend on Ceph.

Crossplanev2.4.0Orchestration & ManagementAug 20, 2026

ACTION 15CHECK 4PLAN 1OTHER 33View full analysis

A release with breaking operational changes, new runtime behavior, and correctness fixes. It also updates the Go toolchain and dependencies for security fixes, including changes that affect CLI publication, package operation, and resource deletion.

Action needed (15)

securityGo version and dependency security updates
Crossplane now builds and runs with a newer Go version to include standard library CVE fixes. The release also includes security updates to Crossplane's Go dependencies.
securityGo 1.25.10
Go was updated to 1.25.10 to fix standard library CVEs.
securitygolang.org/x/crypto v0.52.0
The golang.org/x/crypto module was updated to v0.52.0 for security fixes.
securitygolang.org/x/sys v0.44.0
The golang.org/x/sys module was updated to v0.44.0 for security fixes.
securitygolang.org/x/net v0.55.0
The golang.org/x/net module was updated to v0.55.0 for security fixes.
securitygithub.com/sigstore/cosign/v3 v3.0.6
The github.com/sigstore/cosign/v3 module was updated to v3.0.6 for security fixes.
securitygithub.com/sigstore/rekor v1.5.2
The github.com/sigstore/rekor module was updated to v1.5.2 for security fixes.
securitygithub.com/sigstore/timestamp-authority/v2 v2.1.0
The github.com/sigstore/timestamp-authority/v2 module was updated to v2.1.0 for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.0
The github.com/sigstore/sigstore-go module was updated to v1.2.0 for security fixes.
securityCombined grpc, x/net, and x/text security updates
Combined security updates were applied to grpc, x/net, and x/text.
securitygolang.org/x/net v0.56.0
The golang.org/x/net module was updated to v0.56.0 for security fixes.
securitygolang.org/x/text v0.39.0
The golang.org/x/text module was updated to v0.39.0 for security fixes.
securityVulnerable dependency updates
Vulnerable dependencies were updated for security fixes.
securitygithub.com/sigstore/sigstore-go v1.2.1
The github.com/sigstore/sigstore-go module was updated to v1.2.1 for security fixes.
securitygolang.org/x/mod v0.40.0
The golang.org/x/mod module was updated to v0.40.0 for security fixes.

Check if affected (4)

breakingCrossplane CLI publication location and binary name
Applies if you use the Crossplane CLI.
breakingspec.replicas behavior in DeploymentRuntimeConfig
Applies if DeploymentRuntimeConfig configures spec.replicas.
breakingNarrowed composed resource garbage collection
Applicability is not stated in the release notes.
+ 1 more on the release page

Plan ahead (1)

deprecatedCrossplane v1.20 support endremoval planned in v2.5 (Nov 2026)
Applies when v2.5 is released in Nov 2026 and Crossplane v1.20 runs.

Kubernetesv1.36.4Kubernetes CoreAug 20, 2026

ACTION 1OTHER 4View full analysis

A maintenance release with correctness fixes and a security-related dependency update. The dependency update is recorded in the manifest and has no standalone operator impact.

Action needed (1)

securitySecurity updates for golang.org/x/text and golang.org/x/net
The dependency manifest updates golang.org/x/text and golang.org/x/net to include security updates.

Kyvernov1.19.0SecurityAug 20, 2026

ACTION 7CHECK 6PLAN 1OTHER 160View full analysis

A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.

Action needed (7)

securityhighIntermediate certificate limits
Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.
securityhighGo toolchain 1.26.3
The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.
securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9
CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.
securityUpdated golang.org/x/crypto and x/net dependencies
The golang.org/x/crypto dependency was updated to v0.53.0 and x/net to v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.
securityPatched ORAS and sigstore vulnerabilities
The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.
securityCodeQL vulnerability fixes
Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.
securitycel-go v0.30.0
cel-go was updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.

Check if affected (6)

breakingRequired --resource for the migrate command
Applies when the migrate command runs.
breakingDefault userInfo groups and UID during background scans
Applies when background scans run.
breakingexcludeBootstrapResources webhook flag
Applies when you configure Fail webhooks.
+ 3 more on the release page

Plan ahead (1)

deprecatedDeprecation notices for legacy kyverno.io policy types
Applies when you use legacy kyverno.io policy types.

Strimzi1.2.0Networking & MessagingAug 20, 2026

ACTION 2CHECK 3OTHER 7View full analysis

This release removes legacy CRD API versions and resource state metrics, and changes defaults for token mounting, feature gates, and container security contexts. It also adds Kafka and configuration capabilities and updates shipped dependencies.

Action needed (2)

breakingService Account token mounting
Service Account tokens are no longer auto-mounted into Pods. They are mounted through a volume instead.
breakingThe ServerSideApplyPhase1 feature gate, permanently enabled
The ServerSideApplyPhase1 feature gate has moved to GA and is permanently enabled. It can no longer be disabled.

Check if affected (3)

breakingLegacy CRD API versions, no longer supported
Applies before upgrading to Strimzi 1.0.0 or later if you use the v1beta2, v1beta1, or v1alpha1 APIs.
breakingResource state metrics, removed
Applicability is not stated in the release notes.
breakingDefault securityContext for operator installations
Applies if you use the Cluster, Topic, and User Operator YAML installation files or the Cluster Operator Helm Chart.

Rookv1.19.9Storage & DataAug 19, 2026

ACTION 1OTHER 5View full analysis

A maintenance release with security guidance for CVE-2025–30156 and updates across Ceph authentication, core behavior, Multus networking, and the Ceph base image. The release also includes a workaround for a Ceph authentication rotation race.

Action needed (1)

securityCVE-2025–30156 upgrade guidance
Rook users are advised to upgrade to Rook v1.20.5 or v1.19.9 with Ceph v20.2.4 or v19.2.6 in response to CVE-2025–30156.

Rookv1.20.5Storage & DataAug 19, 2026

CHECK 1OTHER 3View full analysis

A security-focused release with an advisory requiring Rook and Ceph upgrades. It also adds support for the new cephx key type, changes external version validation to ignore Ceph commit IDs, and fixes monitor registration in the v1 failover path.

Check if affected (1)

securityCeph CVE-2025–30156 advisory
Applies if you use Ceph.

Keycloak26.7.2SecurityAug 19, 2026

ACTION 2CHECK 6OTHER 14View full analysis

A maintenance release with disclosed security fixes, a cleartext vault-keystore password correction, a Quarkus dependency upgrade, and other bug corrections. The fixes cover account and permission flows, secret handling, and runtime dependencies.

Action needed (2)

securitymediumCVE-2026-59888 and CVE-2026-59889 fixes in jackson-databind
jackson-databind is upgraded to 2.21.5 to address CVE-2026-59888 and CVE-2026-59889. The dependency update ships in this Keycloak release.
securitymediumCVE-2026-45292 OpenTelemetry Java SDK memory allocation correction
CVE-2026-45292 corrects unbounded memory allocation in W3C Baggage Propagation in the OpenTelemetry Java SDK.

Check if affected (6)

securitycriticalCVE-2026-18963 reset-credentials flow bypass correction
Applies if you use the reset-credentials flow.
securityhighCVE-2026-15571 predictable account-linking hash correction
Applies if you use oidc.
securitymediumCVE-2026-14613 fine-grained admin permissions bypass correction
Applies if you use the admin/fine-grained-permissions API.
+ 3 more on the release page

CoreDNSv1.14.7Kubernetes CoreAug 19, 2026

ACTION 1CHECK 3OTHER 42View full analysis

A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.

Action needed (1)

securityhighGo 1.26.6 security fixes
The release is built with Go 1.26.6, including fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.

Check if affected (3)

securityplugin/acl autopath ACL checks
Applies if you use plugin/acl and autopath.
breakingplugin/forward default connection attempts
Applies if you use plugin/forward.
breakingplugin/hosts unsupported-type fallthrough
Applies if you use plugin/hosts.

Backstagev1.54.0CI/CD & App DeliveryAug 18, 2026

ACTION 2CHECK 16PLAN 3OTHER 238View full analysis

A broad release with dependency updates, breaking changes to commands, authentication patterns, and connection APIs, plus new AWS connection support and updates across the catalog, scaffolder, search, and UI. It also includes Kubernetes plugin security fixes and an undisclosed security announcement.

Action needed (2)

breakingStrict TypeScript configuration schema validation
Package preparation now validates TypeScript configuration schemas strictly before publishing.
breakingPortable configuration schemas for root connection types
Connection types now use portable configuration schemas as the source of root connection types.

Check if affected (16)

securityKubernetes plugin security fixes
Applies if you use the Kubernetes plugin.
breakingBackend connection APIs, removed from package exports
Applies if you use connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, or AnyRootConnection.
breakingNode.js snapshots in generated backend Dockerfiles
Applies if you configure generated backend Dockerfiles.
+ 13 more on the release page

Plan ahead (3)

deprecatedThe plugin-web-library template, updated to toastApiRef
Applies if you use the plugin-web-library template.
deprecatedZod v3 schemas, deprecated
Applies if you depend on Zod v3 schemas.
deprecatedThe catalog.providers.backstageOpenapi.plugins option, deprecated
Applies if you configure catalog.providers.backstageOpenapi.plugins.

Ciliumv1.20.1Networking & MessagingAug 18, 2026

CHECK 1OTHER 51View full analysis

A maintenance release with numerous operator-facing bug fixes and behavior corrections, alongside dependency and image updates. It also introduces a decoder-memory limit and fixes a CIDR policy bypass that could cause traffic drops after an agent restart.

Check if affected (1)

securityThe endpoint CIDR policy bypass, fixed
Applicability is not stated in the release notes.

Ciliumv1.19.7Networking & MessagingAug 18, 2026

OTHER 45View full analysis

A maintenance release with bug fixes, diagnostic improvements, dependency and image updates, and improved DNS request validation. It contains no security advisories or explicitly described vulnerabilities.

Ciliumv1.18.13Networking & MessagingAug 18, 2026

ACTION 1OTHER 26View full analysis

A maintenance release that adds host-firewall protocol support, corrects networking and stability defects, and changes runtime behavior and observability. It also updates dependencies and container images, including a gRPC security fix with no disclosed vulnerability.

Action needed (1)

securityThe google.golang.org/grpc dependency, updated to v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.18 release line. The release note marks this dependency update as a security fix, but does not disclose the vulnerability.

Prometheusv3.14.0ObservabilityAug 18, 2026

ACTION 1CHECK 1PLAN 1OTHER 39View full analysis

A maintenance release with an API deprecation, operator-visible removals and default changes, new capabilities, performance improvements, and correctness fixes across discovery, PromQL, TSDB, and other components. No security advisories or explicitly described security vulnerabilities are included.

Action needed (1)

breakingDefault support for PromQL duration expressions
Duration expressions are enabled by default in PromQL. The promql-duration-expr feature flag is now a no-op.

Check if affected (1)

breakingThe __meta_hetzner_datacenter label, removed
Applies if you use hcloud targets.

Plan ahead (1)

deprecatedThe stats query parameter, deprecated for other valuesremoval date not announced
Applies if you set stats to a value other than true or all.

Chaos Meshv2.8.4ObservabilityAug 18, 2026

OTHER 5View full analysis

A maintenance release focused on operator-visible fixes in the Dashboard and Helm charts. The corrections cover UI behavior, authentication and token handling, dashboard subpath serving, and chart template rendering.

OpenTelemetryv0.159.0ObservabilityAug 17, 2026

CHECK 2OTHER 6View full analysis

A release that adds exporter queue batching controls, changes exporter and scraper metric behavior, and updates public API field shapes. Schema-based configuration migrations are also included, with no security advisories or security fixes disclosed.

Check if affected (2)

breakingThe confighttp.ServerConfig field shape in Config
Applies if you use extension/zpages.
breakingThe configauth.Config field shape in AuthConfig
Applies if you use configauth.Config.

Open Policy Agent (OPA)v1.19.1SecurityAug 17, 2026

ACTION 1View full analysis

A security-focused maintenance release updates the Go build dependency to 1.26.6 and addresses standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins. Operators building their own binaries or images control the Go version used in those builds.

Action needed (1)

securitycriticalGo 1.26.6 build dependency
OPA is built with Go 1.26.6, fixing standard-library vulnerabilities in code used by its HTTP handler and crypto builtins. The fixes address GO-2026-5026, GO-2026-5972, GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091, and GO-2026-6218.

Daprv1.16.19Orchestration & ManagementAug 15, 2026

OTHER 1View full analysis

This maintenance release contains operator-relevant correctness fixes. The SPIFFE SVID source is now attached to the context passed into operation calls, so components can use the SPIFFE ID for per-operation authentication.

OpenFeaturecore/v0.16.2CI/CD & App DeliveryAug 14, 2026

OTHER 4View full analysis

A maintenance release with bug fixes for core initialization, flagd-proxy gRPC keepalive handling, and eventstream connections. No operator action is required beyond upgrading.

OpenFeatureflagd-proxy/v0.9.8CI/CD & App DeliveryAug 14, 2026

ACTION 1OTHER 1View full analysis

A maintenance release for flagd-proxy resolves open Dependabot security alerts. The sync server also receives a gRPC keepalive enforcement policy update.

Action needed (1)

securityOpen Dependabot security alerts resolved
Open Dependabot security alerts are resolved in flagd-proxy v0.9.8.

OpenFeatureflagd/v0.16.2CI/CD & App DeliveryAug 14, 2026

OTHER 4View full analysis

A maintenance release with bug fixes for eventing, eventstream connection handling, and OFREP evaluation metrics. The fixes require no operator action beyond adopting the release.

Daprv1.18.3Orchestration & ManagementAug 14, 2026

OTHER 21View full analysis

A maintenance release with operator-facing correctness fixes, runtime behavior changes, a new configuration flag, and cron parser updates backed by a dependency change. It contains no security advisories or explicitly described vulnerabilities.

Aug 26, 2026 – Aug 14, 2026Older →

Browse by month