Week 45, Nov 2-8, 2026

This week: 145 releases, 144 news items. Notable: kube 5.0.0.

👋 Welcome

This week in Cloud Native, the community continued to address security concerns with a wave of patch releases focused on certificate authority distrust. The Kubernetes ecosystem saw new initiatives with the formation of a Workload Conformance Working Group and a spotlight on AI Conformance within SIG Architecture. Discussions also advanced on the operational aspects of integrating AI agents, from sandboxing to resource management and observability.

🚀 Notable Releases

Security

  • cert-manager v1.20.5 - Removes trust in the compromised eMudhra CA, updates base images to Debian 13, and requires Go 1.26.10 to reject affected certificate chains (CVE-2026-111943).
  • dapr v1.19.1 - Fixes sidecar connection leaks, resolves SQLite state store write failures, and addresses a service invocation access control bypass vulnerability.
  • dapr v1.18.10 - Contains fixes for sidecar connection leaks and a service invocation access control bypass vulnerability.
  • dapr v1.17.19 - Addresses security fixes for service invocation access control bypass and scheduler delivering workflow reminders to incorrect applications.
  • envoyproxy/envoy v1.40.2 - Updates the distroless Docker image base to a patched ca-certificates package (20250419+deb13u1) to distrust compromised eMudhra intermediate CAs.
  • envoyproxy/envoy v1.39.6 - Updates the distroless Docker image base to a patched ca-certificates package (20250419+deb13u1) to distrust compromised eMudhra intermediate CAs.
  • envoyproxy/envoy v1.38.9 - Updates the distroless Docker image to use the patched ca-certificates package (20250419~deb12u2) from Debian bookworm to distrust compromised eMudhra intermediate CAs.
  • envoyproxy/envoy v1.37.11 - Updates the distroless Docker image to use the patched ca-certificates package (20250419~deb12u2) from Debian bookworm to distrust compromised eMudhra intermediate CAs.
  • falcosecurity/falco 0.45.2 - A patch release focusing on security updates.
  • open-policy-agent/opa v1.22.0 - Introduces a new rego.v2 import, configurable log level for HTTP access logs, stricter handling of bundle signature filenames (breaking change), and partial evaluation unrolling every over a known domain.
  • projectcontour/contour v1.33.8 - Includes security fixes for a crash loop when an Ingress has a resource backend (GHSA-899w-6852-7fr3) and another vulnerability (GHSA-9x3c-68m7-f3x4).
  • kubescape/kubescape v4.0.17 - Adds support for applying remediation report items from posture reports, fixes CEL variable cycle detection, RBAC graph issues, runtime profile drift safety, and scan namespace filtering.
  • nats-io/nats-server v2.15.2 - Uses Go 1.27.3, which includes mitigations for CVE-2026-111943 by distrusting eMudhra intermediate certificates.
  • nats-io/nats-server v2.14.9 - Uses Go 1.26.10, which includes mitigations for CVE-2026-111943 by distrusting eMudhra intermediate certificates.
  • openfga/openfga v1.22.1 - Fixes issues with selecting on closed producer channels in graph fast paths, surfacing condition evaluation errors from the unary pipeline, and logging raw request/response as JSON.
  • AthenZ/athenz v1.12.51 - Includes dependency updates, such as follow-redirects from 1.16.0 to 1.16.1 in the UI.
  • cartography-cncf/cartography 0.144.0 - Adds authentication with pre-issued ARM and Graph access tokens for Azure and Entra, fixes reporting of delegated-admin GuardDuty findings, and deletes orphaned pre-data-model nodes after AWS sync.
  • containerssh/containerssh v0.6.1 - Contains security updates for the SSH library and Go runtime, enforces TLS 1.3 minimum version, and fixes TTY allocation on Virtual Kubelet.
  • project-dalec/dalec v0.22.4 - Updates Bionic and Focal workers to distrust incident CA roots and avoids reparsing YAML documents in nested decoders.

Orchestration

Networking

  • envoyproxy/envoy v1.40.2 - (See Security)
  • envoyproxy/envoy v1.39.6 - (See Security)
  • envoyproxy/envoy v1.38.9 - (See Security)
  • envoyproxy/envoy v1.37.11 - (See Security)
  • projectcontour/contour v1.33.8 - (See Security)
  • bfenetworks/bfe v1.8.9.1 - Adds Server.AIUpstreamAcceptEncoding option to control Accept-Encoding rewriting on AI upstream requests.
  • bfenetworks/bfe v1.8.8.7 - Adds Server.AIUpstreamAcceptEncoding option to control Accept-Encoding rewriting on AI upstream requests.
  • bfenetworks/bfe v1.8.9 - Adds ai_zero_cost_reason access-log marker, supports time_weekday_in condition primitive, and introduces BillingZeroCost and AbortBillingSkipped module counters.
  • kubeovn/kube-ovn v1.16.17 - Updates cert-manager to v1.20.5, preserves TCP probe failures for custom VPC Pods, and protects externally managed OVN chassis.
  • kubeovn/kube-ovn v1.15.33 - Refreshes underlay Service flows after OVS ofport changes, improves NetworkPolicy handling, and updates Kubernetes, golang.org/x, and cert-manager dependencies.
  • kubeovn/kube-ovn v1.16.16 - Improves underlay Service flow refresh, coalesces admin policy updates, optimizes NetworkPolicy selector handling, and includes licenses for bundled image binaries.
  • kumahq/kuma v3.0.1 - Bumps Envoy from 1.39.4 to 1.39.6, updates golang.org/x/net, and moves distroless base images to Debian 13.
  • kumahq/kuma v2.14.7 - Bumps CoreDNS to v1.15.0, Envoy from 1.38.7 to 1.38.9, and updates golang.org/x/net.
  • kumahq/kuma v2.13.12 - Bumps CoreDNS to v1.15.0, Envoy from 1.36.10 to 1.37.11, and updates golang.org/x/net.
  • kumahq/kuma v2.11.20 - Bumps CoreDNS to v1.15.0, Envoy from 1.36.10 to 1.37.11, and updates github.com/moby/sys/user.
  • networkservicemesh/api v1.20.0 - Uplifts grpc, x/net, x/text, x/sys to resolve CVEs and migrates golangci-lint v2 config.
  • oxia-db/oxia v0.16.13 - Fixes session closing outside the session-manager lock and waiting for pending WAL syncs before reporting shard status.
  • oxia-db/oxia v0.16.12 - Fixes releasing the coordinator lease on shutdown and allowing RetryNotify to see the context through ConcurrentBackOff.
  • oxia-db/oxia v0.18.0 - Focuses on correctness for online shard splitting, automatic splits, dynamic cluster administration, and coordinator high availability.
  • spidernet-io/spiderpool v1.3.0 - Adds IaaS network provider integration support, configurable HTTP timeout for IaaS provider integration, and configurable vethMTU for coordinator veth0 device.
  • kubernetes-sigs/gateway-api v1.7.0 - Promotes HTTPRoute Retries (codes, attempts, backoff) to the Standard channel, along with HTTPRouteRetryCodes and HTTPRouteRetryConnectionError conformance features.

Observability

CI/CD

  • fluxcd/flux2 v2.10.0 - Promotes Object identity to generally available, introduces SPIFFE mTLS for inter-controller communication, promotes Notification Event, Alert, and Provider APIs to v1, and adds OCIRepository as a chart source for HelmRelease.
  • tektoncd/pipeline v1.18.0 - A feature release for Tekton Pipeline.
  • kube-burner/kube-burner v2.8.7 - Ignores vendor-defined node conditions in cluster health checks, adds PProf stage collection, and propagates file write errors during workload extraction.
  • openchoreo/openchoreo v1.4.0-m.1 - Records actor.id for service accounts in audit events, fixes occ auditlogs context scoping and ascending paging, and makes readable_id_claim optional in the control plane schema.
  • openchoreo/openchoreo v1.3.3 - Updates default observability module versions, denies all ingress in CiliumNetworkPolicy for components without endpoints, and removes a two-step Helm chart installation.
  • werf/werf v3.12.2 - Fixes build issues when a RUN mount option uses a base ENV and rebuilds when a RUN bind-mount source changes.
  • werf/werf v2.84.1 - Prevents empty-body errors when retrying registry uploads, restores Docker Hub login for build and export, and stops uninstall and dismiss hanging.
  • open-component-model/open-component-model v0.22.1 - Fixes not holding the archive lock while streaming blobs in CTF.
  • open-component-model/open-component-model v0.22.0 - Runs the CLI image as non-root, logs target reference in transfer debug logs, selects ref or commit via repository URL fragment, and adds jsonNormalisation/v1.
  • radius-project/radius v0.62.0 - A feature release.
  • shipwright-io/build v0.21.11 - A rebuild of all components to address vulnerabilities in base images.

Storage

  • dragonflyoss/dragonfly v2.5.3 - Bumps Docker login-action, github.com/onsi/ginkgo/v2, and github/codeql-action/upload-sarif dependencies.
  • rook/rook v1.21.1 - Enforces secure msgr2 mode for mon connections, allows configuring Prometheus scrape timeout, fixes minimum failure domain detection, and adds CephObjectStoreUser secret template.
  • hwameistor/hwameistor v1.1.2 - Scheduler retries respect selected-node on Pending PVCs, and migration image defaults from v1.0.4-01 to v1.2.0, incorporating JuiceFS fixes.
  • piraeusdatastore/piraeus-operator v2.12.1 - Deployments now prefer to be spread over multiple nodes for faster failover. Updated LINSTOR and LINSTOR CSI versions contain fixes for shared storage and RWX volumes.

Configuration

  • cadence-workflow/cadence v1.4.5 - Requires Cassandra schema migrations through v0.55 before rollout, adding semaphore_info, executions.semaphore_map, jitter_coefficient, and semaphore_name.
  • kairos-io/kairos v4.4.0 - Drops /usr/libexec from persistent state paths in 00_rootfs.yaml, which fixes Kubernetes cluster builds and rollback across OS versions.
  • opentofu/opentofu v1.12.11 - Fixes a panic when provided invalid state encryption configuration.

Container Runtime

  • bootc-dev/bootc v1.17.3 - Prints journals for failed units in tmt, includes os-image-map updates, and ports test-switch-zstd to os-image-map.

Framework

Platform

  • SlimPlanet/SlimFaas 0.86.1 - Provides Native AOT builds for SlimFaas and SlimFaasMcp, plus standalone SlimFaas local demos for Linux x64/ARM64, Windows x64, and macOS x64/ARM64.
  • SlimPlanet/SlimFaas 0.86.0 - Provides Native AOT builds for SlimFaas and SlimFaasMcp, plus standalone SlimFaas local demos for Linux x64/ARM64, Windows x64, and macOS x64/ARM64.
  • SlimPlanet/SlimFaas 0.85.1 - Provides Native AOT builds for SlimFaas and SlimFaasMcp, plus standalone SlimFaas local demos for Linux x64/ARM64, Windows x64, and macOS x64/ARM64.
  • SlimPlanet/SlimFaas 0.85.0 - Provides Native AOT builds for SlimFaas and SlimFaasMcp, plus standalone SlimFaas local demos for Linux x64/ARM64, Windows x64, and macOS x64/ARM64.
  • openmcp-project/openmcp v1.4.4 - Updates OpenMCP Project Go dependencies and k8s.io/utils digest.
  • openmcp-project/openmcp v1.4.3 - Updates github.com/onsi/ginkgo/v2 and github.com/alitto/pond/v2 modules, and updates Go module directive to v1.27.3.
  • platform-mesh/platform-mesh v26.10.0 - The first release with a single version for all of Platform Mesh components, following RFC 015.

Remote Procedure Call

  • grpc/grpc v1.85.1 - Fixes a Denial of Service in Health Watch RPC and a memory leak in AsyncIO client-streaming calls with interceptors for Python.
  • grpc/grpc v1.84.2 - Fixes a Denial of Service in Health Watch RPC and a memory leak in AsyncIO client-streaming calls with interceptors for Python.
  • grpc/grpc v1.85.0 - Updates gRPC repository roots for security and adds map_host_header_to_authority experiment.

Sustainability

Operating System

Database

Application Frameworks

📰 This Week in Cloud Native

The cloud native ecosystem this week continued to focus on security and the evolving integration of AI. Numerous open-source projects released patch versions to address security vulnerabilities, notably the ongoing effort to distrust the compromised eMudhra intermediate Certificate Authority. This involved updating Go toolchains and base Docker images across projects like cert-manager, Dapr, Envoy, NATS, and Thanos. A survey by LF Research highlighted that while generative AI boosts developer productivity, it also contributes to a quarter of incoming pull requests being considered “AI slop,” increasing maintainer workloads. This indicates a growing challenge for open-source project maintainers in managing AI-generated code.

In the Kubernetes ecosystem, several key developments aimed at improving workload management and AI integration. Kubernetes released patch versions across its 1.37, 1.36, 1.35, and 1.34 stable branches. The community announced the formation of a Workload Conformance Working Group, tasked with defining and validating workload behavior on Kubernetes. This initiative is particularly relevant for AI teams as it seeks to ensure predictable execution environments. Additionally, a spotlight on AI Conformance within SIG Architecture underscored the dedicated effort to standardize how AI workloads are integrated and managed within Kubernetes. The Gateway API reached v1.7.0, promoting HTTPRoute Retries to the Standard channel, providing more robust traffic management capabilities.

Discussions around AI and cloud native continued to explore operational challenges. The “boundary problem” in agentic AI and the necessity of robust sandboxing on Kubernetes were highlighted, emphasizing the need for controlled environments for AI agents. OpenChoreo, an Internal Developer Platform, detailed its use of OpenTelemetry for distributed tracing and Kubernetes events, providing technical visibility into application behavior. Volcano v1.16 was released, introducing NamespaceQueue and a fairshare plugin, which can improve resource management and allocation for various workloads, including AI. These efforts collectively aim to provide clearer technical pathways for deploying and observing AI applications within cloud native infrastructure.

Sustainability in cloud native also saw attention this week, with discussions on making artificial intelligence more environmentally sustainable. Projects like Chantico released new versions with features such as a Prometheus exporter for physical measurement types, indicating a technical push towards integrating environmental metrics into cloud native operations. The CNCF also announced that over 500 professionals have achieved the “Golden Kubestronaut” certification, reflecting continued growth in advanced cloud native expertise within the community.

💬 Community Buzz

Hacker News discussions this week included “Kubernetes for ESP32 microcontrollers” showcasing a lightweight Kubernetes implementation, and “Firmware Simulation for AI Agents” for testing AI agent logic. The topic of running Docker without a local Docker daemon using tools like Ulak was also discussed. Other technical conversations revolved around “Catching agent regressions without an LLM judge” for evaluating AI agent changes, “AI agent sandboxing on Kubernetes,” and “The Case for OpenTelemetry Maintainership.” Tools for composing GPU graph, vector, and ML algorithms in SQL (Algeon) and open-source, on-device AI alternatives (Hob) also generated interest.

📊 Numbers of the Week

  • Total stable releases: 108 across 58 projects
  • Top 3 projects by commits this week:
    1. hivecommons/hive — 723 commits
    2. kubernetes/kubernetes — 317 commits
    3. meshery/meshery — 194 commits
  • Top 3 projects by merged pull requests this week:
    1. hivecommons/hive — 834 merged PRs
    2. argoproj/argo-cd — 187 merged PRs
    3. kubernetes/kubernetes — 178 merged PRs

📚 View all articles from this week →