Week 46, Nov 9-15, 2026

This week: 217 releases, 142 news items. Notable: substrate v1.0.0, hive v6.0.0.

👋 Welcome

This week in Cloud Native saw a strong focus on security, with numerous projects releasing updates to address vulnerabilities and enhance compliance. The ecosystem continued to advance in AI and agentic computing, marked by significant project donations to the CNCF and the introduction of new open-source tools for agent development, testing, and orchestration. Additionally, a key configuration management tool reached a major milestone with its v1.0.0 release.

🚀 Notable Releases

CI/CD & Application Delivery

  • Argo CD v3.6.1 - This is a patch release. The v3.3.19 release series has reached end-of-life and will no longer receive updates.
  • Backstage v1.56.3 - Adds the experimental Zensical engine for TechDocs, providing a migration path.
  • OpenChoreo v1.4.0-m.2 - Fixes notification channel lookup in the alert’s namespace and prevents rejection of notification channel secrets targeting another plane.
  • OpenKruise v1.9.3 - Fixes WorkloadSpread to trigger reconciliation when a Pod becomes unschedulable and prevents empty scale selectors from matching unrelated Pods.
  • Spin v4.3.0 - Introduces support for release signature verification using cosign.

Container Runtimes & Orchestration

  • CRI-O v1.37.3 - This is a patch release, including bug and regression fixes.
  • K0s v1.37.2+k0s.1 - Applies client-side logic when force-upgrading Helm charts and updates internal dependencies.
  • K3s v1.37.2+k3s1 - Updates Kubernetes to v1.37.2, adds gateway-api-crd to help, and includes fixes.
  • KAI-Scheduler v0.18.7 - Changes GPU-fractioning chart dependency range and preserves GPU reservations while binding requests remain retryable.
  • KubeStellar v0.30.1 - Includes dependency updates and adds an Ecosystem table to the README.
  • Lima v2.3.0 - Adds experimental HCS driver support for Windows hosts, host block device attachment for VZ guests on macOS, and experimental virtual networks on Linux.
  • Project-HAMi v2.11.0 - Exports metrics directly via NVML, adds Flexible-MIG support, Cluster Autoscaler support, and new scheduling policies like mutex and policy combinations.
  • WasmCloud v2.12.1 - Fixes operator reporting DaemonSet progress after partial deletions and enables ULID for bind generations without PostgreSQL.
  • Agent Substrate v1.0.0 - This is a milestone release for managing agents and agent-like workloads.
  • Bootc v1.17.4 - Skips serializing optional fields if None and rejects config stateroot on composefs-only images.
  • Container2wasm v0.8.5 - Updates Dockerfile to use mirrors for zlib and busybox.
  • Hyperlight v0.19.0 - Adds Sandbox::snapshot_with_options for scratch size configuration during snapshots and restores.
  • KCP v0.33.6 - Returns NotFound to WatchList clients when a shard does not serve the resource.
  • NVIDIA OpenShell v0.1.7 - Emits native OCSF 1.8.0 records only, deprecating older schema versions (breaking change).

Observability

  • Jaeger v2.23.0 - Removes unused ClickHouse feature gates and resolves auth extension references deterministically (breaking changes). Removes Gemini reference sidecar.
  • OpenTelemetry Collector v0.165.0 - Removes deprecated fields from pkg/confighttp (breaking change) and adds xreceiverhelper for reporting profile sample metrics.
  • Prometheus v3.16.0 - Clamps experimental search API batch_size to 1000, defaults --web.external-url to HTTPS when TLS is enabled, and includes subquery samples in query statistics.
  • HolmesGPT v0.46.0 - Adds webhook destination for alerts and allows allowed_tools configuration for MCP servers.
  • Inspektor Gadget v0.58.0 - Introduces new trace_selinux gadget for tracing SELinux AVC decisions and trace_rename gadget for reporting file renames.
  • Kepler v0.13.0 - Features a minimal base container and adds support for imagePullSecrets and priorityClassName in Helm charts.
  • Kuberhealthy v3.0.33 - Builds with Go 1.26.10 and adds configurable Kubernetes client request rate limits (KH_KUBE_API_QPS, KH_KUBE_API_BURST).
  • Perses v0.55.1 - Restricts URL schemes allowed in dashboard links to relative URLs and an allowlist of schemes. Upgrades Go to 1.27.3.
  • Trickster v2.2.1 - Fixes a Time Series Merge defect returning 502 for Prometheus /api/v1/query_examplars and adds support for draft-23 of the Media over QUIC (MoQ) specification.

Security

  • Open Policy Agent v1.22.2 - Fixes a type checker regression that rejected policies iterating an empty collection.
  • SPIFFE/SPIRE v1.16.0 - Adds experimental WIT-SVID support including Workload API methods, a CLI command, an agent-side cache, and per-entry/default TTLs. Introduces a kmip KeyManager plugin.
  • Keycloak 26.8.2 - Includes security fixes, notably for CVE-2026-92358 related to cross-browser fallback proof.
  • Kubescape v4.0.20 - Fixes LARGE_CLUSTER_SIZE fallback, enforces Cobra argument bounds, and prevents diff output from overwriting input reports.
  • OAuth2 Proxy v7.15.6 - Fixes Entra ID tenant ID extraction and multiple return code/redirect issues. Upgrades to Go 1.26.10 and addresses CVE-2026-111943, CVE-2026-116585, CVE-2026-116586.
  • Trivy v0.76.2 - Rebuilds container images on Alpine 3.24.3, fixing musl, libcurl, and brotli-libs CVEs. Bumps golang.org/x/net to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html.
  • Cedar Policy v4.14.1 - Fixes Entities::upsert_entities keeping a stale ancestor and improves policy formatter line breaks.
  • CMK v0.12.3 - Fixes skipping client certificates when HYOK cert-based authentication is disabled.
  • Secrets Store CSI Driver v1.6.2 - Fixes recovering deleted synced Secrets from cache events and treating empty existing mounts as stale. Improves performance by batching and bounding Secret recovery probes.

Networking & Service Mesh

  • Istio 1.31.4 - This is a maintenance release.
  • Strimzi Kafka Operator 1.3.1 - Supports Kubernetes 1.32 and newer (breaking change: 1.30 and 1.31 are no longer supported). The v1 CRD API is the only supported version (breaking change).
  • Kube-OVN v1.17.0 - Upgrades the networking stack, adds service-scoped load balancing and VPC egress capabilities, and modernizes kubectl-ko. The ClusterNetworkPolicy API is promoted to v1beta1, requiring existing manifests using the ports field to convert to protocols before upgrading (breaking change).
  • KGateway v2.5.1 - Fixes proxy pods logging an envoy_bug error on startup and moves the Istio SDS cluster off the deprecated http2_protocol_options field.
  • MetalLB v0.16.2 - This is a patch release.
  • OPG EWBI Operator v1.1.0 - This is an initial open-source contribution, adding a license and addressing incomplete zone information.
  • Praxis v0.8.0 - Includes dependency updates.
  • Submariner v0.25.0 - This is a stable release.

Storage & Database

Cloud Native Ecosystem & Management

  • Meshery v1.0.75 - Defaults namespace for namespaced kinds, prevents nil pointer dereference on invalid load test URLs, and allows GitHub and Artifact Hub connections to register.
  • Kubean v0.40.1 - Fixes the kube resolv conf playbook.
  • Open Component Model v0.23.0 - Hardens images against DISA GPOS SRG and CIS Docker Benchmark, transfers unpinned Git resources by value with a drift warning, and selects default verifier from signature algorithm.
  • OpenTofu v1.13.9 - Fixes a local backend state persistence bug when the first apply crashes.
  • Cluster API v1.14.4 - Fixes bugs including setting the cluster-name label even if BeforeClusterCreate hook is blocking, and a ControlPlaneInitialization race condition.
  • Gardener v1.155.0 - Seeds whose default DNS domain is identical to their internal DNS domain are now rejected by validation (breaking change).
  • IronCore v0.9.0 - Includes network interface status in IRI response, bumps etcd to 3.7.x, and updates Kubernetes dependencies to v0.37 (breaking changes).
  • OpenMCP v1.4.5 - Includes dependency updates and republishes a FIPS build.
  • Open-Resource-Discovery Specification v1.17.1 - Removes the requirement for case-insensitive ORD ID comparison, lookup, and deduplication.
  • Platform Mesh v26.10.2 - Fixes the security-operator ignoring authorization model type order.

Workflow & AI Enablement

  • Hive v6.4.1 - Fixes a contributor acting as an agent role receiving the resident agent’s full manual kick instead of their assigned task.
  • Luigi v2.33.0 - Adds an option to skip adding modal data to the URL and introduces fullscreen mode for user settings and the user menu.

Chaos Engineering

  • Chaos Mesh v2.8.8 - Fixes PhysicalMachineChaos configuration, workflow deletion, controller selection, and TimeChaos on ARM64. Corrects the Redis Sentinel redisPath field type to string (breaking change).
  • Chaosblade v0.7.4 - Bundles ChaosBlade tool v1.9.0-alpha for Linux/macOS and includes a built-in Web UI.
  • Krkn v5.2.14 - Adds PVC fill for VMIs and VMI storage throttle.

Sustainability

  • Chantico v0.24.0 - Adds a stress test to find the limit of custom resources deployed.

📰 This Week in Cloud Native

AI & Agentic Computing Advancements

This week saw significant developments in the management and deployment of AI agents within cloud native environments. Google announced the donation of Agent Substrate and gVisor to the CNCF. Agent Substrate is designed for managing agent-like workloads securely at scale, while gVisor provides a code sandbox for untrusted AI agents, enhancing isolation and security.

New open-source tools emerged to support the agentic workflow. Nomos, a Go harness, was introduced to prevent coding agents from “cheating” on tests, focusing on verifiable agent output. Gauge, an open-source CLI, aims to recursively improve documentation for coding agents. KeepPlain helps developers understand agent-written code by saving agent sessions and linking them to Git blame. For agent orchestration, Rivet was released, focusing on scaling agentic workloads on S3. Other new tools include Fluxcut-plugin for creating product videos with AI agents, NotBot as an AI-powered financial news analyzer, and AI Gude for generating daily podcasts from news feeds. The LDraw-mecha project demonstrated AI agents inferring Lego mechanisms and animating them. The OpenKruise Agents v0.6.0 release also focused on sandbox security and automation for agents. Discussions also covered strategies for faster LLM inference startup and research into whether code knowledge graphs improve coding agent performance, with one study finding no clear gain.

Security & Compliance Updates

Security remained a central theme across the cloud native landscape. Numerous projects, including gRPC, OAuth2 Proxy, Kuberhealthy, and Trivy, released updates that often included Go toolchain bumps (e.g., to Go 1.26.10 or 1.27.3) and fixes for various CVEs. Specific security enhancements were noted, such as Kubevela v1.11.1 guarding workflow HTTP against SSRF vulnerabilities and Hive implementing file access limits for CLI-memory drains to prevent unauthorized host path access.

The OpenSSF held its Community Day Europe 2026, emphasizing systemic security and operational resilience in open source. Sylva, an open-source project, detailed its journey with OpenSSF, leveraging tools like Sigstore, SLSA, Scorecard, and Best Practices badges for supply chain security. Kubescape completed all six Security Slam badges with OpenSSF, demonstrating a commitment to strengthening its security posture. Discussions also highlighted the importance of addressing security vulnerabilities in widely used open-source components like PHP and ensuring accurate Software Bill of Materials (SBOMs), even for complex build graphs like Swift. The Amutable Foundations Linux project introduced a system where server boot chains and configurations can be proven with TPM-signed measurements, enhancing trust in Linux clusters. Concerns were also raised regarding AI agents potentially exploiting Docker group root access. SPIFFE/SPIRE v1.16.0 introduced experimental support for WIT-SVIDs and a KMIP KeyManager plugin, expanding identity and key management capabilities.

Cloud Native Ecosystem & Tooling

The cloud native ecosystem saw a significant milestone with the release of kpt v1.0.0, marking a mature step for the configuration management toolchain. Lima v2.3.0 expanded its capabilities, adding experimental support for the HCS driver on Windows, allowing host block devices to be attached to VZ guests on macOS, and introducing experimental virtual networks on Linux.

Several new open-source tools were showcased this week. K8sman emerged as a native Kubernetes IDE. DevBox was open-sourced by RudderStack as an engineering harness. Hyperbutler offers a Docker-on-Windows solution without requiring WSL. FELF provides a method for creating AppImage-like single binaries without FUSE, root, or a runtime. In workflow management, Waymark was introduced as a workflow engine that compiles jobs rather than replaying them. Other tools include MxRaven for programmable email infrastructure and Enmetu for Git auto-commits that handle conflicts. In education, Nextcloud partnered with Ionos to launch an open-source educational platform for schools. The community also discussed the need for OpenTelemetry to instrument agent memory, aiming for better observability of agentic workflows.

Sustainability Initiatives

The CNCF reflected on its recent Sustainability Month, sharing learnings about integrating environmental considerations into cloud native practices. The Chantico project continued to advance in sustainability, with its latest releases introducing a stress test for custom resource limits, replacing resourceIds with additionalLabels on PhysicalMeasurement, and enhancing configuration for watching and managing measurement devices across namespaces. These updates provide further technical mechanisms for measuring and managing the environmental impact of cloud native deployments.

💬 Community Buzz

This week on Hacker News, discussions frequently centered on AI agents, covering topics such as building and testing coding agents, their orchestration, and the security implications of granting them access to system resources. New open-source projects for Kubernetes development, container runtimes on Windows, and various workflow automation tools also generated interest. There were also broader conversations about the evolving role of engineers in an AI-assisted world and the impact of AI on software development practices.

📊 Numbers of the Week

  • Total stable releases: 178 across 47 projects
  • Top 3 projects by commits this week:
    1. meshery/meshery — 618 commits
    2. hivecommons/hive — 509 commits
    3. kubernetes/kubernetes — 410 commits
  • Top 3 projects by merged pull requests this week:
    1. hivecommons/hive — 635 merged PRs
    2. kubernetes/kubernetes — 179 merged PRs
    3. meshery/meshery — 148 merged PRs

📚 View all articles from this week →