What kubernetes/kubernetes shipped
Written by FoxPlug from the repository's own releases; not affiliated with Kubernetes. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/kubernetes/kubernetes; Kubernetes did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Kubectl configuration format kuberc promoted to stable with new kubectl.config.k8s.io/v1 version and deprecation of v1beta1. Pull request #142619
- Prometheus client library updated to 1.25.0 with minimum Go version now 1.26. Pull request #142689
- Go version upgraded to 1.27.2 for security fixes. Pull request #142873
- API server fix for large identity header sets backported to release-1.35. Pull request #142772
- Pod group runtime hierarchies validation added to kube-scheduler. Pull request #142719
- Deployment controller now surfaces old ReplicaSet scale-down errors for workqueue retry. Pull request #142650
- Webhook authorizer extended to support conditions as part of conditional authorization implementation. Pull request #137633
- Kubelet now overlays local allocatable onto uninitialized API nodes created by external controllers. Pull request #142234
- Kubectl events command fixed to keep multi-line event messages inside their table rows. Pull request #142149
- API server metrics refactored to emit
apiserver_resource_size_estimate_bytesandapiserver_resource_objectswith explicit timestamps. Pull request #142007
Why it matters
This week brings stability improvements to core components, backports of critical security fixes across multiple release branches, and advances in authorization and scheduling features. The promotion of kuberc to stable and Go 1.27.2 security upgrade are particularly important for users managing cluster configurations and deploying production workloads.
Changelog entry
- Kuberc promoted to stable: kubectl.config.k8s.io/v1 introduced, v1beta1 deprecated Pull request #142619
- Prometheus/client_golang updated to 1.25.0 with Go 1.26 minimum requirement Pull request #142689
- Go version upgraded to 1.27.2 security release Pull request #142873
- API server: large identity header sets support backported to release-1.35 Pull request #142772
- API server: large identity header sets support backported to release-1.34 Pull request #142773
- API server: large identity header sets support backported to release-1.36 Pull request #142771
- API server: large identity header sets support backported to release-1.37 Pull request #142770
- Deployment controller surfaces scale-down errors from old ReplicaSets for retry Pull request #142650
- Kubelet overlays local allocatable onto uninitialized API nodes from external controllers Pull request #142234
- Scheduler validates pod group runtime hierarchies Pull request #142719
- Webhook authorizer supports conditions for conditional authorization Pull request #137633
- Kubectl events preserves multi-line messages in table output Pull request #142149
This week: kuberc config format reaches stable status, Go 1.27.2 security update integrated, pod group scheduling validation added, and multiple core controller bug fixes for deployments and kubelet.
Kubernetes shipped significant updates this week: kuberc configuration format promoted to stable, Go runtime updated to 1.27.2 for security, new pod group runtime hierarchy validation in the scheduler, and critical fixes for deployment controllers and kubelet node initialization. These changes strengthen core reliability and security across multiple cluster components.
Week of September 28, 2026
What shipped
- Kubelet now filters out scoped link-local IPv6 nameservers that pods cannot use when applying the Default DNS policy. Pull request #140880
- Etcd request metrics now separately track updateGet and deleteGet operations and include error reason labels. Pull request #142484
- Watch cache snapshots are now streamed without allocating an item slice for each watchlist. Pull request #142522
- Quantity Dec values now behave as value types instead of reference types, preventing unintended mutations. Pull request #142594
- Quantity comparison and conversion methods are now read-only and thread-safe. Pull request #142581
- Kubectl label now writes missing label warnings to stderr instead of stdout to preserve valid JSON output. Pull request #142436
- HPA resource utilization ratio computation no longer overflows when summing large int64 values. Pull request #142192
- HPAGeneration feature gate is promoted to GA and locked to enabled. Pull request #142386
- Kubectl kuberc set now clears the allowlist when policy is set to AllowAll or DenyAll. Pull request #142564
- DRA ResourceSlice now validates that device-level node selectors use exactly one term as documented. Pull request #141213
Why it matters
This week's changes fix multiple bugs affecting kubelet DNS configuration, quantity handling, metrics, and kubectl output reliability. Several improvements target memory efficiency in watch operations and correctness in API validation, while feature gate promotions signal maturation of HPA functionality.
Changelog entry
- Kubelet: Filter scoped link-local IPv6 DNS servers from pod resolver configuration Pull request #140880
- Metrics: Separate etcd deleteGet and updateGet operations and add error reason labels Pull request #142484
- Cacher: Stream watch cache snapshots without item slice allocation Pull request #142522
- Apimachinery: Make Quantity Dec behave as value type to prevent mutations Pull request #142594
- Apimachinery: Fix Quantity.Cmp and AsDec to be read-only and thread-safe Pull request #142581
- Kubectl: Write missing label warnings to stderr instead of stdout Pull request #142436
- Autoscaling: Fix HPA resource utilization ratio computation int64 overflow Pull request #142192
- Featuregate: Promote HPAGeneration to GA and lock to enabled Pull request #142386
- Kubectl: Clear kuberc allowlist when policy is AllowAll or DenyAll Pull request #142564
- Dra: Validate ResourceSlice device node selector has exactly one term Pull request #141213
- Apimachinery: Fix DeepDerivative to properly validate slice lengths Pull request #137264
- Scheduling: Fix pod deletion latency metric unit from nanoseconds to seconds Pull request #141742
This week: kubelet DNS filtering, safer Quantity types, watch cache streaming, HPA metrics separation, and kubectl stderr fixes. Bug fixes improve reliability across node, API machinery, and CLI components.
Kubernetes this week includes improvements to DNS handling in kubelet, fixes for Quantity value semantics to prevent unintended mutations, and safer etcd metrics tracking. kubectl now correctly routes warnings to stderr, preventing JSON corruption in piped commands. Watch cache streaming avoids unnecessary allocations. HPA gains maturity with feature gate promotion to GA. These changes address reliability, performance, and correctness across core components.
Week of September 21, 2026
What shipped
- Kubeadm now supports ML-DSA-44, ML-DSA-65, and ML-DSA-87 encryption algorithms for new clusters using ClusterConfiguration. Pull request #142037
- Konnectivity network proxy updated to v0.37.0 with CVE fixes and improvements to connection handling and agent data-plane communication. Pull request #142400
- CertificateSigningRequests now support ML-DSA with updates to cluster-signing flags and a new CertificateSigningRequestMLDSA feature gate. Pull request #142196
- Clients can now omit metadata.managedFields from API responses by adding drop=metadata.managedFields to the Accept header behind the ManagedFieldsAlpha feature gate. Pull request #139561
- CompositePodGroup.Spec.SchedulingPolicy.Gang.MinGroupCount is now mutable across v1alpha3 and v1beta1 versions for dynamic workload resizing. Pull request #141023
- Watch validation added using minimal and maximal revision tracking to ensure watches return consistent event tuples. Pull request #142381
- Validation-gen now supports time.Duration bounds in +k8s:minimum and +k8s:maximum annotations with quoted Go duration strings. Pull request #142368
- Callers can now choose the self-signed key algorithm in client-go/util/cert.GenerateSelfSignedCertKeyWithOptions. Pull request #142350
- DRA ResourceSlice controller can now optionally refuse to publish capacities and attributes with driver domain to prevent conflicts. Pull request #142218
- Kubernetes v1.34.12 released. Release
Why it matters
This week brings support for post-quantum cryptography through ML-DSA integration across kubeadm and certificate signing, improving security for future threats. The addition of server-side opt-out for managedFields and mutable workload scheduling parameters addresses operational needs for API efficiency and dynamic resource management. Multiple performance and correctness improvements across watch validation, caching, and device management strengthen the core platform.
Changelog entry
- Kubeadm: add ML-DSA-44, ML-DSA-65, and ML-DSA-87 support to ClusterConfiguration.EncryptionAlgorithm Pull request #142037
- Kube-apiserver: update konnectivity network proxy to v0.37.0 with CVE fixes and performance improvements Pull request #142400
- Certificates: add ML-DSA support to CertificateSigningRequests with CertificateSigningRequestMLDSA feature gate Pull request #142196
- Api: support drop=metadata.managedFields in Accept header to omit managedFields from responses Pull request #139561
- Scheduling: make CompositePodGroup.Spec.SchedulingPolicy.Gang.MinGroupCount mutable Pull request #141023
- Apiserver: add watch validation using revision tracking Pull request #142381
- Validation-gen: support time.Duration in +k8s:minimum/maximum annotations Pull request #142368
- DRA: include extended resource claims in pod claim iteration and taint eviction Pull request #142289
- Kubelet/devicemanager: preserve in-flight device reservations across rebuilds Pull request #137534
- Api: document platform-specific semantics of Node.status.volumesAttached[].devicePath Pull request #141861
This week: ML-DSA post-quantum cryptography support in kubeadm and certificates, managedFields opt-out for API responses, mutable workload scheduling, watch validation improvements, and four patch releases.
Kubernetes shipped significant updates this week: post-quantum cryptography support via ML-DSA for kubeadm and certificate signing; server-side control over metadata.managedFields in API responses; mutable workload group sizing for dynamic scheduling; improved watch validation; and refinements to device management and performance. Four patch releases (v1.34.12, v1.35.9, v1.36.5, v1.37.1) are available.
Week of September 14, 2026
What shipped
- IP/CIDR Validation feature graduates to GA, removing the feature gate requirement. Pull request #141979
- PodCertificateRequest and pod certificate projections now support ML-DSA algorithms for signing PKCS#10 CSRs. Pull request #142108
- Kubectl explain command gains shell autocompletion support. Pull request #140058
- HPA now correctly excludes pod overhead from pod-level resource request calculations. Pull request #142154
- ResourceQuota validation no longer incorrectly rejects updates that preserve previously stored values. Pull request #142163
- StatefulSet restore from ControllerRevision now preserves only the.spec field to prevent unintended modifications. Pull request #142159
- Pod sorting by creation time now uses UID as a tie-breaker to ensure deterministic ordering. Pull request #141211
- Kubelet no longer incorrectly inherits probe state from replaced containers after restart. Pull request #141487
- LimitRanger no longer applies min/max checks to unchanged PersistentVolumeClaim requests on update. Pull request #142170
- Pod resize end-to-end tests now properly wait for resize actuation before continuing. Pull request #142106
Why it matters
Multiple bug fixes address correctness issues in resource management, scheduling, and validation that could affect production workloads. New features like kubectl autocompletion and ML-DSA support expand functionality for operators and security use cases.
Changelog entry
- IP/CIDR Validation feature gate removed as feature graduates to GA Pull request #141979
- Added ML-DSA algorithm support to PodCertificateRequest and pod certificate projections Pull request #142108
- Kubectl explain command now supports shell autocompletion Pull request #140058
- Fixed HPA pod-level resource request calculations to exclude pod overhead Pull request #142154
- Fixed ResourceQuota validation to accept stored values during updates Pull request #142163
- StatefulSet now restores only.spec from ControllerRevision to prevent unintended field modifications Pull request #142159
- Added UID tie-breaker to PodsByCreationTime sort for deterministic ordering Pull request #141211
- Kubelet no longer inherits probe state from replaced containers after restart Pull request #141487
- LimitRanger skips min/max checks on unchanged PersistentVolumeClaim requests during updates Pull request #142170
- Fixed container memory resize validation error message reporting wrong variable Pull request #141100
This week: IP/CIDR Validation reaches GA, pod overhead handling fixed in HPA, kubectl explain gains autocompletion, plus fixes for resource validation and StatefulSet restoration.
Notable updates to Kubernetes this week include IP/CIDR Validation graduating to GA, improvements to pod resource calculations in HPA that now properly exclude overhead, shell autocompletion for kubectl explain, and critical bug fixes for ResourceQuota validation and StatefulSet restoration from ControllerRevision.