What velero-io/velero shipped
Written by FoxPlug from the repository's own releases; not affiliated with Velero. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/velero-io/velero; Velero did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Archive extraction now rejects sibling directories by checking path boundaries in sanitizeArchivePath, closing a Zip Slip gap. Pull request #10212
- A crash from concurrent map writes in pvcPvMap was fixed so ItemBlock worker goroutines no longer race during PersistentVolume backups. Pull request #10635
- Backup request preparation now propagates the reconciler context instead of context.Background when listing storage locations and getting resources. Pull request #10621
- Users now get a warning when snapshot-based volume data of an existing PVC is not restored, instead of only the generic already exists message. Pull request #10570
- The repository metadata cache duration and stale problem was fixed. Pull request #10637
- Uninstall command error messages were standardized to Velero lowercase conventions. Pull request #10619
- The MinIO image cache key in the kind e2e workflow was corrected so the saved image is actually restored by the e2e jobs. Pull request #10631
- CSI snapshot verification on kind was added so four snapshot cases that previously failed verification can run. Pull request #10593
- End-to-end coverage for VolumeGroupSnapshot was added, grouping PVCs sharing a label into one VolumeGroupSnapshot. Pull request #10598
- End-to-end StorageClass definitions are now configurable through storage-class-file flags instead of hardcoded handling. Pull request #10588
Why it matters
This week touched backup correctness and e2e reliability. Crashes, context propagation, path checks, and clearer warnings reduce surprises during real backups and restores, while more CSI and VolumeGroupSnapshot e2e coverage and fixed workflow caching make the tests more trustworthy.
Changelog entry
- Fix Zip Slip path check accepting a sibling directory in archive extraction. Pull request #10212
- Fix concurrent map writes crash in pvcPvMap. Pull request #10635
- Propagate context during backup request preparation. Pull request #10621
- Warn when the volume data of an existing PVC backed up by snapshot is not restored. Pull request #10570
- Fix the repo metadata cache duration and stale problem. Pull request #10637
- Standardize uninstall error messages to Velero lowercase conventions. Pull request #10619
- Fix the MinIO image cache key in the kind e2e workflow. Pull request #10631
- Verify CSI snapshots on kind in e2e. Pull request #10593
- Add VolumeGroupSnapshot coverage in e2e. Pull request #10598
- Make e2e StorageClass definitions configurable. Pull request #10588
- Document running the CSI cases on kind. Pull request #10630
- Correct why the kind backup cases are skipped in e2e. Pull request #10636
This week: fixed a Zip Slip boundary check, a concurrent map write crash in pvcPvMap, context propagation in backup prep, and a stale repo metadata cache. Added a warning when snapshot volume data is not restored, plus CSI and VolumeGroupSnapshot e2e coverage.
This week in Velero: archive extraction now rejects sibling directories with a proper path boundary check, and a concurrent map write crash in pvcPvMap was fixed. Backup request preparation propagates the reconciler context, and the repository metadata cache duration and stale problem was corrected. Users now see a warning when snapshot-based volume data of an existing PVC is not restored. On the e2e side, CSI snapshot verification and VolumeGroupSnapshot coverage were added, StorageClass definitions became configurable, and the MinIO image cache key in the kind workflow was fixed.
Week of September 28, 2026
What shipped
- Velero v1.18.4 released with fix for backup queue permanently stuck when a dequeued backup completes during processing. Release
- VolumeGroupSnapshot API version now detected at runtime to support v1, v1beta2, and v1beta1 across different Kubernetes distributions. Pull request #10601
- CSI PVC backup action now defers VolumeGroupSnapshot cleanup until backup finalization to avoid premature deletion during async operations. Pull request #10612
- VGDP soothing enabled by default with queue length set to 5 to address issue #10575. Pull request #10578
- Script added to install CSI snapshot support on kind clusters for e2e testing as part of CSI-on-kind work. Pull request #10596
- GetResourcePoliciesFromBackup replaced with GetGlobalResourcePolicies to support cluster-wide global backup volume policies. Pull request #10607
- CRD manifests regenerated to include the Activities field added to PodVolumeBackupStatus, PodVolumeRestoreStatus, DataUploadStatus, and DataDownloadStatus. Pull request #10608
- Type assertion panic fixed in ChangeImageNameAction when reading container image field. Pull request #10574
- Architecture entry point and roadmap change process documentation added to make Velero's goals and processes more discoverable. Pull request #10572
- Context propagation fixed in backup repository BSL invalidation to properly use caller-provided context. Pull request #10605
Why it matters
V1.18.4 addresses a critical backup queue issue that could leave backups permanently stuck. Improvements to VolumeGroupSnapshot handling and VGDP soothing enhance reliability for users relying on CSI snapshots and volume group backups. Better API version detection makes Velero more compatible across Kubernetes distributions.
Changelog entry
- Fix backup queue permanently stuck when a dequeued backup completes during processing Release
- Detect VolumeGroupSnapshot API version at runtime to support v1, v1beta2, and v1beta1 Pull request #10601
- Defer VolumeGroupSnapshot cleanup until backup finalization Pull request #10612
- Enable VGDP soothing by default and set queue length to 5 Pull request #10578
- Regenerate CRD manifests for Activities field in status Pull request #10608
- Fix unchecked type assertion panic in ChangeImageNameAction Pull request #10574
- Use GetGlobalResourcePolicies to replace GetResourcePoliciesFromBackup Pull request #10607
- Propagate context in backup repository BSL invalidation Pull request #10605
- Align block and kopia snapshot error messages with lowercase standards Pull request #10558
- Point PodVolumeBackup Node print column at.spec.node Pull request #10585
Velero v1.18.4 is out with a fix for backup queues getting stuck. VolumeGroupSnapshot API version detection now works across distributions.
Velero v1.18.4 is now available. This release fixes a critical issue where backup queues could become permanently stuck, improves VolumeGroupSnapshot handling by detecting API versions at runtime, and defers cleanup operations until backup finalization. Enhanced compatibility across Kubernetes distributions including OpenShift.
Week of September 21, 2026
What shipped
- Released v1.18.4-rc.1 with a fix for backup queue permanently stuck when a dequeued backup completes. Release
- Released v1.18.3 with a fix for duplicated InitContainer names generated in velero install CLI. Release
- Implemented namespace selection by label in resource policy, allowing dynamic include or exclude of namespaces from backups using Kubernetes label selectors. Pull request #10275
- Changed hashing algorithm to HMAC-SHA256-128 for kopia repository. Pull request #10579
- Fixed backup-finalizer to not set backup phase to Completed before PutBackupMetadata succeeds. Pull request #9646
- Fixed CVEs for v1.18.4 by bumping go.opentelemetry.io/otel/sdk to 1.45.0, google.golang.org/grpc to 1.83.2, and paketobuildpacks/run-jammy-tiny to 0.2.177. Pull request #10569
- Deduped entries in backuprequest.spec.excludeNamespaces when a namespace with velero.io/exclude-from-backup label is added. Pull request #10562
- Fixed schedule create command to properly accept and pass through --annotations flag instead of silently dropping it. Pull request #10549
- Added printer columns for BackupStorageLocation provider and access mode to kubectl output. Pull request #10441
- Added ability to customize the tolerations of maintenance jobs. Pull request #10553
Why it matters
V1.18.4-rc.1 and v1.18.3 releases address critical issues with backup queue handling and CLI installation. The namespace label selection feature in resource policies gives users more flexible backup filtering options. Multiple context propagation and CVE fixes improve reliability and security.
Changelog entry
- Fix backup queue permanently stuck when a dequeued backup completes Release
- Change hashing algorithm to HMAC-SHA256-128 for kopia repo Pull request #10579
- Fix backup-finalizer: do not set backup phase to Completed before PutBackupMetadata succeeds Pull request #9646
- Implement namespace selection by label in resource policy Pull request #10275
- Dedup entries in backuprequest.spec.excludeNamespaces Pull request #10562
- Fix schedule create dropping annotations Pull request #10549
- Fix CVEs for v1.18.4: bump go.opentelemetry.io/otel/sdk, google.golang.org/grpc, and paketobuildpacks/run-jammy-tiny Pull request #10569
- Customize the tolerations of maintenance job Pull request #10553
- Add printer columns for BackupStorageLocation provider and access mode Pull request #10441
- Propagate caller context in repository manager Forget/BatchForget Pull request #10554
Velero v1.18.3 and v1.18.4-rc.1 shipped this week with backup queue fixes, namespace label selection in resource policies, and CVE updates.
This week Velero released v1.18.3 and v1.18.4-rc.1, bringing important reliability and security improvements. Key additions include namespace selection by label in resource policies for more flexible backup filtering, fixes for backup queue handling, and CVE patches. The v1.18.4-rc.1 release candidate is now available for testing.
Week of September 14, 2026
What shipped
- Moved fallback full restore logic from PVC CSI RIA to data mover for better separation of concerns. Pull request #10541
- Added pre-flight check ensuring PVC is large enough to hold backed-up data during in-place restore. Pull request #10512
- Fixed in-place restore pre-flight check to identify volumes by CSI handle instead of PV name. Pull request #10530
- Fixed backup queue getting permanently stuck when a dequeued backup completes during the patch operation. Pull request #10521
- Added namespace mapping support for in-place restore with block data mover. Pull request #10461
- Fixed CSI PVC restore action to properly propagate context and standardize error handling. Pull request #10526
- Added support for skipped PVCs in VolumeInfos. Pull request #10525
- Fixed ServiceAccount token volume mount stripping to apply consistently across all container types during restore. Pull request #10349
- Added configurable tolerations for PodVolumeBackup and data mover pods via node-agent-configmap. Pull request #9575
- Fixed schedule reconciler to compare skipImmediately and lastSkipped by value instead of pointer. Pull request #10490
Why it matters
This week's changes address critical issues in in-place restore operations, backup queue management, and CSI volume handling that improve reliability and prevent data loss scenarios. Several fixes ensure proper context propagation, namespace mapping support, and preflight validation checks that operators depend on for safe restore operations.
Changelog entry
- Moved fallback full restore logic from PVC CSI RIA to data mover Pull request #10541
- Added in-place restore pre-flight check: PVC must be large enough for backed-up data Pull request #10512
- Fixed in-place restore pre-flight check to identify volumes by CSI volume handle Pull request #10530
- Fixed backup queue permanently stuck when dequeued backup completes during patch Pull request #10521
- Added namespace mapping support for in-place restore with block data mover Pull request #10461
- Fixed CSI PVC restore action to propagate context and standardize errors Pull request #10526
- Added support for skipped PVC in VolumeInfos Pull request #10525
- Fixed ServiceAccount token volume mount stripping for EphemeralContainers Pull request #10349
- Added configurable tolerations for PodVolumeBackup and data mover pods Pull request #9575
- Fixed schedule reconciler to compare skipImmediately and lastSkipped by value Pull request #10490
- Added nil checks to in-place restore preflight functions Pull request #10480
- Fixed snapshot-location get --selector flag to filter by label Pull request #10449
- Standardized error handling in CSI PVC restore action Pull request #10526
- Added documentation for block data mover Pull request #10537
- Documented --write-sparse-files flag for disk space issues during restore Pull request #9221
- Clarified --wait flag behavior in install command (default false) Pull request #10507
- Added test and documentation coverage for set-based label selectors on restore Pull request #10027
- Added fallback full flag to DataUpload, DataDownload, PodVolumeBackup, and PodVolumeRestore CRs Pull request #10517
This week: in-place restore pre-flight checks, backup queue fixes, CSI volume handle identification, namespace mapping support, and better context propagation in restore operations.
This week's Velero updates focus on in-place restore reliability and data safety. Key improvements include preflight checks to ensure PVC capacity, fixes to identify volumes by CSI handle instead of PV name, prevention of backup queue deadlocks, namespace mapping support for block data movers, and better error handling in CSI restore operations. These changes strengthen restore workflows for production environments.