What velero-io/velero shipped
Written by FoxPlug from the repository's own releases; not affiliated with Velero. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/velero-io/velero; Velero did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Velero v1.19.0-rc.1 was released, introducing a block data mover for container storage. Release
- Seven image vulnerabilities in golang.org/x/net and golang.org/x/crypto were fixed, and Go was bumped to 1.27. Pull request #10781
- The API module split was reverted so pkg/apis is part of the root Velero module again. Pull request #10770
- Backup sync now ignores incomplete PVB to avoid unexpected execution from tampered BSL data. Pull request #10769
- The incomplete PVB fix for backup sync was backported to the 1.18 branch. Pull request #10772
- Possible nil objects are now removed from the object list retrieved from BSL. Pull request #10771
- The Tilt dev setup was fixed to work from a clean checkout and on arm64 hosts. Pull request #10739
- A DATA_MOVER parameter was added to E2E tests to select a named snapshot data mover. Pull request #10775
- E2E provider plugin images were fixed to install the AWS plugin for S3-compatible storage, and Velero v1.18 was added. Pull request #10774
- The FSBackup backup deletion case now runs on kind under CSI. Pull request #10764
Why it matters
This week brings the first release candidate for 1.19, including a new block data mover, while security and correctness fixes address image vulnerabilities and backup sync handling of incomplete or tampered data. Documentation and release notes for 1.19 are in place, and developer tooling and E2E coverage were improved.
Changelog entry
- Release v1.19.0-rc.1 with block data mover. Release
- Fix image vulnerabilities and bump Go to 1.27. Pull request #10781
- Revert API module split so pkg/apis is part of the root module. Pull request #10770
- Ignore incomplete PVB for backup sync. Pull request #10769
- Backport incomplete PVB fix to 1.18. Pull request #10772
- Remove possible nil object from object list retrieved from BSL. Pull request #10771
- Fix Tilt dev setup for clean checkout and arm64. Pull request #10739
- Add DATA_MOVER parameter to E2E tests. Pull request #10775
- Fix E2E provider plugin images and add Velero v1.18. Pull request #10774
- Run FSBackup backup deletion case on kind under CSI. Pull request #10764
- Add 1.19 release notes. Pull request #10761
- Add upgrade to 1.19 doc. Pull request #10782
Velero v1.19.0-rc.1 is out with a block data mover. This week also fixed image vulnerabilities and bumped Go to 1.27, reverted the API module split, and made backup sync ignore incomplete PVB from BSL. Tilt dev setup now works on clean checkouts and arm64.
Velero v1.19.0-rc.1 is available, introducing a block data mover for container storage. Alongside the release candidate, this week's changes fixed seven image vulnerabilities and bumped Go to 1.27, reverted the API module split so pkg/apis is part of the root module again, and updated backup sync to ignore incomplete PVB to avoid unexpected execution from tampered BSL data. The Tilt development setup now works from a clean checkout and on arm64, and E2E tests gained a DATA_MOVER parameter.
Week of October 26, 2026
What shipped
- Backup and restore logs can now be fetched while a backup or restore is Finalizing or FinalizingPartiallyFailed. Pull request #10684
- Added parallel upload and download control for the file system and block data movers. Pull request #10740
- Backup deletion now recognizes the GCS object-not-found error so a tarball already gone is handled correctly. Pull request #10673
- A kopia snapshot still not found after a repo refresh is now treated as deleted, so backup deletion no longer errors. Pull request #10700
- Fixed a hardcoded BLKZEROOUT ioctl request number in the block uploader that was wrong on some architectures. Pull request #10698
- Backup sync, backup delete and restore now ignore invalid PodVolumeBackup uploaders as part of the Restic deprecation. Pull request #10762
- The resourcemodifiers package moved from internal/ to pkg/ so external plugins such as Restore Item Action plugins can import it. Pull request #10759
- Added a CodeQL workflow that runs static analysis on the Go code. Pull request #10695
- Grouped Go security updates in Dependabot for both module entries. Pull request #10689
- Relocated the kopia repository to velero-io. Pull request #10763
Why it matters
This week improves failure handling on the paths that most often go wrong in practice: deleting backups whose tarball or snapshot is already gone, and reading logs while an operation is still finishing. Operators also get new control over data mover upload and download concurrency, and plugin authors can now reuse the built-in resource modifier implementation.
Changelog entry
- Allow backup and restore logs to be fetched while Finalizing. Pull request #10684
- Add parallel upload and download control for the file system and block data mover. Pull request #10740
- Recognize the GCS object-not-found error when deleting a backup. Pull request #10673
- Treat a kopia snapshot not found after a repo refresh as deleted. Pull request #10700
- Fix the architecture-specific BLKZEROOUT ioctl request number in the block uploader. Pull request #10698
- Ignore invalid PodVolumeBackup uploaders in backup sync, backup delete and restore. Pull request #10762
- Move the resourcemodifiers package to pkg/ for external plugin reuse. Pull request #10759
- Add a CodeQL workflow for Go static analysis. Pull request #10695
- Group Go security updates in Dependabot. Pull request #10689
- Relocate the kopia repository to velero-io. Pull request #10763
- Add data mover memory and upload concurrency tuning guidance. Pull request #10752
- Fix the links to Slack channels. Pull request #10755
This week: logs for backups and restores in Finalizing are now readable, GCS object-not-found and stale kopia snapshots are handled on delete, parallel upload and download control lands for the file system and block data movers, and a block uploader ioctl fix for other architectu
This week in Velero: velero backup logs and velero restore logs now work while a backup or restore is in Finalizing or FinalizingPartiallyFailed. Backup deletion handles two common failures better, recognizing the GCS object-not-found error and treating a kopia snapshot still missing after a repo refresh as deleted. Parallel upload and download control was added for the file system and block data movers. The block uploader no longer hardcodes a BLKZEROOUT ioctl request number that is architecture specific. Backup sync, delete and restore now ignore invalid PodVolumeBackup uploaders in the Restic deprecation work. The resourcemodifiers package moved to pkg/ so external restore item action plugins can import it. CodeQL analysis was added for the Go code, and Dependabot now groups Go security
Week of October 19, 2026
What shipped
- Fixed a restore resource priorities aliasing bug that could skip restoring resources when a dash appears in the middle of the priority list. Pull request #10665
- Velero version now explains that compatibility is not guaranteed when client and server major or minor versions differ, includes both versions, and identifies which side to update. Pull request #10655
- The e2e suite now matches --features as the comma-separated list it is, so EnableCSI checks work when more than one feature is enabled. Pull request #10661
- The e2e suite now fails when a label filter selects no specs instead of reporting a successful run that tested nothing. Pull request #10674
- Kibishii snapshot cases now run on kind under CSI in CI. Pull request #10658
- The namespace-mapping e2e cases now run with real volumes on kind under CSI. Pull request #10679
- Make serve-docs works again on buildx setups where the image was never landing in the local store. Pull request #10649
- The volume group snapshot documentation now uses kubectl version instead of the removed --short flag so readers can check both versions. Pull request #10685
- The README OpenSSF Best Practices badge now points directly at bestpractices.dev instead of the retired domain. Pull request #10683
- The SKIP_KIND label, which nothing reads, has been removed from three e2e specs. Pull request #10660
Why it matters
This week fixes a restore bug that could skip resources and makes version mismatch warnings clearer for anyone running a client and server on different releases. The e2e changes mean CI runs more of the snapshot and namespace-mapping cases on kind and can no longer report a passing run that selected no specs.
Changelog entry
- Fix restore resource priorities aliasing that could skip restoring resources. Pull request #10665
- Clarify client and server version mismatch warnings in velero version. Pull request #10655
- Match --features as a comma-separated list in the e2e suite. Pull request #10661
- Fail the e2e suite when a label filter selects no specs. Pull request #10674
- Run Kibishii snapshot cases on kind under CSI. Pull request #10658
- Give namespace-mapping e2e cases real volumes on kind under CSI. Pull request #10679
- Fix make serve-docs on buildx setups. Pull request #10649
- Fix Kubernetes version check for volume group snapshot docs. Pull request #10685
- Point README OpenSSF Best Practices badge at bestpractices.dev. Pull request #10683
- Drop the unused SKIP_KIND e2e label. Pull request #10660
This week: fixed a restore resource priorities bug that could skip resources, clearer client and server version mismatch warnings, and e2e runs that fail when a label filter selects nothing.
This week in Velero: fixed a restore resource priorities aliasing bug that could skip restoring resources when a dash appears in the middle of the priority list. Velero version now explains that compatibility is not guaranteed when client and server major or minor versions differ and shows which side to update. The e2e suite now matches --features as the comma-separated list it is and fails when a label filter selects no specs, and Kibishii snapshot and namespace-mapping cases now run on kind under CSI. Make serve-docs works again on buildx setups.
Week of October 12, 2026
What shipped
- The CSI end-to-end test cases now run on kind in CI, completing the remaining piece of the kind CSI work. Pull request #10644
- The Kibishii installer now uses the kind-csi overlay when CSI is enabled, with the KIBISHII_COMMIT pin moved to the commit that adds it. Pull request #10657
- Kind e2e jobs now reuse cached Go modules across CI jobs instead of downloading every module on every run. Pull request #10656
- Restore gained an AllowExistingVolumeMismatch option that lets you bypass the same volume handle pre-flight check. Pull request #10651
- The CSI-on-kind documentation now uses the storage-class-file flag instead of a sed edit of the test data file. Pull request #10643
- Code, scripts and some template files now reference velero-io instead of vmware-tanzu, with the site, changelogs and design directories excluded for now. Pull request #10650
- Three broken anchor links in the main docs were pointed at anchors that exist on the rendered pages. Pull request #10638
- The velero bug command and issue templates now use velero-io repository issue URLs instead of the legacy vmware-tanzu ones. Pull request #10640
Why it matters
This week brings the CSI e2e cases onto kind in CI, so that path is now exercised automatically, and points Kibishii at the matching overlay. CI should also see fewer module download failures now that Go modules are cached between kind e2e jobs. Restore users get a new option for bypassing the same volume handle pre-flight check, and the remaining changes move repository references and docs to the velero-io organization.
Changelog entry
- Run the CSI e2e cases on kind in CI. Pull request #10644
- Point Kibishii at the kind-csi overlay when CSI is enabled and update the KIBISHII_COMMIT pin. Pull request #10657
- Reuse cached Go modules across kind e2e CI jobs. Pull request #10656
- Add AllowExistingVolumeMismatch to restore to bypass the same volume handle pre-flight check. Pull request #10651
- Document the storage-class flag for CSI on kind instead of editing test data. Pull request #10643
- Update code, scripts and template files for the move from vmware-tanzu to velero-io. Pull request #10650
- Fix broken anchor links in the main docs. Pull request #10638
- Update legacy repository issue URLs in the velero bug command and issue templates. Pull request #10640
This week: CSI e2e cases now run on kind in CI, Kibishii uses the kind-csi overlay when CSI is enabled, and kind e2e jobs reuse cached Go modules. Restore adds AllowExistingVolumeMismatch, and docs and issue URLs move to velero-io.
This week in Velero: the CSI end-to-end cases now run on kind in CI, completing the remaining piece of the kind CSI work. The Kibishii installer points at the kind-csi overlay when CSI is enabled, and the KIBISHII_COMMIT pin moves to the commit that adds it. Kind e2e jobs now reuse cached Go modules across jobs instead of downloading every module on each run. Restore adds AllowExistingVolumeMismatch for bypassing the same volume handle pre-flight check. The CSI-on-kind docs now use the storage-class-file flag, three broken anchor links in the main docs are fixed, and issue URLs and references move from vmware-tanzu to velero-io.
Week of October 5, 2026
What shipped
- Archive extraction now rejects sibling directories by checking path boundaries in sanitizeArchivePath, closing a Zip Slip gap. Pull request #10212
- A crash from concurrent map writes in pvcPvMap was fixed so ItemBlock worker goroutines no longer race during PersistentVolume backups. Pull request #10635
- Backup request preparation now propagates the reconciler context instead of context.Background when listing storage locations and getting resources. Pull request #10621
- Users now get a warning when snapshot-based volume data of an existing PVC is not restored, instead of only the generic already exists message. Pull request #10570
- The repository metadata cache duration and stale problem was fixed. Pull request #10637
- Uninstall command error messages were standardized to Velero lowercase conventions. Pull request #10619
- The MinIO image cache key in the kind e2e workflow was corrected so the saved image is actually restored by the e2e jobs. Pull request #10631
- CSI snapshot verification on kind was added so four snapshot cases that previously failed verification can run. Pull request #10593
- End-to-end coverage for VolumeGroupSnapshot was added, grouping PVCs sharing a label into one VolumeGroupSnapshot. Pull request #10598
- End-to-end StorageClass definitions are now configurable through storage-class-file flags instead of hardcoded handling. Pull request #10588
Why it matters
This week touched backup correctness and e2e reliability. Crashes, context propagation, path checks, and clearer warnings reduce surprises during real backups and restores, while more CSI and VolumeGroupSnapshot e2e coverage and fixed workflow caching make the tests more trustworthy.
Changelog entry
- Fix Zip Slip path check accepting a sibling directory in archive extraction. Pull request #10212
- Fix concurrent map writes crash in pvcPvMap. Pull request #10635
- Propagate context during backup request preparation. Pull request #10621
- Warn when the volume data of an existing PVC backed up by snapshot is not restored. Pull request #10570
- Fix the repo metadata cache duration and stale problem. Pull request #10637
- Standardize uninstall error messages to Velero lowercase conventions. Pull request #10619
- Fix the MinIO image cache key in the kind e2e workflow. Pull request #10631
- Verify CSI snapshots on kind in e2e. Pull request #10593
- Add VolumeGroupSnapshot coverage in e2e. Pull request #10598
- Make e2e StorageClass definitions configurable. Pull request #10588
- Document running the CSI cases on kind. Pull request #10630
- Correct why the kind backup cases are skipped in e2e. Pull request #10636
This week: fixed a Zip Slip boundary check, a concurrent map write crash in pvcPvMap, context propagation in backup prep, and a stale repo metadata cache. Added a warning when snapshot volume data is not restored, plus CSI and VolumeGroupSnapshot e2e coverage.
This week in Velero: archive extraction now rejects sibling directories with a proper path boundary check, and a concurrent map write crash in pvcPvMap was fixed. Backup request preparation propagates the reconciler context, and the repository metadata cache duration and stale problem was corrected. Users now see a warning when snapshot-based volume data of an existing PVC is not restored. On the e2e side, CSI snapshot verification and VolumeGroupSnapshot coverage were added, StorageClass definitions became configurable, and the MinIO image cache key in the kind workflow was fixed.
Week of September 28, 2026
What shipped
- Velero v1.18.4 released with fix for backup queue permanently stuck when a dequeued backup completes during processing. Release
- VolumeGroupSnapshot API version now detected at runtime to support v1, v1beta2, and v1beta1 across different Kubernetes distributions. Pull request #10601
- CSI PVC backup action now defers VolumeGroupSnapshot cleanup until backup finalization to avoid premature deletion during async operations. Pull request #10612
- VGDP soothing enabled by default with queue length set to 5 to address issue #10575. Pull request #10578
- Script added to install CSI snapshot support on kind clusters for e2e testing as part of CSI-on-kind work. Pull request #10596
- GetResourcePoliciesFromBackup replaced with GetGlobalResourcePolicies to support cluster-wide global backup volume policies. Pull request #10607
- CRD manifests regenerated to include the Activities field added to PodVolumeBackupStatus, PodVolumeRestoreStatus, DataUploadStatus, and DataDownloadStatus. Pull request #10608
- Type assertion panic fixed in ChangeImageNameAction when reading container image field. Pull request #10574
- Architecture entry point and roadmap change process documentation added to make Velero's goals and processes more discoverable. Pull request #10572
- Context propagation fixed in backup repository BSL invalidation to properly use caller-provided context. Pull request #10605
Why it matters
V1.18.4 addresses a critical backup queue issue that could leave backups permanently stuck. Improvements to VolumeGroupSnapshot handling and VGDP soothing enhance reliability for users relying on CSI snapshots and volume group backups. Better API version detection makes Velero more compatible across Kubernetes distributions.
Changelog entry
- Fix backup queue permanently stuck when a dequeued backup completes during processing Release
- Detect VolumeGroupSnapshot API version at runtime to support v1, v1beta2, and v1beta1 Pull request #10601
- Defer VolumeGroupSnapshot cleanup until backup finalization Pull request #10612
- Enable VGDP soothing by default and set queue length to 5 Pull request #10578
- Regenerate CRD manifests for Activities field in status Pull request #10608
- Fix unchecked type assertion panic in ChangeImageNameAction Pull request #10574
- Use GetGlobalResourcePolicies to replace GetResourcePoliciesFromBackup Pull request #10607
- Propagate context in backup repository BSL invalidation Pull request #10605
- Align block and kopia snapshot error messages with lowercase standards Pull request #10558
- Point PodVolumeBackup Node print column at.spec.node Pull request #10585
Velero v1.18.4 is out with a fix for backup queues getting stuck. VolumeGroupSnapshot API version detection now works across distributions.
Velero v1.18.4 is now available. This release fixes a critical issue where backup queues could become permanently stuck, improves VolumeGroupSnapshot handling by detecting API versions at runtime, and defers cleanup operations until backup finalization. Enhanced compatibility across Kubernetes distributions including OpenShift.
Week of September 21, 2026
What shipped
- Released v1.18.4-rc.1 with a fix for backup queue permanently stuck when a dequeued backup completes. Release
- Released v1.18.3 with a fix for duplicated InitContainer names generated in velero install CLI. Release
- Implemented namespace selection by label in resource policy, allowing dynamic include or exclude of namespaces from backups using Kubernetes label selectors. Pull request #10275
- Changed hashing algorithm to HMAC-SHA256-128 for kopia repository. Pull request #10579
- Fixed backup-finalizer to not set backup phase to Completed before PutBackupMetadata succeeds. Pull request #9646
- Fixed CVEs for v1.18.4 by bumping go.opentelemetry.io/otel/sdk to 1.45.0, google.golang.org/grpc to 1.83.2, and paketobuildpacks/run-jammy-tiny to 0.2.177. Pull request #10569
- Deduped entries in backuprequest.spec.excludeNamespaces when a namespace with velero.io/exclude-from-backup label is added. Pull request #10562
- Fixed schedule create command to properly accept and pass through --annotations flag instead of silently dropping it. Pull request #10549
- Added printer columns for BackupStorageLocation provider and access mode to kubectl output. Pull request #10441
- Added ability to customize the tolerations of maintenance jobs. Pull request #10553
Why it matters
V1.18.4-rc.1 and v1.18.3 releases address critical issues with backup queue handling and CLI installation. The namespace label selection feature in resource policies gives users more flexible backup filtering options. Multiple context propagation and CVE fixes improve reliability and security.
Changelog entry
- Fix backup queue permanently stuck when a dequeued backup completes Release
- Change hashing algorithm to HMAC-SHA256-128 for kopia repo Pull request #10579
- Fix backup-finalizer: do not set backup phase to Completed before PutBackupMetadata succeeds Pull request #9646
- Implement namespace selection by label in resource policy Pull request #10275
- Dedup entries in backuprequest.spec.excludeNamespaces Pull request #10562
- Fix schedule create dropping annotations Pull request #10549
- Fix CVEs for v1.18.4: bump go.opentelemetry.io/otel/sdk, google.golang.org/grpc, and paketobuildpacks/run-jammy-tiny Pull request #10569
- Customize the tolerations of maintenance job Pull request #10553
- Add printer columns for BackupStorageLocation provider and access mode Pull request #10441
- Propagate caller context in repository manager Forget/BatchForget Pull request #10554
Velero v1.18.3 and v1.18.4-rc.1 shipped this week with backup queue fixes, namespace label selection in resource policies, and CVE updates.
This week Velero released v1.18.3 and v1.18.4-rc.1, bringing important reliability and security improvements. Key additions include namespace selection by label in resource policies for more flexible backup filtering, fixes for backup queue handling, and CVE patches. The v1.18.4-rc.1 release candidate is now available for testing.
Week of September 14, 2026
What shipped
- Moved fallback full restore logic from PVC CSI RIA to data mover for better separation of concerns. Pull request #10541
- Added pre-flight check ensuring PVC is large enough to hold backed-up data during in-place restore. Pull request #10512
- Fixed in-place restore pre-flight check to identify volumes by CSI handle instead of PV name. Pull request #10530
- Fixed backup queue getting permanently stuck when a dequeued backup completes during the patch operation. Pull request #10521
- Added namespace mapping support for in-place restore with block data mover. Pull request #10461
- Fixed CSI PVC restore action to properly propagate context and standardize error handling. Pull request #10526
- Added support for skipped PVCs in VolumeInfos. Pull request #10525
- Fixed ServiceAccount token volume mount stripping to apply consistently across all container types during restore. Pull request #10349
- Added configurable tolerations for PodVolumeBackup and data mover pods via node-agent-configmap. Pull request #9575
- Fixed schedule reconciler to compare skipImmediately and lastSkipped by value instead of pointer. Pull request #10490
Why it matters
This week's changes address critical issues in in-place restore operations, backup queue management, and CSI volume handling that improve reliability and prevent data loss scenarios. Several fixes ensure proper context propagation, namespace mapping support, and preflight validation checks that operators depend on for safe restore operations.
Changelog entry
- Moved fallback full restore logic from PVC CSI RIA to data mover Pull request #10541
- Added in-place restore pre-flight check: PVC must be large enough for backed-up data Pull request #10512
- Fixed in-place restore pre-flight check to identify volumes by CSI volume handle Pull request #10530
- Fixed backup queue permanently stuck when dequeued backup completes during patch Pull request #10521
- Added namespace mapping support for in-place restore with block data mover Pull request #10461
- Fixed CSI PVC restore action to propagate context and standardize errors Pull request #10526
- Added support for skipped PVC in VolumeInfos Pull request #10525
- Fixed ServiceAccount token volume mount stripping for EphemeralContainers Pull request #10349
- Added configurable tolerations for PodVolumeBackup and data mover pods Pull request #9575
- Fixed schedule reconciler to compare skipImmediately and lastSkipped by value Pull request #10490
- Added nil checks to in-place restore preflight functions Pull request #10480
- Fixed snapshot-location get --selector flag to filter by label Pull request #10449
- Standardized error handling in CSI PVC restore action Pull request #10526
- Added documentation for block data mover Pull request #10537
- Documented --write-sparse-files flag for disk space issues during restore Pull request #9221
- Clarified --wait flag behavior in install command (default false) Pull request #10507
- Added test and documentation coverage for set-based label selectors on restore Pull request #10027
- Added fallback full flag to DataUpload, DataDownload, PodVolumeBackup, and PodVolumeRestore CRs Pull request #10517
This week: in-place restore pre-flight checks, backup queue fixes, CSI volume handle identification, namespace mapping support, and better context propagation in restore operations.
This week's Velero updates focus on in-place restore reliability and data safety. Key improvements include preflight checks to ensure PVC capacity, fixes to identify volumes by CSI handle instead of PV name, prevention of backup queue deadlocks, namespace mapping support for block data movers, and better error handling in CSI restore operations. These changes strengthen restore workflows for production environments.