Who contributed to Kubernetes on June 9, 2026?

5 developers shipped this update, including cpanato, immanuwell, jfremy-openai, dependabot[bot], and my-git9.

What were the notable Kubernetes updates?

Update Go version to 1.26.4 to fix standard library vulnerabilities, Merge pull request #1782 from zhanggbj/fix_security, and Bump distroless-iptables to use Go 1.26.4/1.25.11.

@kubernetes

Container orchestration - what platform teams ship on

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO 1.26.4 PATCHES STANDARD LIBRARY VULNERABILITIES ACROSS THE ECOSYSTEM

By RepoJournal · Filed 06:01 UTC on June 9, 2026 · About Kubernetes

5 people shipped this

dependabot[bot] @dependabot[bot] 3 cited

cpanato @cpanato 1 cited

immanuwell @immanuwell 1 cited

jfremy-openai @jfremy-openai 1 cited

my-git9 @my-git9 1 cited

Cloud-provider-vsphere and distroless-iptables are both shipping Go 1.26.4 to patch multiple critical standard library security flaws.

The most urgent move this cycle: upgrade Go to 1.26.4 across your clusters and operators [1] [3]. Cloud-provider-vsphere just merged the jump to address GO-2026-5039, GO-2026-5038, GO-2026-5037 and others [2], and distroless-iptables is right behind it [3]. This isn't optional. If you're running vSphere integrations or iptables-based networking, patch immediately. In parallel, kube-state-metrics shipped two critical fixes [4] [5]. The first guards against nil pointer dereferences in deployment metrics that would panic under specific configurations [4]. The second fixes a sharding bug where bookmark events weren't propagating correctly after the WatchListClient upgrade [5], which means only one shard would sync properly in multi-shard setups. Both are backported and ready. On the release desk, promo-tools bumped to 4.5.1 [6], YAML library advanced to 4.0.0-rc.5 with a merge tag regression fix [7], and golang.org/x/text moved to 0.38.0 [8]. Documentation cleared backlog with staleness mitigation guidance landing in Chinese [9] and swap memory docs polished [10] .

Action items

→ Upgrade Go to 1.26.4 in all operators and components before next release kubernetes/cloud-provider-vsphere [immediate]
→ Upgrade kube-state-metrics to pick up nil-guard and sharding fixes if running 2.19.0 with multi-shard kubernetes/kube-state-metrics [immediate]
→ Bump promo-tools to 4.5.1 and update YAML dependency to 4.0.0-rc.5 in release tooling kubernetes/release [plan]

References

[1] Update Go version to 1.26.4 to fix standard library vulnerabilities kubernetes/cloud-provider-vsphere
[2] Merge pull request #1782 from zhanggbj/fix_security kubernetes/cloud-provider-vsphere
[3] Bump distroless-iptables to use Go 1.26.4/1.25.11 ↗ kubernetes/release
[4] fix(deployment): guard nil Spec.Replicas before dereference ↗ kubernetes/kube-state-metrics
[5] fix: watch-list bookmarks with sharding ↗ kubernetes/kube-state-metrics
[6] Bump sigs.k8s.io/promo-tools/v4 from 4.5.0 to 4.5.1 in the all group ↗ kubernetes/release
[7] Bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.5 ↗ kubernetes/release
[8] Bump golang.org/x/text from 0.37.0 to 0.38.0 ↗ kubernetes/release
[9] [zh-cn] Add blog: staleness-mitigation-for-controllers ↗ kubernetes/website
[10] Fix typo in swap-memory-management kubernetes/website

Quick answers

What shipped in Kubernetes on June 9, 2026?: Cloud-provider-vsphere and distroless-iptables are both shipping Go 1.26.4 to patch multiple critical standard library security flaws. In total, 26 commits and 18 pull requests landed.
Who contributed to Kubernetes on June 9, 2026?: 5 developers shipped this update, including cpanato, immanuwell, jfremy-openai, dependabot[bot], and my-git9.
What were the notable Kubernetes updates?: Update Go version to 1.26.4 to fix standard library vulnerabilities, Merge pull request #1782 from zhanggbj/fix_security, and Bump distroless-iptables to use Go 1.26.4/1.25.11.

SCHEDULER GAINS PREQUEUING FILTER, KUBELET USER NAMESPACES MOVE TO BETA

Kubernetes tackles the pod requeue bottleneck that's been choking large clusters, while user namespacing ships closer to production.

go 19 shipped 1-min read

@kubernetes 1 day ago

CLUSTER-AUTOSCALER PATCHES HIT ALL RELEASE BRANCHES AS DRA AND VOLUMEMOUNT BIND OPTIONS LAND

Cluster-autoscaler shipped four patch releases across versions 1.33 through 1.36 fixing ProvisioningRequest condition application and Scaleway node detection, while Kubernetes core merged DRA node operations and volumeMount bind mount options.

go 89 shipped 1-min read

@kubernetes 2 days ago

DRA GETS SMARTER RESOURCE ACCOUNTING, CLUSTER-AUTOSCALER ROLLS OUT FOUR PATCHES

Dynamic Resource Allocation fixed device accounting across its resource pool controller while cluster-autoscaler shipped maintenance releases across four versions.

go 52 shipped 1-min read

@kubernetes 3 days ago

DRA GRADUATES TO STABLE, KUBELET METRICS BYPASS CADVISOR, NAMESPACE LIFECYCLE UNBLOCKED

Three critical production fixes ship across core scheduler, metrics, and admission layers while DRA resource tracking stabilizes after surfacing a crash bug in the informer.

go 129 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.