RepoJournal
Kubernetes @kubernetes
115 wires and counting

$ follow Kubernetes

Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-09
stories 85
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Kubernetes patches SSH DoS CVE, fixes kube-cross bullseye build break

By RepoJournal · Filed · About Kubernetes

kubernetes-prow[bot] Kubernetes Publisher Carlos Panato github-actions[bot] jihyun-huh pablo-ruth stephenfin
13 people shipped this
kubernetes-prow[bot] @kubernetes-prow[bot] 3 cited Kubernetes Publisher @k8s-publishing-bot 2 cited Carlos Panato @cpanato 2 cited github-actions[bot] @github-actions[bot] 1 cited jihyun-huh @jihyun-huh 1 cited pablo-ruth @pablo-ruth 1 cited stephenfin @stephenfin AboEl3iz @AboEl3iz ibm-adarsh @ibm-adarsh luxas @luxas Choraden @Choraden Jordan Liggitt @liggitt dependabot @dependabot

A DoS vulnerability in x/crypto/ssh is patched across core Kubernetes and its API module, and release engineering moves off Debian 11 as its LTS window closes.

A DoS vulnerability in the SSH library is now patched. Kubernetes core updated golang.org/x/crypto to v0.56.0 to address CVE-2026-78662, which "prevent[s] DoS on deadlocked undecided channel in x/crypto/ssh" [1]. The fix flowed into the API module as well [2]. Check your dependents for the same issue.

Release engineering is moving off an expired base image. kube-cross, which builds on debian:bullseye-slim, failed because Debian 11's LTS window closed on 2026-08-31 and the apt security repo is no longer re-signed, returning "Release file ... is expired (invalid since 12h 8min 45s)" [3]. The fix pins bullseye apt sources to snapshot.debian.org [3]. In the same effort, Go versions advance: kube-cross, go-runner, and releng-ci now build with Go 1.27.1/1.26.8, and deprecated Kubernetes version images are being cleaned up [4]. Note the google-cloud-sdk apt package is gone, replaced by google-cloud-cli in releng-ci [4].

Cluster Autoscaler fixed a provider bug and an overflow. The Scaleway provider previously overrode taints with identical key/value but different effects; it now reads a newly returned field with the correct taint list, and the change is retro-compatible because the old field is still present [5]. Separately, the AWS provider now avoids an int32 overflow when computing memory from InstanceRequirements [6].

Two API/internal dependencies were cleaned up. kube-openapi was bumped and go-json-experiment was dropped across core and the API module [7][8]. Related, the OCCM Helm chart release 2.36.5 shipped [9], and a regression test now exercises the ServiceMonitor-to-Service-to-DaemonSet wiring for disabled and enabled paths [10].

Action items

References

  1. [1] Merge pull request #141886 from AboEl3iz/fix-cve-2026-78662 ↗ kubernetes/kubernetes
  2. [2] Merge pull request #141886 from AboEl3iz/fix-cve-2026-78662 ↗ kubernetes/api
  3. [3] kube-cross: pin bullseye apt sources to snapshot.debian.org ↗ kubernetes/release
  4. [4] build kube-cross, go-runner, releng-ci with golang 1.27.1/1.26.8 ↗ kubernetes/release
  5. [5] fix: correctly handling duplicate key/value taints on scaleway ↗ kubernetes/autoscaler
  6. [6] Merge pull request #10171 from pujitha24/auto/issue-10167 ↗ kubernetes/autoscaler
  7. [7] Merge pull request #141873 from liggitt/kube-openapi ↗ kubernetes/kubernetes
  8. [8] Merge pull request #141873 from liggitt/kube-openapi ↗ kubernetes/api
  9. [9] openstack-cloud-controller-manager-2.36.5 ↗ kubernetes/cloud-provider-openstack
  10. [10] [occm] test: add loadbalancer servicemonitor regression (#3171) ↗ kubernetes/cloud-provider-openstack

$ ls kubernetes/reviews/ # the step-back reads

the week in review Declarative validation for Condition.Message lands, graduates stable the month in review August Ships Kubernetes 1.37 RC and kOps 1.37 Beta
Topics: Go Infrastructure Full archive →

Quick answers

What shipped in Kubernetes on September 9, 2026?
A DoS vulnerability in x/crypto/ssh is patched across core Kubernetes and its API module, and release engineering moves off Debian 11 as its LTS window closes. In total, 54 commits, 30 pull requests, and 1 releases landed.
Who contributed to Kubernetes on September 9, 2026?
13 developers shipped this update, including github-actions[bot], jihyun-huh, stephenfin, kubernetes-prow[bot], AboEl3iz, ibm-adarsh, luxas, and pablo-ruth, and 5 more.
What were the notable Kubernetes updates?
Merge pull request #141886 from AboEl3iz/fix-cve-2026-78662, Merge pull request #141886 from AboEl3iz/fix-cve-2026-78662, and kube-cross: pin bullseye apt sources to snapshot.debian.org.
♥

$ log @kubernetes --recent

kube-state-metrics exposes VolumeAttributesClass, kops adds Akamai firewall 35 shipped Docs drive the day: Spanish SIG Docs page lands, plus maintenance merges 15 shipped VPA chart 0.12.0 syncs CRDs on upgrade; kOps gains Amazon Linux 2027 coverage 49 shipped kOps drops legacy keyset aliases, mirroring deeper Kubernetes dependency shifts 37 shipped

$ log --all # elsewhere on the wire

@vuejs Compiler-SFC fix restores await scope in nested blocks @vercel Next.js fixes dev startup race as Turborepo layers telemetry and matcher speedups

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.