RepoJournal
Kubernetes @kubernetes
176 wires and counting

$ follow Kubernetes

Keep up with Kubernetes in about 3 minutes: what actually shipped โ€” the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest โ€” weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-11-06
stories 7
GitHub RSS Archive Reviews

ยฉ 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire ยท showcase

ML-DSA support for service account tokens

By RepoJournal ยท Filed ยท About Kubernetes ยท Composed from the cited sources ยท methodology

kubernetes-prow[bot] zhanggbj Kubernetes Publisher
3 people shipped this
kubernetes-prow[bot] @kubernetes-prow[bot] 3 cited zhanggbj @zhanggbj 1 cited Kubernetes Publisher @k8s-publishing-bot 1 cited

Kubernetes' externaljwt module picked up ML-DSA signing for service account tokens, while cloud-provider-vsphere cleared a batch of CVEs with a Go toolchain bump and the release tooling stayed on routine dependency churn.

Merge pull request #142397 from everettraven/upstream/mldsa/sa-token-gen kubernetes/externaljwt

by Kubernetes Publisher

The externaljwt tree merged the upstream change titled "ML-DSA support for tokens," landing post-quantum signing capability in the service account token generation path. ML-DSA is the NIST-standardized module-lattice signature scheme, so tokens from this path can now be issued under a scheme whose verification path differs from existing RSA and ECDSA setups, which matters for anyone with mixed-...

๐ŸŒฑ Fix CVEs by bump golang to 1.26.0 kubernetes/cloud-provider-vsphere

by zhanggbj

cloud-provider-vsphere addressed a batch of CVEs by bumping the build toolchain to golang 1.26.0, per the PR description: "Fix CVEs by bump golang to 1.26.0." The commits change only the Go version the provider is compiled with, so no API or behavior change is called out, but images built from this branch need a rebuild before the fix reaches a released tag.

Merge pull request #1929 from zhanggbj/fix-weekly-security-scan kubernetes/cloud-provider-vsphere

by kubernetes-prow[bot]

The Go 1.26.0 bump merged cleanly through the weekly security scan fix. No separate release note shipped alongside it, so check the tags before assuming a published cloud-provider-vsphere build carries the CVE fixes.

Merge pull request #4615 from kubernetes/dependabot/go_modules/go.yaml.in/yaml/v4-4.0.0-rc.9 kubernetes/release

by kubernetes-prow[bot]

kubernetes/release moved go.yaml.in/yaml/v4 from 4.0.0-rc.7 to 4.0.0-rc.9, still on the release-candidate line. Build tooling only; nothing user-facing.

Merge pull request #4614 from kubernetes/dependabot/github_actions/actions-26f0b512f4 kubernetes/release

by kubernetes-prow[bot]

The rest of the day's kubernetes/release activity was a Dependabot bump of the actions group with 4 updates. Routine maintenance with no migration attached.

Action items

$ ls kubernetes/reviews/ # the step-back reads

the week in review Kubernetes release v0.23.0 adds trixie kube-cross variant the month in review node-problem-detector 1.37.0 patches three CVEs
Full archive โ†’ Weekly reviews โ†’

Quick answers

What shipped in Kubernetes on November 6, 2026?
Kubernetes' externaljwt module picked up ML-DSA signing for service account tokens, while cloud-provider-vsphere cleared a batch of CVEs with a Go toolchain bump and the release tooling stayed on routine dependency churn. In total, 4 commits and 3 pull requests landed.
Who contributed to Kubernetes on November 6, 2026?
3 developers shipped this update, including kubernetes-prow[bot], zhanggbj, and Kubernetes Publisher.
What were the notable Kubernetes updates?
Merge pull request #142397 from everettraven/upstream/mldsa/sa-token-gen, ๐ŸŒฑ Fix CVEs by bump golang to 1.26.0, and Merge pull request #1929 from zhanggbj/fix-weekly-security-scan.
โ™ฅ

$ log @kubernetes --recent

Control plane cleanups: watchcache context prep, RecursiveReadOnlyMounts gate removed 90 shipped Consistent get backed out when etcd transforms are on 121 shipped Admission webhook metrics go beta; watch cache gets a minheap freshness waiter 103 shipped PodGroupPreemptionPolicy gate removed, ResourceQuota retry admits denied requests 34 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.