$ cat kubernetes/week/2026-11-02.log
the week in review · Nov 2 – Nov 8, 2026
Kubernetes release v0.23.0 adds trixie kube-cross variant
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
client-go bumps golang.org/x/net to 0.62.0 for two CVEs, and the registry client no longer fetches foreign bundle layers.
Merge pull request #143642 from yue9944882/bump-golang-net-cve kubernetes/client-go
golang.org/x/net moves to 0.62.0 to close CVE-2026-78661 and CVE-2026-97045, so anything vendoring client-go picks up the fix on its next dependency bump rather than through a Kubernetes upgrade.
v0.23.0 kubernetes/release
The release tooling gains a trixie kube-cross variant, moves distroless-iptables onto Go 1.27.3/1.26.10, and lets krel stage binaries. Release engineering only, but it is the machinery behind every published artifact.
Skip foreign bundle layer URLs and check their digest kubernetes/release
A sigstore bundle layer carrying urls previously made the registry client fetch the blob from those hosts when the registry did not have it; it now skips those foreign URLs and checks their digest instead. This closes a fetch path outside the registry.
fix(service): reconcile when the autoscaler taint is added or removed kubernetes/cloud-provider-alibaba-cloud
A taint-only Node update never enqueued a Service, so nodes with ToBeDeletedByClusterAutoscaler kept sitting in load balancer backends. The provider now reconciles on taint changes; a companion fix skips update tasks for Services being deleted.
Merge pull request #141905 from Okabe-Junya/Okabe-Junya/fix/resourcequota-admission-retry-deny kubernetes/apiserver
After a conflict retry, ResourceQuota admission could admit a request it had already denied. If you run quota checks in the admission path, this is the one behavioral fix of the week worth confirming in your target version.
Merge pull request #142511 from saschagrunert/api-security-profile-oci kubernetes/client-go
The OCI seccomp profile type lands behind the SecurityProfileOCI feature gate. Gate it on and your pod specs can reference a profile stored in an image, which is a spec-surface change to plan around.
Watchcache simplify bookmarks kubernetes/kubernetes
The watch cache bookmark path sheds code on the assumption that setting resourceVersion on a bookmark event never fails. Reviewers are asked to read it commit by commit, since the assumption now carries more weight than before.
Merge pull request #143290 from michaelasp/workqueue-pause kubernetes/client-go
Alongside: the workqueue gains a Pausable interface to pause and resume item retrieval, client-go adds support for a pool of connections, kueue's main and release-0.20 Prow jobs move to Go 1.27, and the website picks up Ukrainian translations of the multi-tenancy and ephemeral storage pages.
$ ls kubernetes/week/ # the briefings behind this review
Keep up with Kubernetes in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.