Cluster API v1.14.4
security~~~~~~~~~~*****!!
Cluster API v1.14.4 was released with 27 changes, including two security-related items: a Go bump to 1.26.9 with dependency updates, and a fix to a typo in the trivy DB mirror. Other changes include dependency bumps to several golang.org/x packages and coredns corefile-migration, and fixes to cluster labeling when a BeforeClusterCreate hook blocks, ControlPlaneInitialized reason handling, clusterctl listing of kinds ending in List, KCP in-place updates when coredns and kube-proxy phases are skipped, and kubelet version checks. The release also rejects file-based credentials in kubeconfigs for ClusterCache and pins the kind binary version in e2e tests.
What changes for platform teams
Platform teams running Cluster API should review the change rejecting file-based kubeconfig credentials in ClusterCache, since configurations relying on them will no longer work. The security content is dependency and toolchain bumps plus a mirror typo fix, so no vulnerability in the tool's own code is described.
Changes
- Bump go to 1.26.9 and dependencies for securitysecurity
- Fix typo in trivy DB mirrorsecurity
- Github.com/coredns/corefile-migration: v1.0.35 → v1.0.36changed
- Golang.org/x/crypto: v0.56.0 → v0.57.0changed
- Golang.org/x/mod: v0.38.0 → v0.41.0changed
- Golang.org/x/net: v0.58.0 → v0.60.0changed
- Golang.org/x/sync: v0.22.0 → v0.23.0changed
- Golang.org/x/sys: v0.47.0 → v0.48.0changed
- Golang.org/x/telemetry: 49f421f → a038080changed
- Golang.org/x/term: v0.45.0 → v0.46.0changed
- Golang.org/x/text: v0.41.0 → v0.42.0changed
- Golang.org/x/tools: v0.48.0 → v0.49.0changed
11 more lines
- Cluster: Also set cluster-name label even if BeforeClusterCreate hook is blockingfixed
- Cluster: Fix ControlPlaneInitialized reason when the control plane does not existfixed
- Clusterctl: Fix clusterctl listing of resources whose kind ends in Listfixed
- KCP: Support KCP in-place updates when coredns and kube-proxy phases are skippedfixed
- Machine: Stop checking kubelet version against an empty versionfixed
- Management Cluster: v1.33.x -> v1.37.xother
- Workload Cluster: v1.31.x -> v1.37.xother
- 13 new commits mergedother
- 5 bugs fixed 🐛other
- ClusterCache: Reject file-based credentials in kubeconfigsother
- E2e: Pin kind binary version and download exact versionother
4 maintenance lines (dependency bumps, CI, tests, docs)
- Fallback to alternate locations for Trivy DBmaintenance
- Clusterctl: Bump cert-manager to v1.21.3maintenance
- Dependency: Bump corefile-migration to v1.0.36maintenance
- Dependency: Bump go to 1.26.10maintenance
Full release notes ↗ · all Cluster API releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules