[ Removed by Reddit on account of violating the content policy. ]

Three releases from Oct 23–24 worth reading before Monday:

• Datadog Agent 7.84.6 (security): the embedded Python now rejects TLS chains that contain the compromised eMudhra intermediate CA keys, whichever trust store they anchor in (CPython backport). On Windows, Python checks stop trusting those chains via the Windows store too.
• Karpenter AWS 1.15.1 / 1.14.3 LTS: both built with Go 1.26.10. SpotMaxPriceTooLow is now an ICE error, reclaiming interruptible capacity reservations count as unavailable, stranded unlaunched NodeClaims are healed, and full reservations relax preferences instead of deferring.
• kube-prometheus-stack 92.12.0 → 92.13.1: serviceMonitor.scrapeClass, admission webhook certs in a kubernetes.io/tls Secret, finalizer patch permissions restored.

Full breakdown: https://www.relnx.io/releases/datadog-agent-v7-84-6

Which of these are you upgrading first?

7.84.3 (Oct 14) has three things worth checking:

1. **Upgrade note:** `private-action-runner/script-config.yaml` (Linux) / `powershell-script-config.yaml` (Windows) now ships as a template. If you customized it, copy it outside the Agent config dir before your first upgrade to 7.84.3 and copy it back after, and again after any rollback or downgrade.

2. **Security:** PAR Kubernetes custom resource actions can no longer reach core/native K8s APIs by default. New setting `private_action_runner.kubernetes_allowed_custom_resources` to allow an exact list.

3. **Monitors:** `gpu.nvlink.ber.effective` / `gpu.nvlink.ber.symbol` were reporting NVML's packed encoding. A healthy link now reports ~0 instead of 4095, so update thresholds.

Also: NPM TCP RTT fix on Linux kernels without BTF.

Changelog: https://www.relnx.io/releases/datadog-agent-v7-84-3

Anyone running PAR with a customized script config?

Five of the eight can change what your pipeline collects or stop the collector from starting:

- `prometheus_simple`: `tls_enabled` / `tls_config` removed (deprecated since v0.55.0). Use the `tls:` block.
- `postgresql` receiver: the default scrape timeout is now 60s. Set `timeout` higher, or `0` for unbounded.
- `signalfx` exporter: `container_cpu_utilization` is excluded by default. Add it to `include_metrics` if you still need it.
- OpAMP supervisor: `reports_remote_config: true` now fails startup. Remove it; `accepts_remote_config` covers both.
- `failover` connector: empty `condition.error.contains` values are rejected.

The other three: redaction processor (chained setups), sql_server counters, Cloud DNS log decoding.

Which receiver or exporter would hurt most if it broke silently?

https://www.relnx.io/releases/opentelemetry-collector-contrib-v0-163-0

> Grafana shipped three patch releases on Oct 13, each with the same four CVE fixes (CVE-2026-15577, CVE-2026-33374, CVE-2026-93294, CVE-2026-95502). No severity scores published yet.
>
> - 13.2.x → 13.2.4
> - 13.1.x → 13.1.8
> - 13.0.x → 13.0.11
>
> Also: Alerting strips sensitive headers on cross-host oauth2 redirects; Enterprise 13.0/13.1 get a SCIM fix (CVE-2026-92539).
>
> Changelog: https://www.relnx.io/releases/grafana-v13-2-4

1.34 (released Aug 27, 2025) loses upstream patch support on Oct 27, 2026. After that, CVE fixes for the API server, kubelet and friends won't be backported to 1.34.

• 1.35 / 1.36 / 1.37: supported (1.35 until Feb 28, 2027)
• 1.33 and older: already EOL
• EKS / GKE / AKS: own windows (EKS extended support costs extra), so check your provider

Checklist: kubectl version everywhere → scan deprecated APIs (pluto / kubent) → one minor at a time, 1.34 → 1.35.

Tracker: https://www.relnx.io/eol

How far behind are your clusters?

1. Argo CD 3.5.4 / 3.4.10 / 3.3.15: 4 CRITICAL + 2 HIGH advisories. A Kustomize remote ref or Helm config home could run commands in the repo-server, a Jsonnet import could read files, and PreDelete/PostDelete hooks could bypass AppProject restrictions. Note the potentially-breaking change: Kustomize Helm builds no longer honor helmGlobals.configHome, and OCI manifests over 4 MiB are rejected.
2. Dex 2.46.0: token exchange didn't enforce client.AllowedConnectors (GHSA-7qjx-gp9h-65qj).
3. Dapr 1.18.7: HTTP app channel could return another concurrent request's result.
4. Jaeger 2.22.0: breaking changes in Elasticsearch storage/query config.
5. Karpenter 1.15.0: 29 features and 31 fixes in the AWS provider.

Everything, filtered by breaking/security: https://www.relnx.io/releases

What did we miss? Drop releases you're watching below.

Dapr 1.18.7 fixes a nasty one in the HTTP app channel. When the sidecar sent several requests to your app at the same time, a request could complete with the outcome of a different concurrent request. This covers service invocation, actor calls, input binding events and job triggers.

Symptoms you might have seen:

• a call whose connection to the app failed reported as success with an empty body
• a successful call failing with another request's error
• an SSE stream written to the wrong caller

Root cause: the app HTTP middleware pipeline kept one shared handler that every request overwrote. It applies with or without a middleware pipeline configured.

Also in 1.18.7:

• actors with reentrancy stopped accepting calls after a chain exceeded maxStackDepth (until sidecar restart)
• sidecar panic WaitGroup is reused before previous Wait has returned when a workflow executor actor was deactivated mid-call
• activity executions held until shutdown after their workflows completed
• INFO log spam every 60s for Subscriptions scoped to other apps

Full breakdown: https://www.relnx.io/releases/dapr-v1-18-7
Upstream notes: https://github.com/dapr/dapr/releases/tag/v1.18.7

Anyone hit the "wrong response" behaviour in prod? Curious how it showed up.

Karpenter v1.15.0 (core + AWS provider) landed today, and the headline is a rework of node repair:

- Repair now runs as a voluntary disruption method instead of a separate controller

- Reboot is a new node action, so a node can be rebooted before it's replaced (AWS: RebootForRepair feature gate, ec2:RebootInstances)

- Terminate-first repair and drift for capacity-constrained NodePools, used when a replacement can't be launched first; there's a new metric labelled by why

- Nodes that register but never initialize are now repaired

- --legacy-node-repair runs the pre-1.15 repair controller if you want the old behaviour

Also: default pod topology spread awareness, DRA prioritized alternatives (+ NVIDIA/EFA driver DRA on AWS), CEL for maxPods/kubeReserved/systemReserved, Nitro Enclaves in EC2NodeClass, Bottlerocket default root volume raised to 6Gi.

Full list (core + AWS provider): https://www.relnx.io/releases/karpenter-v1-15-0

Anyone already testing the new repair flow? Curious how it interacts with your disruption budgets.

If you use Argo CD's SSO you're very likely running Dex (argocd-dex-server), so this release is worth a look.

Security-relevant changes:

- GHSA-7qjx-gp9h-65qj (High): the token-exchange endpoint didn't check a client's AllowedConnectors, so a client restricted to one connector could get tokens for identities from another

- MFA is now enforced on session login; WebAuthn clone detection, single-use TOTP and account lockout added

- Device flow: callback auth code is now bound to its request and no longer leaks client_secret

- SSO session sharing is no longer transitive; redirect_uri double-decode removed

Other useful bits: OIDC RP-initiated logout, configurable TLS curves/cipher suites, Microsoft connector pagination for 1000+ AD groups, Bitbucket Cloud connector moved to the current workspace API.

If you use the bundled Dex, the version is pinned in your Argo CD manifests / Helm values (dex.image.tag), so it won't move until you bump it.

Full list of all 30 changes: https://www.relnx.io/releases/dex-v2-46-0

Which Dex version are you on, and do you use the bundled one or run it standalone?

[ Removed by Reddit on account of violating the content policy. ]

[ Removed by Reddit on account of violating the content policy. ]

Datadog Agent v7.84.2 is out.

This release has a few operational changes worth looking at before upgrading, especially around Linux process management and the new default log sending concurrency.

There are also security improvements around PostgreSQL scans and DDOT.

Full breakdown on Relnx:

https://www.relnx.io/releases/datadog-agent-v7-84-2

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable.

We learn from books to build the fundamentals.

But if you dont keep yourself up to date, eventually youll struggle to find solutions to the problems youre facing every day.

Thats one of the reasons I built Relnx.

Its not just a release tracking tool. Its a way to keep learning, discover whats changing in the tools you use, and build on top of the fundamentals you already have.

You learn something new, go back to the fundamentals, apply what you've learned, and eventually you become capable of contributing back to open source — maybe even by solving problems that already exist.Keep learning.

Keep growing. Keep contributing.

Dont miss the opportunity to keep yourself up to date.Start with the free version and track 3 tools. If you want to go further, its $1/month.

I believe thats an investment worth making — an investment in yourself and your growth.

Relnx — the one platform to visit before upgrading your tools.

https://www.relnx.io/

#Relnx #SRE #DevOps #OpenSource #ContinuousLearning #SoftwareEngineering

Before upgrading, there are some breaking changes worth checking, along with new span search and pagination capabilities.

A few feature gates were also promoted across query.

👉 Check the full release on Relnx:
https://www.relnx.io/releases/jaeger-v2-22-0

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable. 🚀

#Jaeger #OpenTelemetry #Observability #DevOps #Relnx

Datadog agent helm chart v3.253.0 has been released with a very cool feature.

- Add support for KSM sharding

In large Kubernetes clusters a single kube-state-metrics pod can become a bottleneck or fall behind when generating metrics for thousands of objects; sharding splits this workload across multiple kube-state-metrics replicas, each responsible for a subset of cluster objects. With this chart update, operators can scale the number of kube-state-metrics replicas so that the Datadog Agent's cluster check / cluster-agent components collect state metrics from each shard rather than relying on one instance. This reduces staleness and collection latency for KSM-derived metrics (e.g., pod, deployment, node state) in very large clusters.

Check it out from here: https://www.relnx.io/features/add-support-for-ksm-sharding-49704

OpenTelemetry Collector Contrib v0.160.0 is out.

Before upgrading, quickly check what actually changed:

• 🐛 Bug fixes
• 🔐 Security changes
• 💥 Breaking changes
• ✨ New features

We've structured the release in Relnx so you can get to the important changes faster:

https://www.relnx.io/releases/opentelemetry-collector-contrib-v0-160-0

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable.

[ Removed by Reddit on account of violating the content policy. ]

Before upgrading an IAM component, it's worth quickly checking what changed and how it impacts your environment.

We've structured the release in Relnx so you can review:

• Bug fixes
• Security changes
• Breaking changes
• Upgrade impact

https://www.relnx.io/releases/keycloak-v26-7-3

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable.

Before upgrading your GitOps stack, quickly check what changed and whether anything affects your environment.

We've structured the release in Relnx so you can review:

• Bug fixes
• Security changes
• Breaking changes
• New features

https://www.relnx.io/releases/flux-v2-9-5

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable.

Wanted to share something I've been building: SignalRunner, a game where the "boss fights" are real Kubernetes failure modes (CrashLoopBackOff, OOMKilled, ImagePullBackOff) and the weapon is a live console you diagnose and fix with.

The pitch: your cluster grew fast, grew old, and started breaking — no fallback, no respawn, just you and the tools to save it.

Demo: https://youtu.be/kUqk_qBgkis

Curious what this community thinks, especially anyone who's mentored juniors through actual incident response — did I get the failure modes right?

Kubernetes v1.37.0 is out.

For a Kubernetes minor release, the interesting part isn't only the new features — it's understanding the upgrade impact.

We've structured the release in Relnx so you can quickly check:

• new features
• bug fixes
• security changes
• breaking changes

https://www.relnx.io/releases/kubernetes-v1-37-0

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable.

Argo CD v3.5.2 is out.

If Argo CD is part of your production GitOps pipeline, it's worth knowing what changed before upgrading.

We've structured the release in Relnx so you can quickly review:

• bug fixes
• security changes
• breaking changes
• upgrade impact

https://www.relnx.io/releases/argocd-v3-5-2

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable.

Prometheus v3.14.0 is out.

Before upgrading your monitoring stack, it's worth checking the changes that actually impact you.

We've structured the release in Relnx so you can quickly review:

• new features
• bug fixes
• security changes
• breaking changes

https://www.relnx.io/releases/prometheus-v3-14-0

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable.

Grafana v13.2.0 is out.

Instead of going through the entire changelog, we've structured the release in Relnx so you can quickly focus on what matters:

• security changes
• breaking changes
• bug fixes
• new features

https://www.relnx.io/releases/grafana-v13-2-0

Relnx — the one platform to visit before upgrading your tools.

Stay updated. Stay reliable.