Skip to content

chore(deps): update module kubevirt.io/kubevirt to v1.9.0 [security] (v1.9) - #311

Open
renovate[bot] wants to merge 1 commit into
v1.9from
renovate/v1.9-go-kubevirt.io-kubevirt-vulnerability
Open

chore(deps): update module kubevirt.io/kubevirt to v1.9.0 [security] (v1.9)#311
renovate[bot] wants to merge 1 commit into
v1.9from
renovate/v1.9-go-kubevirt.io-kubevirt-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
kubevirt.io/kubevirt v1.7.0 → v1.9.0 age confidence

KubeVirt Guest Agent DoS via Excessive Network Interface Reports

CVE-2025-14525 / GHSA-25mh-hp8x-cgrv / GO-2026-4384

More information

Details

A flaw was found in KubeVirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive number of network interfaces. This action can overwhelm the system's ability to store VM configuration updates, effectively blocking changes to the Virtual Machine Instance (VMI). This allows the VM user to restrict the VM administrator's ability to manage the VM, leading to a Denial of Dervice for administrative operations.

Severity

  • CVSS Score: 6.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

KubeVirt has a Link Following vulnerability

CVE-2026-7374 / GHSA-7jcp-v9w4-wjmg / GO-2026-5848

More information

Details

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host's container runtime (CRI-O) socket, an attacker can hijack virt-handler's privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.

Severity

  • CVSS Score: 9.9 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

KubeVirt has a Link Following vulnerability in kubevirt.io/kubevirt

CVE-2026-7374 / GHSA-7jcp-v9w4-wjmg / GO-2026-5848

More information

Details

KubeVirt has a Link Following vulnerability in kubevirt.io/kubevirt

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

KubeVirt's authorization mechanism improperly truncates subresource names

CVE-2026-6383 / GHSA-j6cv-3w8p-vrg8 / GO-2026-5450

More information

Details

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

KubeVirt has a Link Following issue

CVE-2026-9804 / GHSA-mpmf-3w4r-qfpf / GO-2026-5883

More information

Details

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

Severity

  • CVSS Score: 7.7 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

kubevirt/kubevirt (kubevirt.io/kubevirt)

v1.9.0

Compare Source

tag v1.9.0
Tagger: Luboslav Pivarc lpivarc@redhat.com

This release follows v1.8.4 and consists of 1653 changes, contributed by 108 people, leading to 2195 files changed, 209726 insertions(+), 38785 deletions(-).
v1.9.0 is a promotion of release candidate v1.9.0-rc.2 which was originally published 2026-07-28
The source code and selected binaries are available for download at: https://github.com/kubevirt/kubevirt/releases/tag/v1.9.0.

The primary release artifact of KubeVirt is the git tree. The release tag is
signed and can be verified using git tag -v v1.9.0.

Pre-built containers are published on Quay and can be viewed at: https://quay.io/kubevirt/.

Notable changes

  • [PR #​18567][kubevirt-bot] Bug fix: Expose VFIO cdev devices (/dev/vfio/devices/vfioN) to virt-launcher containers, fixing IOMMUFD-based GPU passthrough on ARM64 systems with SMMUv3.
  • [PR #​18532][kubevirt-bot] virt-launcher pods get cleaned up along with migration objects
  • [PR #​18539][kubevirt-bot] BugFix: hotplug volume detach deadlock when VMIs exchange RWO PVCs between attachment pods.
  • [PR #​18507][kubevirt-bot] Fixed missing validation for network interface bindings: interfaces with no binding or multiple bindings are now rejected at admission instead of failing silently at runtime.
  • [PR #​18466][kubevirt-bot] Network binding plugin sidecars can now infer their registration name using the NETWORK_BINDING_PLUGIN_NAME environment variable.
  • [PR #​18438][iholder101] Bug fix: VMs with NFS-backed storage are no longer incorrectly restarted during temporary NFS unavailability (e.g., NFS server failover).
  • [PR #​18446][kubevirt-bot] vep-10: move GPUsWithDRA and HostDevicesWithDRA to beta
  • [PR #​18445][kubevirt-bot] Add E2E tests support for DRA feature.
  • [PR #​18433][kubevirt-bot] Network conformance tests can now be run with a custom network binding plugin via the --primary-network-binding-plugin test flag.
  • [PR #​18412][kubevirt-bot] Set explicit SMMUv3 address capability defaults for Grace I/O Virtualization.
  • [PR #​18404][kubevirt-bot] The kubevirt_vmi_guest_os_panic_total metric is now emitted
  • [PR #​18405][kubevirt-bot] BugFix: Importer pod rejected by ValidatingAdmissionPolicy 'kubevirt-plugin-sidecar-subpath-policy'
  • [PR #​18331][kubevirt-bot] Live migration data stream can be compressed now by using .spec.experimental.compression field in MigrationPolicy applied to a set of VMs. Currently only "zstd" algorithm is supported.
  • [PR #​18356][kubevirt-bot] Support inferFromVolume for VolumeSnapshot-backed DataVolumes, DataVolumeTemplates, and DataSources
  • [PR #​18343][kubevirt-bot] Bug fix: PreferredPanicDeviceModel now creates a panic device when none exist on the VMI, instead of silently ignoring the preference.
  • [PR #​18299][lyarwood] Bug fix: Increase IOMMUFD socket accept timeout from 60 seconds to 15 minutes to prevent silent fallback to legacy VFIO on environments with slow container image pulls.
  • [PR #​18095][fra2404] Add PortRanges support for masquerade interfaces (Alpha, guarded by PortRangesSpec feature gate)
  • [PR #​18011][fanzhangio] When the alpha GraceIOVirtualization feature gate is enabled, KubeVirt now configures NVIDIA Grace GPU passthrough with SMMUv3/IOMMUFD, ACPI Generic Initiator NUMA topology, NUMA distance mapping, and automatic PCI 64-bit hole sizing.
  • [PR #​18048][alancaldelas] WorkloadEncryptionSEV graduated from Alpha -> Beta
  • [PR #​18216][awels] BugFix: Fixes bug in cancelling of decentralized live migration not removing finalizer from migration resource
  • [PR #​18004][avlitman] Add VMNonRecoverableOSPanic alert
  • [PR #​18065][0xFelix] The Template feature gate has been graduated to Beta and is now enabled by default. Virt-template components are deployed automatically unless explicitly disabled.
  • [PR #​18116][brianmcarey] Build KubeVirt with go 1.26.4
  • [PR #​18161][machadovilaca] Add kubevirt_vmi_gpu_info metric to correlate GPU UUIDs with VMIs
  • [PR #​17837][keinsword] Nebius is listed as an adopter of KubeVirt since 2023.
  • [PR #​17846][ksimon1] virt-api: add X-Content-Type-Options: nosniff security header
  • [PR #​18101][dsanatar] Remove ephemeral hotplug volume metric and alert
  • [PR #​18082][alromeros] Expose FS freeze status early in VirtualMachineBackup
  • [PR #​18252][kubevirt-bot] Updated virt-template to v0.2.2
  • [PR #​18198][orenc1] VEP-160: Graduate OptOutRoleAggregation feature gate to Beta
  • [PR #​18112][xpivarc] SRIOV vGPU now supports display
  • [PR #​17199][lyarwood] Add CrossArchitectureVirtualization Alpha feature gate enabling cross-architecture VM execution. When enabled, VMs can run on nodes with a different architecture (e.g. ARM64 guest on AMD64 host) via QEMU TCG software emulation. The scheduler prefers native-arch nodes and falls back to cross-arch emulation when unavailable. The feature gate is designed to accommodate future hardware-accelerated backends (e.g. SAE) under the same gate.
  • [PR #​18102][iholder101] Plugin sidecars can now mutate the libvirt domain XML via gRPC domain hooks, enabling arbitrary domain customization through sidecar containers injected alongside virt-launcher pods.
  • [PR #​18103][orelmisan] Fix infinite migration target pod loop caused by stale VMI MigrationState when the target pod fails after preparation.
  • [PR #​18141][machadovilaca] Skip PrometheusRule generation when VMStatsCollector is enabled
  • [PR #​17818][fossedihelm] MigrationPriorityQueue feature gate has been promoted to GA.
  • [PR #​18228][kubevirt-bot] Updated common-instancetypes bundles to v1.7.0
  • [PR #​17540][orenc1] Add RBAC role aggregation upgrade e2e test
  • [PR #​18220][0xFelix] Updated virt-template to v0.2.1
  • [PR #​17770][jschintag] IBM Secure Execution is now generally available
  • [PR #​18188][machadovilaca] Add VMStatsHandler with HTTP endpoint for VM stats collection
  • [PR #​18032][0xFelix] Add VirtualMachineTemplate as a source kind for OCI export via VMExport.
  • [PR #​18001][iholder101] Add node lifecycle hooks for the plugin framework, enabling plugins to run callbacks at VM start/stop and migration phases (alpha, behind Plugins feature gate).
  • [PR #​17998][fanzhangio] VMIs requesting NVIDIA Grace GPU PCI passthrough resources are now validated by admission. Such VMIs require the GraceIOVirtualization, PCINUMAAwareTopology, and IOMMUFD feature gates, arm64 architecture, the virt machine type, and dedicated CPU placement; ambiguous NVIDIA wildcard PCI selectors are rejected when GraceIOVirtualization is enabled.
  • [PR #​17886][fanzhangio] PCI NUMA-aware placement (PCINUMAAwareTopology) now fails with an error for VMIs using numa.guestMappingPassthrough when a host device cannot be placed on a NUMA-aligned PCIe topology. Non-passthrough VMIs retain the existing fallback behavior.
  • [PR #​17544][Aseeef] Adds a robust migration stall detection mechanism that triggers post-copy or stop-and-copy opportunistically at local minimas reducing both total migration duration and downtime.
  • [PR #​18105][keinsword] BugFix: fixed hotplug mount resolution when multiple attachment pods exist for volumes from the same underlying device, and prevented virt-handler from reusing one hotplug volume's source pod UID for later volumes in the same sync loop.
  • [PR #​17664][ksimon1] feat: Add annotation-based GuestAgentPing probe pausing
  • [PR #​18129][iholder101] Fixed missing RBAC rules for plugin.kubevirt.io in the kubevirt.io:view ClusterRole, restoring cluster-reader access to Plugin resources.
  • [PR #​17910][jcanocan] virtctl: updated virt-template subcomands to v1beta1
  • [PR #​18143][akalenyu] BugFix: Storage Live Migration Filesystem-to-Block fails with libvirt error Code 84 pre-creation of storage target for incremental storage migration of disk is not supported
  • [PR #​18090][Acedus] VirtualMachineBackups now consist of only 3 conditions: Progressing, Complete, and Failed, with matching reasons to replace the now removed Initializing, ExportInitiated, ExportReady, Aborting and Done.
  • [PR #​17861][mhenriks] VEP 250: Add serviceAccountName to VirtualMachineInstance Spec
  • [PR #​17960][dsanatar] Fix the virtctl image-upload command token expiry issue by refreshing the token.
  • [PR #​17976][ethan-gallant] virt-operator: customizeComponents.Patches now apply to the install-strategy job (match it with resourceType "Job" and resourceName "virt-operator-install-strategy"). The job's generated name changed from "kubevirt--job" to "virt-operator-install-strategy-".
  • [PR #​17505][alromeros] Enable live migration for VMs with SCSI persistent reservations
  • [PR #​17956][fossedihelm] Add IOMMUFD device plugin to virt-handler behind the IOMMUFD Alpha feature gate. When enabled, virt-controller requests devices.kubevirt.io/iommufd for every launcher pod. Nodes without /dev/iommu (kernel <6.2) will report unhealthy devices, making pods unschedulable there. This feature also emits domain-level and uses virDomainFDAssociate, which require a libvirt/QEMU stack that supports fdgroup-based IOMMUFD, currently libvirt >= 12.2. Enable this gate only on clusters where target nodes and virt-launcher images provide compatible kernel, libvirt, and QEMU support.
  • [PR #​17993][Acedus] BugFix: Live migration with CBT and RWO backend storage now correctly retains checkpoints post-migration
  • [PR #​17623][MarSik] The RebootPolicy feature was graduated to Beta status.
  • [PR #​17422][jean-edouard] Libvirt bumped to v11.10
  • [PR #​17891][vladikr] Add foundation types for Grace IO Virtualization: GraceIOVirtualization feature gate, IOMMU domain XML schema, HostDevice IOMMU/ACPI extensions, and NUMACell pointer change for zero-memory cells.
  • [PR #​17897][iholder101] Added CEL-based domain hook evaluation for the structured plugin system (alpha, behind Plugins feature gate).
  • [PR #​17551][jschintag] Allow configuring launch security via preference.
  • [PR #​17923][alaypatel07] vep-10: add dra packages to lint configuration and fix linter errors
  • [PR #​16990][lyarwood] Migrated port-forwarding and remote exec from hardcoded SPDY to WebSocket-primary with SPDY fallback, fixing intermittent stream creation failures against Kubernetes 1.31+ clusters where the PortForwardWebsockets feature gate is enabled.
  • [PR #​18076][jcanocan] Updated virt-template to v0.2.0
  • [PR #​18052][vidit-bhat] Fixed a build failure in pkg/hypervisor on GOOS/GOARCH combinations outside linux/{amd64,arm64,s390x}, which previously prevented downstream packagers from cross-building virtctl on architectures such as riscv64, ppc64le, and 386. On those architectures, common.SchedSetScheduler now returns the new sentinel error common.ErrUnsupportedRTScheduling.
  • [PR #​17996][ksimon1] virt-operator: fix DeploymentInProgress after toggling optional feature gates
  • [PR #​17984][Acedus] Incremental backups now distinguish discarded blocks from data changes by merging base:allocation and qemu:dirty-bitmap contexts, reducing transfer size by skipping dirty extents that read as zero.
  • [PR #​17845][orelmisan] Network binding plugins can now read the interface MTU from the network-info downward API annotation.
  • [PR #​17809][michalskrivanek] cgroup v1 support is deprecated now, with removal planned for the next release
  • [PR #​17797][alaypatel07] vep-10: migrate away from k8sv1.PodResourceClaim to kubevirts own type
  • [PR #​17790][iholder101] Introduce the Plugin CRD (plugin.kubevirt.io/v1alpha1) behind the Plugins feature gate (Alpha), enabling declarative VM extension via domain hooks, node hooks, and admission references (VEP-190).
  • [PR #​17947][Barakmor1] Use --expand-cpu-features and --supported-cpu-features in node-labeller for
  • [PR #​17944][0xFelix] Add OCI artifact export support behind the OCIExport feature gate. Use virtctl vmexport download --format=oci to export a VM as an OCI image layout TAR.
  • [PR #​17989][UdayYendva] Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).
  • [PR #​16599][dasionov] Promote VideoConfig FG to General Availability
  • [PR #​17661][oshoval] Add alpha support for DRA SR-IOV networks via spec.networks[].resourceClaim behind NetworkDevicesWithDRA, with webhook validation and virt-launcher hostdev generation from DRA metadata.
  • [PR #​16932][dsanatar] Graduate HotplugVolumes and DeclarativeHotplugVolumes to Beta
  • [PR #​17883][yaroslavborbat] Fixed a target-side hotplug mount leak that could remain after failed or canceled live migration.
  • [PR #​17836][iholder101] Add kubevirt_vmi_guest_os_panic_total Prometheus counter metric to track guest OS panic events per VMI, with labels for panic type and hyper-v bugcheck code
  • [PR #​17959][mhenriks] Fix symlink traversal in VMExport dir handler
  • [PR #​16674][akalenyu] Persistent Reservation GA
  • [PR #​17550][machadovilaca] Add GetVMStats unified gRPC RPC for monitoring data collection
  • [PR #​17757][Acedus] Fix: Handle disks with qcow2 overlay in migration related code
  • [PR #​17825][akalenyu] BugFix: endless cycle of attachment pod deletion/creation
  • [PR #​17699][dsanatar] only populate vmexport with a vm manifest if source is not pvc
  • [PR #​17798][SamAlber] Fixed a gRPC connection leak in virt-handler's GetLauncherClient that caused unbounded memory growth, socket accumulation, and goroutine leaks when multiple controllers raced to create connections for the same VMI.
  • [PR #​17644][kubevirt-bot] Updated virt-template to v0.1.8
  • [PR #​17272][ksimon1] Feat: Record K8s event on VMI when GuestAgentPing probe fails
  • [PR #​17536][nirdothan] Fixed VMI status reporting the pod's IPv6 address instead of the guest's when using bridge binding on a network with IPv6 IPAM.
  • [PR #​17405][iholder101] Enable all Beta feature gates by default. Users can opt out of individual Beta features by adding them to spec.configuration.developerConfiguration.disabledFeatureGates in the KubeVirt CR. A feature gate report with all non-GA feature gates will be added to each release's artifacts.
  • [PR #​17805][lyarwood] Fixed multi-device VFIO passthrough VMs failing to start with "cannot limit locked memory" by scaling virt-handler's memlock rlimit to account for per-device memory locking, matching libvirt's calculation introduced in v8.7.0.
  • [PR #​17496][fanzhangio] The --additional-launcher-annotations-sync and --additional-launcher-labels-sync flags now support prefix wildcards via a trailing '' suffix (e.g. 'vendor.io/'), allowing all matching labels/annotations to be propagated from VM template to VMI and virt-launcher pod without enumerating each key individually.
  • [PR #​17029][mhenriks] Fix PCI address stability across upgrades with v3 hotplug port topology
  • [PR #​17475][samt-ai] Fix race condition in VM force restart where the pod could remain stuck in Terminating state for the full terminationGracePeriodSeconds instead of terminating promptly. The VMI's terminationGracePeriodSeconds is now patched before triggering the restart, ensuring the short grace period is always honored.
  • [PR #​17031][suPer8Hu] N/A
  • [PR #​17548][Barakmor1] Add container-level SecurityContext to virt-exportproxy and virt-synchronization-controller deployments
  • [PR #​17755][dasionov] fix: cross-namespace live migration now works on IPv6 clusters
  • [PR #​17490][oshoval] Fixed virt-controller DRA claim rendering for GPU/HostDevice resources by preserving per-device claim/request tuples (including shared claim names with different requests).
  • [PR #​17527][mhenriks] Fix VM with PCI hostdev failing to restart after hotplug block volume
  • [PR #​17573][lyarwood] Bug fix: virt-operator error messages no longer dump entire resource structs via %+v, preventing the KubeVirt CR from exceeding the etcd 3MB object size limit when resource creation fails
  • [PR #​17691][vishnuchalla] NA
  • [PR #​17049][frenzyfriday] Graduates LiveUpdateNADRef feature gate
  • [PR #​16697][dippydocus] Fixed DHCP failure after live migration followed by guest reboot when using bridge binding without a specified MAC address.
  • [PR #​17599][Sreeja1725] Add release 1.8 perf-scale benchmarks data
  • [PR #​17576][ema-aka-young] Bugfix: Added enum validation for the targetReadinessPolicy field for restore resources.
  • [PR #​17571][0xFelix] Fixed virt-api truncating deep subresources (vnc/screenshot, sev/*, evacuate/cancel) when constructing SubjectAccessReviews, causing authorization checks against incorrect subresource names.
  • [PR #​17015][Ronilerr] Adding missing metrics, recording rules and alerts for virt components
  • [PR #​17130][sradco] Fix VirtualMachineStuckOnNode and VMCannotBeEvicted alerts failing during live migration due to duplicate kubevirt_vmi_info series
  • [PR #​17488][alaypatel07] change /var/lib/kubelet mount from Bidirectional to HostToContainer
  • [PR #​17028][alaypatel07] VEP-10: bug fixes for DRA Devices to align kubevirt implementation to KEP-5304
  • [PR #​17557][dshchedr] Fixed GuestPanicked event details for non-root virt-launcher
  • [PR #​17235][tiraboschi] Fix: GuestAgentPing liveness/readiness probes no longer cause Kubernetes to restart the virt-launcher pod when the guest agent is temporarily unreachable for a non-fault reason; suppression covers live migration (both pre-copy target and post-copy source) and any intentional or transient VM pause such as user pause, snapshot, save, or dump.
  • [PR #​17497][sbiradar10] Remediate CVE-2026-33186 by bumping grpc to 1.79.3
  • [PR #​17295][avlitman] new metric kubevirt_vmi_sync_total added in order to track number of times a controller has synced a VMI.
  • [PR #​17512][0xFelix] Remove vnc/screenshot from kubevirt.io:edit
  • [PR #​16882][alromeros] Snapshot: Add PartialSnapshot indication for excluded volumes
  • [PR #​17398][dasionov] Bug-fix: virt-handler now detects when domain-notify.sock is deleted and automatically restarts the notify server.
  • [PR #​16890][xpivarc] KubeVirt's PCI device plugin now supports passing of pre-setup VF (vGPU)
  • [PR #​17425][shubham-pampattiwar] fix: VirtualMachineBackup printer columns (Type, CheckpointName) now display correctly in kubectl output
  • [PR #​17407][dsanatar] preserve annotation for restore pvc
  • [PR #​17297][Acedus] fix: correctly handle source resolution for disks with a qcow2 overlay, preventing incorrect disk expansion and wrong cache/IO mode detection.
  • [PR #​16742][keinsword] Improve Unmount() cleanup by processing all entries and preserving failed paths for retry.
  • [PR #​16853][dankenigsberg] VMs with backend storage volume use and report the volume name as persistent-state-for-this-vm rather than trying to embed the vm name in the volume name.
  • [PR #​17315][frenzyfriday] Fixes bug in Live NAD Ref Update feature where a VM with no interfaces/networks is unable to start when LiveNADRefUpdate FG is enabled.
  • [PR #​17102][Barakmor1] Bug fix: sync-controller healthz server and virt-exportserver now respect TLSConfiguration from the KubeVirt CR.
  • [PR #​16730][alromeros] GA VMExport feature gate
  • [PR #​17139][dsanatar] fix hotplug volume status being stuck in Detaching phase
  • [PR #​16514][varunrsekar] The PanicDevices feature has graduated to GA and no longer requires the associated feature gate to be enabled.
  • [PR #​17251][iholder101] Fixed VM startup failure under software emulation when /dev/kvm is absent, caused by cgroup device rules not accounting for the emulation case.
  • [PR #​17042][awels] Fixed migration not reporting succeeded when doing compute migration after decentralized live migration
  • [PR #​16842][ksimon1] OpenApi V3 paths for subresources.kubevirt.io is present
  • [PR #​17065][avlitman] multiple recording rules are deprecated in favor of new names, in order to comply with the recording rules naming conventions. kubevirt_vm_created_total recording rule and kubevirt_vm_created_by_pod_total metric are deprecated completely
  • [PR #​17285][dhiller] Maintenance: revert bazel server network change monitoring
  • [PR #​17071][samt-ai] Make --vnc-path optional for --vnc-type, allowing VNC viewer binary lookup from $PATH automatically
  • [PR #​17109][dasionov] bug-fix: restart virt-handler's domain-notify server on unexpected exit.
  • [PR #​16885][akalenyu] Maintenance: make the bazel server container reload on network changes
  • [PR #​16675][csomani1] vGPU (mdev) now supports live migration (limited to one device)
  • [PR #​17106][iholder101] Allow multifd (parallel migration threads) with post-copy migration
  • [PR #​15298][Acedus] bugfix: Online snapshots now correctly include live-changes applied to a VM.
  • [PR #​16737][keinsword] Fix virt-handler hotplug mount target record growth by preventing duplicate TargetFile entries.
  • [PR #​17041][orelmisan] Fixed an infinite VMI status update loop between virt-controller and virt-handler that occurred when the VMI spec listed the primary network interface after a secondary one.
  • [PR #​16783][dasionov] Fixed SMBIOS system information not being visible inside ARM64 guest VMs
  • [PR #​16556][alaypatel07] VEP-10: Update DRA devices implementation to read from metadata file instead of VMI status
  • [PR #​16930][Acedus] Introduce incremental backup pull mode support
  • [PR #​16927][harshitgupta1337] Add MSHV backend for multi-hypervisor support interfaces.
  • [PR #​16817][ShellyKa13] Handle migration with CBT and backup checkpoints
  • [PR #​16632][mresvanis] Add PCIe NUMA-aware topology placement for GPU and host devices behind the PCINUMAAwareTopology feature gate (Alpha). When enabled, devices are automatically placed on PCIe expander buses matching their NUMA affinity for improved performance.
  • [PR #​16884][EdDev] 'virtctl expose' creates now services with an ownerReference pointing to the exposed resource.
  • [PR #​16412][frenzyfriday] Allows the user to update the NAD reference (networkName) of a network on a running VM through Live Migration.
  • [PR #​16746][Barakmor1] Expose Memory Overhead on VMI Status behind VmiMemoryOverheadReport feature gate
  • [PR #​16350][orenc1] Add a new config option to opt-out RBAC aggregation
  • [PR #​16806][machadovilaca] Use defined deployment number of replicas as base to fire low count alerts
  • [PR #​16604][dsanatar] Graduate ExpandDisk Feature Gate
  • [PR #​15958][Aseeef] Added support for attestation on the Intel TDX Confidential Computing Platform
  • [PR #​16877][ShellyKa13] Handle migration during backup according to migration priority
  • [PR #​16871][awels] BugFix: VMs requiring enlightenment are now able to be live migrated after a decentralized live migration
  • [PR #​16865][machadovilaca] Subtract non-schedulable nodes from kubevirt_allocatable_nodes
  • [PR #​16846][Aneesh-Hegde] fix VMExport failure with long PVC names
  • [PR #​16399][Acedus] fix: Prevent stale VMI backup status update when reusing backup names
  • [PR #​16786][alromeros] Allow disabling Velero hooks in virt-launcher via Annotation

Contributors

108 people contributed to this release:

67 Orel Misan omisan@redhat.com
63 Dan Kenigsberg danken@redhat.com
54 Adi Aloni aaloni@redhat.com
51 Itamar Holder iholder@redhat.com
45 dsionov dsionov@redhat.com
44 Or Shoval oshoval@redhat.com
43 Michal Skrivanek michal.skrivanek@redhat.com
42 Lee Yarwood lyarwood@redhat.com
38 fossedihelm ffossemo@redhat.com
36 Luboslav Pivarc lpivarc@redhat.com
33 Harshit Gupta guptaharshit@microsoft.com
32 Alex Kalenyuk akalenyu@redhat.com
29 Brian Carey brian.carey@protonmail.com
26 Felix Matouschek fmatouschek@redhat.com
23 machadovilaca machadovilaca@gmail.com
21 bmordeha bmordeha@redhat.com
19 Ananya Banerjee anbanerj@redhat.com
19 Aseef contact@aseef.dev
18 Alvaro Romero alromero@redhat.com
17 Edward Haas edwardh@redhat.com
17 avlitman alitman@redhat.com
16 Aseef Imran aimran@redhat.com
16 Michael Henriksen mhenriks@redhat.com
15 Fan Zhang fanzhang@nvidia.com
15 Jed Lejosne jed@redhat.com
13 Alexander Wels awels@redhat.com
13 Nir Dothan ndothan@redhat.com
13 Vamsi Krishna Siddu vamsikrishna.siddu@ibm.com
13 dsanatar dsanatar@redhat.com
11 Harshitha MS harshitha.ms@ibm.com
10 Alay Patel alayp@nvidia.com
10 Daniel Hiller dhiller@redhat.com
10 Shelly Kagan skagan@redhat.com
8 Oren Cohen ocohen@redhat.com
7 Karel Simon ksimon@redhat.com
7 Noam Assouline nassouli@redhat.com
6 Beñat Gartzia Arruabarrena bgartzia@redhat.com
6 Javier Cano Cano jcanocan@redhat.com
6 Michail Resvanis mresvani@redhat.com
6 Michal Vavrinec mvavrine@redhat.com
6 ronilerr rrabinov@redhat.com
5 rkishner rkishner@redhat.com
4 Laxmi Adavalli laxmi.adavalli@ibm.com
4 Vladik Romanovsky vromanso@redhat.com
4 dhiller dhiller@redhat.com
4 jaydeep869 <jaydeeppokhariya2106@​gmail.com>
4 svarnam svarnam@nvidia.com
3 Dylan White dywhite@redhat.com
3 Emanuele Prella eprella@redhat.com
3 German Maglione gmaglione@redhat.com
3 Jan Schintag jan.schintag@de.ibm.com
3 Nestor Acuna Blanco nestor.acuna@ibm.com
3 Samuel Albershtein salbersh@redhat.com
3 Shirly Radco sradco@redhat.com
3 Simone Tiraboschi stirabos@redhat.com
3 Vishnu Challa vchalla@redhat.com
2 Aidan Wallace awallace@redhat.com
2 Aneesh Hegde <aneeshhegde7110@​gmail.com>
2 Avnish Jaltare <avnishjaltare8@​gmail.com>
2 Billy billydevbusiness@gmail.com
2 Denis Ollier dollierp@redhat.com
2 RITANKAR SAHA <ritankar.saha786@​gmail.com>
2 Varun Ramachandra Sekar vsekar@nvidia.com
2 Vidit Bhat bhatvidit@gmail.com
2 Vladislav Alekseev valekseev@nebius.com
2 Xu Han xuhan@redhat.com
2 mosheyaku mosheyaku@gmail.com
2 samt samt@redhat.com
1 Adi Aloni 105346241+Acedus@users.noreply.github.com
1 Andrej Krejcir akrejcir@redhat.com
1 Andy Powell andrew@civo.com
1 AnupamSingh2004 <sanupam2004@​gmail.com>
1 Chandan Somani csomani@redhat.com
1 Changlin Hu <steviehu95@​gmail.com>
1 Daniel Hiller <daniel.hiller.1972@​googlemail.com>
1 Danny Sanatar dsanatar@redhat.com
1 Denys Shchedrivyi dshchedr@redhat.com
1 Ethan J. Gallant ethan.gallant@gmail.com
1 Federico Fossemo ffossemo@redhat.com
1 Gabriele Pio Nitti nittigabriele@gmail.com
1 Howard Gao howard.gao@gmail.com
1 Jathavedhan M jathavedhan.m@ibm.com
1 João Vilaça machadovilaca@gmail.com
1 Kelson White kelson@redhat.com
1 Martin Sivak msivak@redhat.com
1 Matias Ezequiel Vara Larsen mvaralar@redhat.com
1 Max Weiss maxweiss@microsoft.com
1 Michal Vavrinec 91726098+Ruclo@users.noreply.github.com
1 Raul Leite sp4wn.root@gmail.com
1 Shivansh Sahu <sahushivansh142@​gmail.com>
1 Shiwani Biradar sbiradar@redhat.com
1 Shreesha001 <shettyshreesha552@​gmail.com>
1 Shubham Pampattiwar spampatt@redhat.com
1 Uday Yendava uyendava@redhat.com
1 Vaivaswat Dubey <vaivaswat2244@​gmail.com>
1 Victor Toso victortoso@redhat.com
1 Vladislav Alekseev keinsword@gmail.com
1 Volker Theile vtheile@suse.com
1 Volodymyr Tsap voa@shalb.com
1 Yaroslav Borbat <yaroslav.752@​gmail.com>
1 ajcaldelas alan.caldelas@amd.com
1 arnabnandikgp <arnabnandi2002@​gmail.com>
1 kartheek kartheekbudime@gmail.com
1 nestoracunablanco nestor.acuna@ibm.com
1 pranshul gupta <pranshulg01@​gmail.com>

Additional Resources

-----BEGIN PGP SIGNATURE-----

iHUEABEIAB0WIQQK4GMgftQ8MISyrdLHuzxv+aiWdAUCamtGBwAKCRDHuzxv+aiW
dH23AP4ikmdr53N1RmDmU9e9EBNZjJF+9UI7d4Ue10O20dEsFgEA5R5oqSO5bc11
n6ct32N8og9xbCZab79Aav2G0+8geb0=
=CHt5
-----END PGP SIGNATURE-----

v1.8.4

Compare Source

tag v1.8.4
Tagger: Federico Fossemo ffossemo@redhat.com

This release follows v1.8.3 and consists of 31 changes, contributed by 12 people, leading to 60 files changed, 1901 insertions(+), 475 deletions(-).

The source code and selected binaries are available for download at: https://github.com/kubevirt/kubevirt/releases/tag/v1.8.4.

The primary release artifact of KubeVirt is the git tree. The release tag is
signed and can be verified using git tag -v v1.8.4.

Pre-built containers are published on Quay and can be viewed at: https://quay.io/kubevirt/.

Notable changes

  • [PR #​17987][Ronilerr] Adding missing metrics, recording rules and alerts for virt components
  • [PR #​17962][UdayYendva] Bump github.com/moby/spdystream from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).
  • [PR #​18059][kubevirt-bot] Use --expand-cpu-features and --supported-cpu-features in node-labeller for
  • [PR #​18031][SamAlber] Fixed a gRPC connection leak in virt-handler's GetLauncherClient that caused unbounded memory growth, socket accumulation, and goroutine leaks when multiple controllers raced to create connections for the same VMI.

Contributors

12 people contributed to this release:

6 ronilerr rrabinov@redhat.com
3 Adi Aloni aaloni@redhat.com
2 Samuel Albershtein salbersh@redhat.com
2 bmordeha bmordeha@redhat.com
1 Javier Cano Cano jcanocan@redhat.com
1 Lee Yarwood lyarwood@redhat.com
1 Or Shoval oshoval@redhat.com
1 Oren Cohen ocohen@redhat.com
1 Uday Yendava uyendava@redhat.com
1 fossedihelm ffossemo@redhat.com

Additional Resources

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQT336LhfFzgGMwYm4OriYWHZ3eqPAUCai/AYwAKCRCriYWHZ3eq
PJWrAQCHqk74Hfcw/NssGvFo1tGhhYr96XE3eiiZJ+NEWIqGVAEA54l9iwEj2ibo
TNawajpxXOk2lQAOLEE0hraThtenJQs=
=3Wgo
-----END PGP SIGNATURE-----

v1.8.3

Compare Source

tag v1.8.3
Tagger: Federico Fossemo ffossemo@redhat.com

This release follows v1.8.2 and consists of 75 changes, contributed by 21 people, leading to 457 files changed, 81936 insertions(+), 33796 deletions(-).

The source code and selected binaries are available for download at: https://github.com/kubevirt/kubevirt/releases/tag/v1.8.3.

The primary release artifact of KubeVirt is the git tree. The release tag is
signed and can be verified using git tag -v v1.8.3.

Pre-built containers are published on Quay and can be viewed at: https://quay.io/kubevirt/.

Notable changes

  • [PR #​17988][kubevirt-bot] Fix symlink traversal in VMExport dir handler
  • [PR #​17876][nirdothan] Fixed VMI status reporting the pod's IPv6 address instead of the guest's when using bridge binding on a network with IPv6 IPAM.
  • [PR #​17660][kubevirt-bot] Updated virt-template to v0.1.8
  • [PR #​17745][kubevirt-bot] Fixed virt-controller DRA claim rendering for GPU/HostDevice resources by preserving per-device claim/request tuples (including shared claim names with different requests).
  • [PR #​17863][fossedihelm] Fixed multi-device VFIO passthrough VMs failing to start with "cannot limit locked memory" by scaling virt-handler's memlock rlimit to account for per-device memory locking, matching libvirt's calculation introduced in v8.7.0.
  • [PR #​17823][kubevirt-bot] Fix VirtualMachineStuckOnNode and VMCannotBeEvicted alerts failing during live migration due to duplicate kubevirt_vmi_info series
  • [PR #​17727][mhenriks] Gate PCI topology on machine type, not just architecture
  • [PR #​17761][kubevirt-bot] Bug fix: virt-operator error messages no longer dump entire resource structs via %+v, preventing the KubeVirt CR from exceeding the etcd 3MB object size limit when resource creation fails
  • [PR [#​17658](https://redirec

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Taipei)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
chore(deps): update module kubevirt.io/kubevirt to v1.9.0 [security]
991b816 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate

renovate Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 16 additional dependencies were updated

Details:

Package Change
k8s.io/api v0.34.1 -> v0.34.3
k8s.io/apimachinery v0.34.1 -> v0.34.3
kubevirt.io/api v1.7.0 -> v1.8.0
sigs.k8s.io/controller-runtime v0.21.0 -> v0.22.5
github.com/emicklei/go-restful/v3 v3.12.2 -> v3.13.0
github.com/google/gnostic-models v0.7.0 -> v0.7.1
gopkg.in/evanphx/json-patch.v4 v4.12.0 -> v4.13.0
k8s.io/apiserver v0.34.1 -> v0.34.3
k8s.io/component-base v0.34.1 -> v0.34.3
github.com/go-openapi/jsonpointer v0.21.1 -> v0.22.4
github.com/go-openapi/jsonreference v0.21.0 -> v0.21.4
github.com/go-openapi/swag v0.23.1 -> v0.25.4
k8s.io/apiextensions-apiserver v0.34.1 -> v0.34.3
k8s.io/klog/v2 v2.130.1 -> v2.140.0
k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d -> v0.0.0-20260319190234-28399d86e0b5
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 -> v0.0.0-20250730193827-2d320260d730

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies needs-review renovate/v1.9

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants