v1.27.9 release

What's Changed

• cherry-pick #2601 to release-1.27: fix rhcos mountPath alongside hostPath by @andyzhangx in #2602
• Cherry-pick #2603 to release-1.27: validate volume attribute keys and containerName by @andyzhangx in #2605
• doc: cut v1.27.9 release by @andyzhangx in #2608

Full Changelog: v1.27.8...v1.27.9

v1.26.16 release

What's Changed

• Cherry-pick #2603 to release-1.26: validate volume attribute keys and containerName by @andyzhangx in #2606
• doc: cut v1.26.16 release by @andyzhangx in #2607

Full Changelog: v1.26.15...v1.26.16

v1.27.8 release

What's Changed

• [release-1.27] cleanup: add periodic progress logging for SetVolumeOwnership during NodeStageVolume by @k8s-infra-cherrypick-robot in #2520
• [release-1.27] fix: CVE-2026-25680 by @andyzhangx in #2522
• [release-1.27] chore: update CSI sidecar images to latest versions by @andyzhangx in #2527
• [release-1.27] chore: bump Go version to 1.25.12 in trivy workflow by @k8s-infra-cherrypick-robot in #2536
• [release-1.27] chore: upgrade azcopy to v10.32.5 to fix CVEs by @andyzhangx in #2540
• [release-1.27] feat: install blobfuse 2.5.4 as default version by @andyzhangx in #2545
• [release-1.27] fix: clean up orphaned container on CreateVolume failure by @k8s-infra-cherrypick-robot in #2551
• [release-1.27] fix: CVE-2026-56852 by @andyzhangx in #2555
• [release-1.27] fix: allow additional blobfuse2 mount options in ephemeral allowlist by @k8s-infra-cherrypick-robot in #2556
• [release-1.27] cherry-pick: allow blobfuse2 attr-cache-max-size-mb and kernel-list-cache-timeout on ephemeral volumes by @andyzhangx in #2560
• [release-1.27] fix: GHSA-hrxh-6v49-42gf by @andyzhangx in #2567
• fix: prevent ARM throttling on kubelet requiresRepublish for clientID-based mounts (cherry-pick #2575) by @andyzhangx in #2578
• Cherry pick #2573 into release-1.27: use syscall.Statfs instead of ReadDir for mount health probe by @andyzhangx in #2580
• [release-1.27] fix: skip ReadDir health probe on NodePublishVolume republish by @k8s-infra-cherrypick-robot in #2574
• [release-1.27] chore: upgrade azcopy to v10.32.6 to fix CVEs by @k8s-infra-cherrypick-robot in #2583
• [release-1.27] fix: resolve /usr/local symlink under crun by adding linux.distro=rhcos by @andyzhangx in #2586
• doc: cut v1.27.8 release by @andyzhangx in #2588

Full Changelog: v1.27.7...v1.27.8

v1.26.15 release

What's Changed

• [release-1.26] fix: CVE-2026-25680 by @andyzhangx in #2523
• [release-1.26] chore: bump Go version to 1.25.12 in trivy workflow by @k8s-infra-cherrypick-robot in #2537
• [release-1.26] chore: upgrade azcopy to v10.32.5 to fix CVEs by @andyzhangx in #2541
• [release-1.26] feat: install blobfuse 2.5.4 as default version by @andyzhangx in #2546
• [release-1.26] fix: CVE-2026-56852 by @andyzhangx in #2554
• [release-1.26] fix: allow additional blobfuse2 mount options in ephemeral allowlist by @k8s-infra-cherrypick-robot in #2557
• [release-1.26] cherry-pick: allow blobfuse2 attr-cache-max-size-mb and kernel-list-cache-timeout on ephemeral volumes by @andyzhangx in #2561
• [release-1.26] fix: GHSA-hrxh-6v49-42gf by @andyzhangx in #2568
• fix: skip unmount in ensureMountPoint during NodePublishVolume republish (cherry-pick #2509) by @andyzhangx in #2577
• [release-1.26] fix: skip ReadDir health probe on NodePublishVolume republish by @k8s-infra-cherrypick-robot in #2579
• [release-1.26] chore: upgrade azcopy to v10.32.6 to fix CVEs by @andyzhangx in #2584
• doc: cut v1.26.15 release by @andyzhangx in #2587

Full Changelog: v1.26.14...v1.26.15

v1.27.7 release

What's Changed

• [release-1.27] fix: allow --use-adls mount option for ephemeral volumes by @k8s-infra-cherrypick-robot in #2507
• [release-1.27] fix: skip unmount in ensureMountPoint during NodePublishVolume republish by @k8s-infra-cherrypick-robot in #2512
• [release-1.27] chore: lower blobfuse proxy health metric verbosity by @k8s-infra-cherrypick-robot in #2511
• doc: cut v1.27.7 release by @andyzhangx in #2514

Full Changelog: v1.27.6...v1.27.7

v1.26.14 release

What's Changed

• [release-1.26] fix: allow --use-adls mount option for ephemeral volumes by @k8s-infra-cherrypick-robot in #2508
• doc: cut v1.26.14 release by @andyzhangx in #2513

Full Changelog: v1.26.13...v1.26.14

v1.27.6 release

What's Changed

• [release-1.27] chore: use native platform for Dockerfile builder stage to avoid QEMU arm64 failures by @k8s-infra-cherrypick-robot in #2486
• [release-1.27] chore: update go version to 1.25.11 and add stdlib CVEs to .trivyignore by @k8s-infra-cherrypick-robot in #2495
• [release-1.27] fix: scope container name validation to inline volume only by @k8s-infra-cherrypick-robot in #2496
• doc: cut v1.27.6 release by @sunpa93 in #2498

Full Changelog: v1.27.5...v1.27.6

v1.26.13 release

What's Changed

• [release-1.26] chore: update go version to 1.25.11 and add stdlib CVEs to .trivyignore by @k8s-infra-cherrypick-robot in #2494
• [release-1.26] fix: scope container name validation to inline volume only by @k8s-infra-cherrypick-robot in #2497
• doc: cut v1.26.13 release by @sunpa93 in #2499

Full Changelog: v1.26.12...v1.26.13

v1.27.5 release

What's Changed

• cleanup: remove obsolete blobfuse-proxy.yaml reference from kustomization.yaml by @andyzhangx in #2419
• fix: correct NOTES.txt selector in latest chart (release-1.27) by @andyzhangx in #2422
• [release-1.27] fix: add missing fields to storage account lockKey by @k8s-infra-cherrypick-robot in #2428
• [release-1.27] fix: preserve storageAccount for inline volumes with workload identity by @k8s-infra-cherrypick-robot in #2437
• [release-1.27] cleanup: improve blobfuse-proxy mount logging to clarify version selection reason by @k8s-infra-cherrypick-robot in #2438
• [release-1.27] fix: skip storing account key when using identity-based mount by @k8s-infra-cherrypick-robot in #2441
• [release-1.27] test: add managed identity auth mount e2e test for dynamic provisioning by @k8s-infra-cherrypick-robot in #2444
• [release-1.27] chore: ignore CVE-2026-29181 in azcopy in trivy scan by @k8s-infra-cherrypick-robot in #2447
• [release-1.27] fix: skip blobfuse2/fuse3-libs host install on Azure Container Linux by @andyzhangx in #2449
• [release-1.27] chore: bump Go version to 1.25.10 in trivy workflow by @k8s-infra-cherrypick-robot in #2452
• [release-1.27] test: add e2e test for dynamic provisioning with workload identity token mount by @k8s-infra-cherrypick-robot in #2463
• [release-1.27] chore: upgrade azcopy to v10.32.4 to fix CVEs by @k8s-infra-cherrypick-robot in #2467
• [release-1.27] Fix/blobfuse proxy context by @k8s-infra-cherrypick-robot in #2470
• [release-1.27] fix: stop ticker/timer in waitForMount to avoid leak by @k8s-infra-cherrypick-robot in #2471
• [release-1.27] fix: harden ephemeral mount option handling for inline volumes (cherry-pick #2460) by @andyzhangx in #2476
• [release-1.27] chore(deps): bump build-image/debian-base from bookworm-v1.0.7 to bookworm-v1.0.8 in /pkg/blobplugin by @k8s-infra-cherrypick-robot in #2479
• doc: cut v1.27.5 release by @andyzhangx in #2482

Full Changelog: v1.27.4...v1.27.5

v1.26.12 release

What's Changed

• cleanup: remove obsolete blobfuse-proxy.yaml reference from kustomization.yaml by @andyzhangx in #2420
• fix: correct NOTES.txt selector in latest chart (release-1.26) by @andyzhangx in #2421
• [release-1.26] chore: ignore CVE-2026-29181 in azcopy in trivy scan by @k8s-infra-cherrypick-robot in #2448
• [release-1.26] chore: bump Go version to 1.25.10 in trivy workflow by @k8s-infra-cherrypick-robot in #2453
• [release-1.26] chore: upgrade azcopy to v10.32.4 to fix CVEs by @k8s-infra-cherrypick-robot in #2468
• [release-1.26] fix: harden ephemeral mount option handling for inline volumes (cherry-pick #2460) by @andyzhangx in #2477
• [release-1.26] chore(deps): bump build-image/debian-base from bookworm-v1.0.7 to bookworm-v1.0.8 in /pkg/blobplugin by @k8s-infra-cherrypick-robot in #2480
• doc: cut v1.26.12 release by @andyzhangx in #2481

Full Changelog: v1.26.11...v1.26.12