What's Changed

• [release-1.27] chore: ignore x/crypto CVEs in trivy scan by @k8s-infra-cherrypick-robot in #2676
• fix: reject non-ASCII volume attribute keys on inline volumes by @andyzhangx in #2680
• doc: cut v1.27.11 release by @kapilupadhayay in #2686
• [release-1.27] Adds BlobFuse2 distributed-cache support and default DNS server option to the Blob CSI driver. by @k8s-infra-cherrypick-robot in #2690

Full Changelog: v1.27.10...v1.27.11

What's Changed

• [release-1.27] fix: change azure container linux install path for blobfuse-proxy by @dallasd1 in #2610
• [release-1.27] chore: update csi-resizer to v2.2.1 by @andyzhangx in #2619
• [release-1.27] fix: optionally skip reading the config from the API server by @k8s-infra-cherrypick-robot in #2617
• [release-1.27] chore: bump Go to 1.26.6 and update .trivyignore by @k8s-infra-cherrypick-robot in #2622
• [release-1.27] fix: do not overwrite host libfuse3.so.3 on RHCOS/RHEL by @k8s-infra-cherrypick-robot in #2625
• cherry-pick #2620 to release-1.27: fix: harden server field handling in inline volume with managed identity auth mount by @andyzhangx in #2628
• [release-1.27] fix: limit inline block cache parallelism by @k8s-infra-cherrypick-robot in #2631
• cherry-pick #2630 to release-1.27: protect storageAccountName for inline volumes by @andyzhangx in #2633
• [release-1.27] fix: block preload for inline volumes by @k8s-infra-cherrypick-robot in #2636
• [release-1.27] chore: upgrade azcopy to v10.32.7 to fix CVEs by @k8s-infra-cherrypick-robot in #2641
• [release-1.27] cleanup: reduce log noise for ephemeral (CSI inline) volume NodePublishVolume path by @k8s-infra-cherrypick-robot in #2643
• chore: upgrade blobfuse to 2.5.5 (cherry-pick #2644 to release-1.27) by @andyzhangx in #2645
• [release-1.27] fix: CVE-2026-56854- #3783 by @andyzhangx in #2651
• [release-1.27] fix: mount azure.json read-only in CSI controller and node pods by @andyzhangx in #2654
• [release-1.27] test: add workload identity account-key mode e2e test by @k8s-infra-cherrypick-robot in #2656
• [release-1.27] chore: upgrade Azure cloud provider lib by @andyzhangx in #2658
• [release-1.27] fix: CVE-2026-84304 by @andyzhangx in #2662
• [release-1.27] chore: ignore CVE-2026-84304 in trivy scan by @k8s-infra-cherrypick-robot in #2664
• [release-1.27] chore: upgrade azcopy to v10.32.8 to fix CVEs by @k8s-infra-cherrypick-robot in #2667
• [release-1.27] fix: CVE-2026-56855 by @andyzhangx in #2670
• doc: cut v1.27.10 release by @kapilupadhayay in #2672

New Contributors

• @dallasd1 made their first contribution in #2610

Full Changelog: v1.27.9...v1.27.10

What's Changed

• [release-1.26] chore: bump Go to 1.26.6 and update .trivyignore by @k8s-infra-cherrypick-robot in #2623
• [release-1.26] fix: limit inline block cache parallelism by @k8s-infra-cherrypick-robot in #2632
• cherry-pick #2620 to release-1.26: fix: harden server field handling in inline volume with managed identity auth mount by @andyzhangx in #2629
• cherry-pick #2630 to release-1.26: protect storageAccountName for inline volumes by @andyzhangx in #2634
• [release-1.26] fix: block preload for inline volumes by @k8s-infra-cherrypick-robot in #2637
• [release-1.26] chore: upgrade azcopy to v10.32.7 to fix CVEs by @andyzhangx in #2642
• chore: upgrade blobfuse to 2.5.5 (cherry-pick #2644 to release-1.26) by @andyzhangx in #2646
• [release-1.26] fix: CVE-2026-56854 by @andyzhangx in #2652
• [release-1.26] fix: CVE-2026-84304 by @andyzhangx in #2663
• [release-1.26] chore: ignore CVE-2026-84304 in trivy scan by @k8s-infra-cherrypick-robot in #2665
• [release-1.26] chore: upgrade azcopy to v10.32.8 to fix CVEs by @landreasyan in #2668
• [release-1.26] fix: CVE-2026-56855 by @andyzhangx in #2671
• doc: cut v1.26.17 release by @kapilupadhayay in #2673

Full Changelog: v1.26.16...v1.26.17

What's Changed

• cherry-pick #2601 to release-1.27: fix rhcos mountPath alongside hostPath by @andyzhangx in #2602
• Cherry-pick #2603 to release-1.27: validate volume attribute keys and containerName by @andyzhangx in #2605
• doc: cut v1.27.9 release by @andyzhangx in #2608

Full Changelog: v1.27.8...v1.27.9

What's Changed

• Cherry-pick #2603 to release-1.26: validate volume attribute keys and containerName by @andyzhangx in #2606
• doc: cut v1.26.16 release by @andyzhangx in #2607

Full Changelog: v1.26.15...v1.26.16

What's Changed

• [release-1.27] cleanup: add periodic progress logging for SetVolumeOwnership during NodeStageVolume by @k8s-infra-cherrypick-robot in #2520
• [release-1.27] fix: CVE-2026-25680 by @andyzhangx in #2522
• [release-1.27] chore: update CSI sidecar images to latest versions by @andyzhangx in #2527
• [release-1.27] chore: bump Go version to 1.25.12 in trivy workflow by @k8s-infra-cherrypick-robot in #2536
• [release-1.27] chore: upgrade azcopy to v10.32.5 to fix CVEs by @andyzhangx in #2540
• [release-1.27] feat: install blobfuse 2.5.4 as default version by @andyzhangx in #2545
• [release-1.27] fix: clean up orphaned container on CreateVolume failure by @k8s-infra-cherrypick-robot in #2551
• [release-1.27] fix: CVE-2026-56852 by @andyzhangx in #2555
• [release-1.27] fix: allow additional blobfuse2 mount options in ephemeral allowlist by @k8s-infra-cherrypick-robot in #2556
• [release-1.27] cherry-pick: allow blobfuse2 attr-cache-max-size-mb and kernel-list-cache-timeout on ephemeral volumes by @andyzhangx in #2560
• [release-1.27] fix: GHSA-hrxh-6v49-42gf by @andyzhangx in #2567
• fix: prevent ARM throttling on kubelet requiresRepublish for clientID-based mounts (cherry-pick #2575) by @andyzhangx in #2578
• Cherry pick #2573 into release-1.27: use syscall.Statfs instead of ReadDir for mount health probe by @andyzhangx in #2580
• [release-1.27] fix: skip ReadDir health probe on NodePublishVolume republish by @k8s-infra-cherrypick-robot in #2574
• [release-1.27] chore: upgrade azcopy to v10.32.6 to fix CVEs by @k8s-infra-cherrypick-robot in #2583
• [release-1.27] fix: resolve /usr/local symlink under crun by adding linux.distro=rhcos by @andyzhangx in #2586
• doc: cut v1.27.8 release by @andyzhangx in #2588

Full Changelog: v1.27.7...v1.27.8

What's Changed

• [release-1.26] fix: CVE-2026-25680 by @andyzhangx in #2523
• [release-1.26] chore: bump Go version to 1.25.12 in trivy workflow by @k8s-infra-cherrypick-robot in #2537
• [release-1.26] chore: upgrade azcopy to v10.32.5 to fix CVEs by @andyzhangx in #2541
• [release-1.26] feat: install blobfuse 2.5.4 as default version by @andyzhangx in #2546
• [release-1.26] fix: CVE-2026-56852 by @andyzhangx in #2554
• [release-1.26] fix: allow additional blobfuse2 mount options in ephemeral allowlist by @k8s-infra-cherrypick-robot in #2557
• [release-1.26] cherry-pick: allow blobfuse2 attr-cache-max-size-mb and kernel-list-cache-timeout on ephemeral volumes by @andyzhangx in #2561
• [release-1.26] fix: GHSA-hrxh-6v49-42gf by @andyzhangx in #2568
• fix: skip unmount in ensureMountPoint during NodePublishVolume republish (cherry-pick #2509) by @andyzhangx in #2577
• [release-1.26] fix: skip ReadDir health probe on NodePublishVolume republish by @k8s-infra-cherrypick-robot in #2579
• [release-1.26] chore: upgrade azcopy to v10.32.6 to fix CVEs by @andyzhangx in #2584
• doc: cut v1.26.15 release by @andyzhangx in #2587

Full Changelog: v1.26.14...v1.26.15

What's Changed

• [release-1.27] fix: allow --use-adls mount option for ephemeral volumes by @k8s-infra-cherrypick-robot in #2507
• [release-1.27] fix: skip unmount in ensureMountPoint during NodePublishVolume republish by @k8s-infra-cherrypick-robot in #2512
• [release-1.27] chore: lower blobfuse proxy health metric verbosity by @k8s-infra-cherrypick-robot in #2511
• doc: cut v1.27.7 release by @andyzhangx in #2514

Full Changelog: v1.27.6...v1.27.7

What's Changed

• [release-1.26] fix: allow --use-adls mount option for ephemeral volumes by @k8s-infra-cherrypick-robot in #2508
• doc: cut v1.26.14 release by @andyzhangx in #2513

Full Changelog: v1.26.13...v1.26.14

What's Changed

• [release-1.27] chore: use native platform for Dockerfile builder stage to avoid QEMU arm64 failures by @k8s-infra-cherrypick-robot in #2486
• [release-1.27] chore: update go version to 1.25.11 and add stdlib CVEs to .trivyignore by @k8s-infra-cherrypick-robot in #2495
• [release-1.27] fix: scope container name validation to inline volume only by @k8s-infra-cherrypick-robot in #2496
• doc: cut v1.27.6 release by @sunpa93 in #2498

Full Changelog: v1.27.5...v1.27.6