Release Support
Kargo's maintainers publish a new minor release roughly four times a year. This page records when each minor release was published, its most recent patch, and how long Akuity backports fixes for Critical vulnerabilities to it.
| Release | Released | Latest patch | Critical CVE coverage ends |
|---|---|---|---|
| 1.11 | Jul 24, 2026 | v1.11.2 | Jul 24, 2027 |
| 1.10 | Apr 17, 2026 | v1.10.10 | Apr 17, 2027 |
| 1.9 | Jan 29, 2026 | v1.9.10 | Jan 29, 2027 |
| 1.8 | Oct 21, 2025 | v1.8.14 | Oct 21, 2026 |
| 1.7 | Aug 5, 2025 | v1.7.10 | Aug 5, 2026 |
| 1.6 | Jun 27, 2025 | v1.6.4 | Jun 27, 2026 |
| 1.5 | May 15, 2025 | v1.5.3 | May 15, 2026 |
| 1.4 | Apr 5, 2025 | v1.4.4 | Apr 5, 2026 |
| 1.3 | Feb 25, 2025 | v1.3.4 | Feb 25, 2026 |
| 1.2 | Jan 14, 2025 | v1.2.3 | Jan 14, 2026 |
| 1.1 | Dec 6, 2024 | v1.1.3 | Dec 6, 2025 |
| 1.0 | Oct 19, 2024 | v1.0.4 | Oct 19, 2025 |
What these dates mean
The final column is the end of the Critical CVE backport window for AKP
commercial builds of Kargo — the ak-tagged images distributed as part of
the Akuity Platform. Akuity backports fixes for Critical vulnerabilities to
AKP builds of any Kargo release published within the previous 12 months.
Coverage is bound by severity as well as by time:
| Severity | Backported to AKP builds of releases published within |
|---|---|
| Critical | the last 12 months |
| High | the last 6 months |
| Medium / Low | the current minor release |
Each window is measured from the affected release's publication date — the date in the Released column above — and a Kargo instance must be running a release still inside the applicable window to be eligible. A Critical vulnerability affecting a release published thirteen months ago falls outside the window; the fix for it lands in supported releases, and the instance running the older release upgrades to receive it.
Critical and High severity fixes in Kargo's own code may be delivered as out-of-band, security-only patch releases rather than waiting for the next minor release.
Open source Kargo
The open-source distribution — Apache 2.0, published to
ghcr.io/akuity/kargo — carries no time- or severity-bound backport
guarantee. Security fixes land in the latest release, and open-source users
upgrade to receive them. Fixes are not backported to older release lines.
Maintenance is best-effort and the software is provided "as is" under its
license.
The dates in the table above therefore describe AKP coverage. If you run the open-source distribution, the supported version is the latest release, whatever the table says about the line you are on.
Open-source and commercial builds are produced from the same source on the same release schedule, so a fix lands in both at the same time. What differs is the commitment around it and the range of releases it is backported to.
Open-source users receive the same transparency artifacts Akuity publishes with every release:
- A Software Bill of Materials (SBOM) enumerating the components in the image.
- Signed VEX statements recording whether each known vulnerability is actually exploitable in Kargo. Scanners commonly flag components that are present in an image but never invoked; VEX dispositions those findings formally so your scanner can filter them. Point your scanner at vex.akuity.io to ingest them, or read them from the Sigstore attestations attached to each released image.
- Public security advisories.