What's Changed
- [release-1.20] chore: bump Go version to 1.25.12 in trivy workflow by @k8s-infra-cherrypick-robot in #1149
- [release-1.20] fix: CVE-2026-24051 by @andyzhangx in #1153
- [release-1.20] fix: GHSA-hrxh-6v49-42gf by @andyzhangx in #1161
- [release-1.20] fix: prevent goroutine leak on Windows mount timeout by @k8s-infra-cherrypick-robot in #1166
- [release-1.20] feat: add krb5AutoConfig option for automatic Kerberos ccache setup by @andyzhangx in #1168
- [release-1.20] chore: remove xfsprogs from smbplugin image by @k8s-infra-cherrypick-robot in #1186
- [release-1.20] chore: bump csi-resizer to v2.2.1 (cherry-pick #1184) by @andyzhangx in #1185
- [release-1.20] fix: update Go version from 1.26.4 to 1.26.5 to fix CVEs by @andyzhangx in #1190
- [release-1.20] chore: remove e2fsprogs from smbplugin image by @k8s-infra-cherrypick-robot in #1191
- [release-1.20] chore: bump Go to 1.26.6 by @k8s-infra-cherrypick-robot in #1193
- [release-1.20] cleanup: demote empty GRPC response log to V(6) by @k8s-infra-cherrypick-robot in #1200
- [release-1.20] fix: CVE-2026-56854 by @andyzhangx in #1205
- cherry-pick #1209 to release-1.20: add --require-privacy-for-global-mapping flag on Windows nodes by @andyzhangx in #1210
- [release-1.20] fix: CVE-2026-84304 by @andyzhangx in #1212
- [release-1.20] fix: CVE-2026-56855 by @andyzhangx in #1214
- [release-1.20] fix: recover stale SMB mappings in hostprocess remount by @k8s-infra-cherrypick-robot in #1220
- [release-1.20] fix: CVE-2026-81870 by @andyzhangx in #1223
- [release-1.20] fix: reject block volumes in NodePublishVolume by @k8s-infra-cherrypick-robot in #1228
- [release-1.20] fix: CVE-2026-78659 by @andyzhangx in #1233
- chore: update release-tools via subtree pull by @andyzhangx in #1234
- [release-1.20] upgrade to go 1.26.10 to fix CVE-2026-111943 by @andyzhangx in #1242
- doc: cut v1.20.4 release by @andyzhangx in #1243
Full Changelog: v1.20.3...v1.20.4