Security

The release images were rebuilt with Go 1.26.10, which includes the crypto/x509 mitigation for CVE-2026-111943 / GO-2026-6809. The refreshed Distroless trust bundle excludes emSign ECC Root CA - G3 and AAA Certificate Services, addressing the image rebuild request in #10621.

Changes by Kind

Bug or Regression

• Exclude GPU-labeled unmanaged nodes with unavailable GPU capacity from GPU quota usage, logging a warning instead of blocking cluster-wide scale-up. (#10409, @MaximilianoUribe)
• AWS: correctly extract placeholder instance names when an Auto Scaling Group name contains /. (#10350, @ketanjani21)
• OCI instance pools: align HasInstance and NodeGroupForNode instance mappings, compare pool states case-insensitively, and improve diagnostic logging. (#9383, @jlamillan)
• OCI: include the fault-domain label on node-pool templates so pods with fault-domain scheduling constraints can select zero-size pools. (#10048, @jlamillan)

Other (Cleanup or Flake)

• Update Kubernetes dependencies to v1.34.13. The Go module's minimum version increases from 1.24 to 1.25; the published release images use Go 1.26.10 as noted above. (#10612, @jackfrancis)
• Move the release-image builder to Go 1.26. (#10582, @GaneshBannur)
• Change the default staging build/push destination to us-central1-docker.pkg.dev/k8s-staging-images/autoscaling. Production image URLs remain under registry.k8s.io/autoscaling. (#10599, @maxsxu)

Images

• registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.6
• registry.k8s.io/autoscaling/cluster-autoscaler-amd64:v1.34.6
• registry.k8s.io/autoscaling/cluster-autoscaler-arm64:v1.34.6
• registry.k8s.io/autoscaling/cluster-autoscaler-s390x:v1.34.6

Full Changelog: cluster-autoscaler-1.34.5...cluster-autoscaler-1.34.6