Security

The release images were rebuilt with Go 1.26.10, which includes the crypto/x509 mitigation for CVE-2026-111943 / GO-2026-6809. The refreshed Distroless trust bundle excludes emSign ECC Root CA - G3 and AAA Certificate Services, addressing the image rebuild request in #10621.

Changes by Kind

Bug or Regression

• Exclude GPU-labeled unmanaged nodes with unavailable GPU capacity from GPU quota usage, logging a warning instead of blocking cluster-wide scale-up. (#10408, @MaximilianoUribe)
• AWS: correctly extract placeholder instance names when an Auto Scaling Group name contains /. (#10351, @ketanjani21)
• AWS: fix integer overflow in memory calculations for ASGs using attribute-based InstanceRequirements without instance-type overrides. A MemoryMiB.Min of 2048 or greater could produce a zero-memory template node and prevent scale-up. (#10271, @pujitha24)
• Azure: fix VMSS instance deletion when disableAzureStackCloud is enabled. (#10085, @tallaxes)
• Cluster API: allow scale-down of MachinePool-backed node groups when no per-node Machine can be resolved, after verifying that the node belongs to the MachinePool, by decrementing the pool's replica count. (#10485, @iamjanr)
• OCI instance pools: align HasInstance and NodeGroupForNode instance mappings, compare pool states case-insensitively, and improve diagnostic logging. (#9385, @jlamillan)
• OCI: include the fault-domain label on node-pool templates so pods with fault-domain scheduling constraints can select zero-size pools. (#10049, @jlamillan)
• OCI: recover node pools when failed node creation leaves a node without an instance ID. (#10118, @jlamillan)
• Pass build-tag and linker flags to Docker image builds so BUILD_TAGS and LDFLAGS are honored, including provider-specific builds that avoid compiling unused cloud providers. (#10623, @Choraden)

Other (Cleanup or Flake)

• Update Kubernetes dependencies to v1.35.10. (#10613, @jackfrancis)
• Move the release-image builder to Go 1.26. (#10581, @GaneshBannur)
• Change the default staging build/push destination to us-central1-docker.pkg.dev/k8s-staging-images/autoscaling. Production image URLs remain under registry.k8s.io/autoscaling. (#10600, @maxsxu)

Images

• registry.k8s.io/autoscaling/cluster-autoscaler:v1.35.3
• registry.k8s.io/autoscaling/cluster-autoscaler-amd64:v1.35.3
• registry.k8s.io/autoscaling/cluster-autoscaler-arm64:v1.35.3
• registry.k8s.io/autoscaling/cluster-autoscaler-s390x:v1.35.3

Full Changelog: cluster-autoscaler-1.35.2...cluster-autoscaler-1.35.3