Release notes from metrics-server v0.9.0

{
  "id": "5ef8235e237c782e60bd782a2f6123fde5c501bce7a7b6fd7ed7e2790c12c398",
  "url": "https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Release notes from metrics-server v0.9.0",
    "summary": "metrics-server v0.9.0 updates Go and golang.org/x/crypto dependencies; the Go update addresses two listed CVEs.",
    "evidence": "Bump Go version to v1.26.4, addressing CVE-2025-47907 and CVE-2025-47906.",
    "products": [
      {
        "name": {
          "value": "metrics-server",
          "evidence": "Release notes from metrics-server"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v0.9.0",
            "evidence": "Release notes from metrics-server\nv0.9.0"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-47907",
        "evidence": "Bump Go version to v1.26.4, addressing CVE-2025-47907 and CVE-2025-47906."
      },
      {
        "value": "CVE-2025-47906",
        "evidence": "Bump Go version to v1.26.4, addressing CVE-2025-47907 and CVE-2025-47906."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-kubernetes-sigs-metrics-server",
  "document_id": 21561,
  "published_at": "2026-07-13T12:27:58+00:00"
}