Creating Release Notes

This guide covers the creation of Harvester release notes for both minor and patch releases. SUSE Virtualization release notes are created separately and are derived from the completed Harvester release notes.

Although the source files reside in harvester/release-notes/, this process documentation is located in the harvester/docs repository because GitHub Wikis are disabled in the release notes repository.

Ownership and PR Creation

Release Type	Release Notes PR Creator	Primary Writer Responsibilities
Minor release	Doc Writer	Create the PR and prepare all writer-owned sections (see workflow below).
Patch release	Release Captain	Review and add release-specific content (such as warnings, deprecations, and security notices).

Doc Writer Workflow (Minor Releases)

When creating the release notes PR for a minor release, perform the following tasks:

1. Duplicate the previous minor version's release notes file.
2. Remove outdated or non-applicable content.
3. Update URLs in reused text (for example, installation and upgrade documentation links).
4. Write feature descriptions for the Highlights section:
   • Draft a concise description for every GitHub issue labeled highlight.
   • Include links to relevant documentation pages, YouTube demo videos, and GitHub issues for each highlighted feature.
5. Draft or review release-specific content requested by Engineering and Product Management (such as security notices, deprecations, or warnings).
6. Create the PR and tag relevant stakeholders for review.

Section Responsibility Matrix

Use the matrix below to determine section ownership and related tasks based on the release type:

Minor Release	Patch Release	Section	Owner	Doc Writer Tasks
✓	✓	Title and introduction	Doc Writer	Reuse previous content; update version numbers and documentation URLs.
✓	✓	Downloads	Release Captain	N/A
✓	✓	Installation	Doc Writer	Reuse previous content; update target version in documentation URLs.
✓	✓	Upgrades	Doc Writer	Reuse previous content; update target version in documentation URLs.
✓	✗	Highlights	Doc Writer	Draft descriptions for all GitHub issues labeled highlight; include doc, video, and issue links.
Cond.	Cond.	Deprecations and Removals	Doc Writer	Draft descriptions using information gathered from documentation PRs.
✗	Cond.	Security Fixes	Eng / PM	Edit draft content provided by stakeholders.
✓	✓	Features	Release Captain	N/A
✓	✓	Enhancements	Release Captain	N/A
✓	✓	Bug Fixes	Release Captain	N/A
✓	Cond.	Known Issues	Release Captain	N/A
✓	Cond.	Others	Release Captain	N/A
✓	✓	Components	Release Captain	N/A
✓	✓	Contributors	Release Captain	N/A

Legend:

• ✓ = Mandatory section for this release type
• ✗ = Omit for this release type
• Cond. = Conditional (include only if applicable or requested by stakeholders)

Release-Specific Content Examples

Installation (admonition)

Example (from v1.7.0):

> [!IMPORTANT]
> The Harvester installer checks if the hardware meets the [minimum requirements](https://docs.harvesterhci.io/v1.7/install/requirements/#hardware-requirements) for production use. If any of the checks fail, installation is stopped and warnings are printed to the system console. You can disable this behavior during iPXE installation (for testing purposes) by adding the kernel parameter [`harvester.install.skipchecks=true`](https://docs.harvesterhci.io/v1.7/install/pxe-boot-install#harvesterinstallskipcheckstrue) when you boot the system.
> Starting with v1.7.0, the installation process includes a mandatory step for configuring the login password for the default `rancher` user account.

Upgrades (admonition)

Example (from v1.8.1):

> [!IMPORTANT]
> When upgrading from v1.7 to v1.8, you may encounter an operating system image corruption issue if *all* of the following conditions are met:
> - Harvester v1.4.1 or earlier was originally installed.
> - A separate data disk is used.
> - The cluster has been continually upgraded in place.
> For more information, see issue [#10687](https://github.com/harvester/harvester/issues/10687).

Deprecations and Removals (descriptions)

Example (from v1.9.0):

### `ssl-parameters` Setting
The `ssl-parameters` setting for the Ingress NGINX Controller (`ingress-nginx`) is deprecated in Harvester v1.9.0 and replaced with the `traefik-default-tls-options` setting, which applies default [TLS options](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-options/) for the Traefik Ingress Controller.

### `striped` Volume Type
The `striped` volume type is deprecated and excluded from the LVM CSI general availability (GA) support scope. You must use a `dm-thin` StorageClass for all LVM storage. Because existing striped volumes cannot be converted to dm-thin in place, you must migrate data from existing striped volumes before upgrading to a Harvester version that removes support for this volume type.

Security Fixes (descriptions)

Example (from v1.7.3 and v1.8.2):

This release addresses security vulnerabilities in the following underlying components:

- **Operating system (SUSE Linux Micro)**: The BaseOS image was updated with the latest SUSE security patches for the Linux kernel, resolving several use-after-free vulnerabilities that could allow privilege escalation ([#11209](https://github.com/harvester/harvester/issues/11209)). For more information, see [CVE-2026-53359](https://www.suse.com/security/cve/CVE-2026-53359.html), [CVE-2026-43499](https://www.suse.com/security/cve/CVE-2026-43499.html), and [CVE-2026-46242](https://www.suse.com/security/cve/CVE-2026-46242.html).
- **etcd (RKE2)**: RKE2 was updated to include a patched etcd version that resolves a denial-of-service vulnerability in the etcd TLS listener ([GHSA-6vch-q96h-7gc3](https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3)). This vulnerability could exhaust server memory and render the control plane or cluster unavailable.
- **virt-handler (KubeVirt)**: The `virt-handler` service now strictly validates virtual machine console socket file targets to prevent improper symlink resolution. This prevents authenticated users with namespace edit permissions from replacing console sockets with symlinks to host container runtime sockets (such as CRI-O), which could allow attackers to hijack privileged host connections and gain full node or cluster control. For more information, see [CVE-2026-7374](https://www.suse.com/security/cve/CVE-2026-7374.html).