Kubernetes v1.34.11 was published on 20 August 2026. The patch rebuilds the 1.34 line with Go 1.26 and bumps golang.org/x/text and golang.org/x/net for security fixes. There are no API changes and no new kubelet flags.
The full release notes and downloads are on the GitHub release page. The GitHub tag body is a stub. Hashes, image lists, and the two changelog entries live in CHANGELOG-1.34.md. Announce mail goes to kubernetes-announce.
Built with Go 1.26 ¶
Pull request #140919 moved the release-1.34 branch to Go 1.26 and fixed gomock compile errors. The changelog line is one sentence. Kubernetes 1.34 is now built with Go 1.26. The pull request is more specific. The toolchain pin is Go 1.26.5, plus mock regen and import order churn in generated files.
For operators this is a rebuild, not a config change. kube-apiserver, kube-controller-manager, kube-scheduler, kube-proxy, and kubelet all ship from that pin. Container images at registry.k8s.io are tagged v1.34.11 as manifest lists for amd64, arm64, ppc64le, and s390x. The same tag is on kubectl and conformance.
If you vendor k8s.io packages from this tag, the module graph now wants a Go 1.26 toolchain. That is the point of the bump. The gomock work is test scaffolding. It does not change scheduler scoring, admission, or CSI publish paths.
Security updates in text and net ¶
The second changelog entry is pull request #141224. It updates golang.org/x/text and golang.org/x/net for security fixes. Landed versions in the changelog are golang.org/x/text v0.23.0 to v0.39.0 and golang.org/x/net v0.38.0 to v0.56.0.
The pull request that produced that line names GO-2026-5970 on golang.org/x/text and GO-2026-5026 on golang.org/x/net. The first is an infinite loop in unicode normalization when the input has invalid UTF-8. The second is Punycode label handling in golang.org/x/net/idna. The changelog does not spell those IDs out. Image scanners will.
This is a vendor bump, not a new Kubernetes feature. The blast radius is wide because vendor/ is shared. SIG tags on the entry include API Machinery, Auth, CLI, Network, Node, Scheduling, Security, and Storage. Rolling only the apiserver leaves kubelet and kube-proxy on the old copies.
There is a build tradeoff. The new golang.org/x modules want Go 1.25 as a floor. Compatibility jobs that still built client-go 1.34 patches on Go 1.24 failed. The security bump won. If you still compile against this branch with Go 1.24, that path is closed.
Companion golang.org/x versions ¶
The security bump pulled the rest of the golang.org/x set. The changelog records:
golang.org/x/cryptov0.36.0 to v0.53.0golang.org/x/modv0.21.0 to v0.37.0golang.org/x/syncv0.12.0 to v0.21.0golang.org/x/sysv0.31.0 to v0.46.0golang.org/x/termv0.30.0 to v0.44.0golang.org/x/toolsv0.26.0 to v0.47.0
Two modules were added. golang.org/x/tools/go/expect and golang.org/x/tools/go/packages/packagestest land at the v0.1.1-deprecated tag. Those are toolchain test helpers pulled in by the tools bump. They are not a new Kubernetes API. Nothing was removed.
Most of this section is go.mod noise. Treat it as such. The operator visible part is the two security packages and the Go 1.26 rebuild. The rest is what go mod tidy does when those two move.
Upgrade notes ¶
v1.34.11 has no urgent upgrade block. Nothing in this patch changes flags, APIs, or storage versions. It is a final patch, not a release candidate.
Still treat it as a control plane and node roll. Image tags move. SHA512 hashes in CHANGELOG-1.34.md are the checksums to pin for kubernetes.tar.gz, server tarballs, and node tarballs. If your scanner gates on golang.org/x/net or golang.org/x/text, this is the 1.34 tag that clears the copies shipped in v1.34.10.
The GitHub release page does not list CVEs. Read the changelog, then confirm the image digest you actually run matches registry.k8s.io/kube-apiserver:v1.34.11 (and the sibling images) from that file.