PaxMachinaOne · Oct 22, 2026 · Oct 22, 2026
diff --git a/addons/processors/iceberg-processor/Dockerfile b/addons/processors/iceberg-processor/Dockerfile
@@ -26,7 +26,7 @@ RUN if [ "${USE_LOCAL_PLATFORM}" != "1" ]; then \
       go mod edit -dropreplace github.com/KafScale/platform || true; \
     fi
 RUN if [ "${USE_LOCAL_PLATFORM}" != "1" ]; then \
-      go mod download github.com/KafScale/platform@v1.6.2 || true; \
+      go mod download github.com/KafScale/platform@v1.6.3 || true; \
     fi
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \

diff --git a/addons/processors/iceberg-processor/deploy/helm/iceberg-processor/Chart.yaml b/addons/processors/iceberg-processor/deploy/helm/iceberg-processor/Chart.yaml
@@ -17,5 +17,5 @@ apiVersion: v2
 name: iceberg-processor
 description: Storage-native Iceberg processor for Kafscale segments
 type: application
-version: 0.1.2
-appVersion: "v1.6.2"
+version: 0.1.3
+appVersion: "v1.6.3"
diff --git a/addons/processors/iceberg-processor/go.mod b/addons/processors/iceberg-processor/go.mod
@@ -5,7 +5,7 @@ go 1.25.2
 toolchain go1.26.10
 
 require (
-	github.com/KafScale/platform v1.6.2
+	github.com/KafScale/platform v1.6.3
 	github.com/apache/arrow-go/v18 v18.4.1
 	github.com/apache/iceberg-go v0.4.0
 	github.com/aws/aws-sdk-go-v2 v1.41.5

diff --git a/addons/processors/skeleton/deploy/helm/skeleton-processor/Chart.yaml b/addons/processors/skeleton/deploy/helm/skeleton-processor/Chart.yaml
@@ -17,5 +17,5 @@ apiVersion: v2
 name: skeleton-processor
 description: Storage-native processor skeleton for Kafscale segments
 type: application
-version: 0.1.2
-appVersion: "v1.6.2"
+version: 0.1.3
+appVersion: "v1.6.3"
diff --git a/addons/processors/sql-processor/deploy/helm/sql-processor/Chart.yaml b/addons/processors/sql-processor/deploy/helm/sql-processor/Chart.yaml
@@ -17,5 +17,5 @@ apiVersion: v2
 name: sql-processor
 description: SQL processor for querying Kafscale segments in S3
 type: application
-version: 0.1.2
-appVersion: "v1.6.2"
+version: 0.1.3
+appVersion: "v1.6.3"
diff --git a/deploy/docker-compose/README.md b/deploy/docker-compose/README.md
@@ -228,7 +228,7 @@ Override these in `docker-compose.yaml` or via your own `.env.local` if needed.
 ### Override Registry/Tag
 
 ```bash
-REGISTRY=my-registry.local:5000 TAG=v1.6.2 docker-compose up -d
+REGISTRY=my-registry.local:5000 TAG=v1.6.3 docker-compose up -d
 ```
 
 ## Architecture

diff --git a/deploy/helm/kafscale/Chart.yaml b/deploy/helm/kafscale/Chart.yaml
@@ -19,5 +19,5 @@ description: Helm chart for the Kafscale operator and console
 home: https://github.com/KafScale/platform
 icon: https://raw.githubusercontent.com/KafScale/platform/main/docs/assets/icon.png
 type: application
-version: 0.4.5
-appVersion: "v1.6.2"
+version: 0.4.6
+appVersion: "v1.6.3"
diff --git a/docs/operations.md b/docs/operations.md
@@ -50,7 +50,7 @@ spec:
   brokers:
     image:
       repository: ghcr.io/kafscale/kafscale-broker
-      tag: v1.6.2
+      tag: v1.6.3
 ```
 
 Omitting the image keeps the operator default. A repository without a tag is used

diff --git a/docs/releases/v1.6.3.md b/docs/releases/v1.6.3.md
@@ -0,0 +1,47 @@
+<!--
+Copyright 2026 Alexander Alten (novatechflow), NovaTechflow (novatechflow.com).
+This project is supported and financed by Scalytics, Inc. (www.scalytics.io).
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# v1.6.3
+
+Release date: 2026-10-22
+
+## Highlights
+
+- Built with Go 1.26.10, which fixes CVE-2026-111943 in crypto/x509 (#208).
+- gRPC 1.83.2 and other dependency updates that resolve the open Dependabot alerts (#198, #201).
+
+## Upgrade notes
+
+- The main Helm chart is version `0.4.6`; processor charts are version `0.1.3`. All charts default to application images tagged `v1.6.3`.
+- No CRD or configuration changes since v1.6.2.
+
+## Bug fixes
+
+- None.
+
+## Security fixes
+
+- CVE-2026-111943 (GO-2026-6809): every Go binary and image is built with Go 1.26.10. Certificate.Verify in crypto/x509 now rejects a list of compromised intermediate certificates (#208).
+- GHSA-2v4p-qf9q-27wj: gRPC 1.83.2 in the platform, SQL processor and Iceberg processor (#201).
+- Updated gRPC, OpenTelemetry, Thrift, WebSocket and SDK dependencies for the open Dependabot alerts (#198).
+
+## Maintenance
+
+- The coverage gate fails when coverage drops below the floor, and the coverage badge is published to gh-pages (#199, #200, #202, #203, #204, #205).
+- README lists related projects (#207). The compose registry example uses the release tag (#195).
+
+[Full changelog](https://github.com/KafScale/platform/compare/v1.6.2...v1.6.3)