Overall status: RECOMMENDED

Cautions

N/A

Changes

This release bumps dependencies but has no functional changes from edge-26.7.1.

What's Changed

• build(deps): bump linkerd-extension-init to v0.1.12 by @alpeb in #15497
• proxy: v2.363.0 by @l5d-bot in #15502
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #15500
• build(deps): bump github.com/go-openapi/spec from 0.22.6 to 0.22.9 by @dependabot[bot] in #15498
• build(deps): bump @fortawesome/free-solid-svg-icons from 7.3.0 to 7.3.1 in /web/app by @dependabot[bot] in #15494
• build(deps-dev): bump webpack-bundle-analyzer from 5.3.0 to 5.3.1 in /web/app by @dependabot[bot] in #15491
• build(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 by @dependabot[bot] in #15488
• build(deps): bump http-body-util from 0.1.3 to 0.1.4 by @dependabot[bot] in #15485
• build(deps): bump bitflags from 2.13.0 to 2.13.1 by @dependabot[bot] in #15484
• build(deps): bump http-body from 1.0.1 to 1.1.0 by @dependabot[bot] in #15483
• build(deps): bump zmij from 1.0.22 to 1.0.23 by @dependabot[bot] in #15482
• build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in #15481
• build(deps): bump zerocopy from 0.8.54 to 0.8.55 by @dependabot[bot] in #15512
• build(deps): bump the pest group with 4 updates by @dependabot[bot] in #15511
• build(deps): bump the futures group with 8 updates by @dependabot[bot] in #15509
• build(deps): bump github.com/prometheus/common from 0.70.0 to 0.70.1 by @dependabot[bot] in #15508
• build(deps): bump shell-quote from 1.8.4 to 1.10.0 in /web/app by @dependabot[bot] in #15504
• build(deps): bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 by @dependabot[bot] in #15495
• build(deps): bump @fortawesome/fontawesome-svg-core from 7.3.0 to 7.3.1 in /web/app by @dependabot[bot] in #15493
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #15486
• build(deps): bump postcss from 8.5.10 to 8.5.22 in /web/app by @dependabot[bot] in #15514
• build(deps): bump @fortawesome/free-regular-svg-icons from 7.3.0 to 7.3.1 in /web/app by @dependabot[bot] in #15492
• build(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 by @dependabot[bot] in #15499
• build(deps): bump docker/login-action from 4.4.0 to 4.5.0 by @dependabot[bot] in #15522
• build(deps): bump fastrand from 2.4.1 to 2.5.0 by @dependabot[bot] in #15521
• build(deps): bump cc from 1.2.67 to 1.3.0 by @dependabot[bot] in #15520
• build(deps): bump regex from 1.13.0 to 1.13.1 by @dependabot[bot] in #15519
• build(deps): bump tokio-macros from 2.7.0 to 2.7.1 by @dependabot[bot] in #15518
• build(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 by @dependabot[bot] in #15517
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #15515
• build(deps): bump github.com/mattn/go-runewidth from 0.0.24 to 0.0.27 by @dependabot[bot] in #15516

Full Changelog: edge-26.7.1...edge-26.7.2

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release uses the trust domain rather than the cluster domain for the expected tracing collector identity, updates the CNI plugin to be smarter about finding IPtables binaries, and correctly checks for Gateway API when installing with Helm, and prevents routing to undefined ports on a Service even when a ServiceProfile is present. It also updates the Apache license link in the README to use HTTPS (thanks, Milo!) and corrects the error message when checking an RSA trust anchor with an unsupported key size (thanks, Immanuel Tikhonov!).

What's Changed

• chore(deps): upgrade containerd by @adleong in #15405
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #15408
• build(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 in /web/app by @dependabot[bot] in #15406
• build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 by @dependabot[bot] in #15403
• build(deps-dev): bump @babel/runtime from 7.29.7 to 8.0.0 in /web/app by @dependabot[bot] in #15399
• build(deps): bump github.com/prometheus/common from 0.68.1 to 0.69.0 by @dependabot[bot] in #15395
• build(deps): bump github.com/go-openapi/spec from 0.22.5 to 0.22.6 by @dependabot[bot] in #15382
• build(deps-dev): bump webpack-dev-server from 5.2.4 to 5.2.5 in /web/app by @dependabot[bot] in #15381
• build(deps): bump @babel/eslint-plugin from 7.27.1 to 7.29.7 in /web/app by @dependabot[bot] in #15379
• build(deps): bump log from 0.4.32 to 0.4.33 by @dependabot[bot] in #15402
• build(deps): bump cc from 1.2.64 to 1.2.65 by @dependabot[bot] in #15401
• build(deps): bump bytes from 1.11.1 to 1.12.0 by @dependabot[bot] in #15396
• build(deps): bump wasip2 from 1.0.3+wasi-0.2.9 to 1.0.4+wasi-0.2.12 by @dependabot[bot] in #15387
• build(deps-dev): bump @babel/preset-react from 7.28.5 to 7.29.7 in /web/app by @dependabot[bot] in #15380
• fix(proxy): build trace-collector identity from trust domain, not cluster domain by @joedrf in #15404
• chore(test): explicit registry for ducker hub images by @alpeb in #15407
• build(deps): update go to 1.26.4 by @alpeb in #15278
• build(deps): bump @fortawesome/free-regular-svg-icons from 7.2.0 to 7.3.0 in /web/app by @dependabot[bot] in #15421
• build(deps-dev): bump webpack-cli from 7.0.3 to 7.1.0 in /web/app by @dependabot[bot] in #15418
• build(deps-dev): bump webpack from 5.107.2 to 5.108.1 in /web/app by @dependabot[bot] in #15417
• build(deps): bump rustls from 0.23.40 to 0.23.41 by @dependabot[bot] in #15413
• build(deps): bump quote from 1.0.45 to 1.0.46 by @dependabot[bot] in #15412
• build(deps): bump chacha20 from 0.10.0 to 0.10.1 by @dependabot[bot] in #15410
• build(deps): bump @fortawesome/fontawesome-svg-core from 7.2.0 to 7.3.0 in /web/app by @dependabot[bot] in #15419
• build(deps): bump hyper-http-proxy from 1.1.0 to 1.1.1 by @dependabot[bot] in #15411
• build(deps): bump @fortawesome/free-solid-svg-icons from 7.2.0 to 7.3.0 in /web/app by @dependabot[bot] in #15420
• chore(build): bump dev container to v50 by @alpeb in #15423
• build(deps): bump golang.org/x/tools from 0.46.0 to 0.47.0 by @dependabot[bot] in #15416
• build(deps): bump helm.sh/helm/v3 from 3.21.0 to 3.21.2 by @dependabot[bot] in #15400
• proxy: v2.360.0 by @l5d-bot in #15430
• build(deps): bump the kube group with 2 updates by @dependabot[bot] in #15424
• build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #15425
• build(deps): bump enum-ordinalize from 4.3.2 to 4.4.1 by @dependabot[bot] in #15428
• build(deps): bump core-foundation from 0.10.0 to 0.10.1 by @dependabot[bot] in #15426
• build(deps): bump aws-lc-rs from 1.17.0 to 1.17.1 by @dependabot[bot] in #15429
• build(deps): bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #15431
• build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 in /.github/actions/docker-build by @dependabot[bot] in #15432
• chore(deps): bump anyhow from 1.0.102 to 1.0.103 by @cratelyn in #15434
• refactor(deps): use linkerd-kubert git dependencies by @cratelyn in #15433
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 in /.github/actions/docker-build by @dependabot[bot] in #15441
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #15440
• build(deps): bump docker/login-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #15439
• build(deps): bump rustls-native-certs from 0.8.1 to 0.8.4 by @dependabot[bot] in #15435
• build(deps): bump security-framework from 3.2.0 to 3.7.0 by @dependabot[bot] in #15436
• build(deps): bump rand from 0.10.1 to 0.10.2 by @dependabot[bot] in #15437
• build(deps): bump rustls-pki-types from 1.14.1 to 1.15.0 by @dependabot[bot] in #15438
• build(deps): bump DavidAnson/markdownlint-cli2-action from 23.2.0 to 24.0.0 by @dependabot[bot] in #15448
• build(deps): bump docker/login-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #15447
• build(deps-dev): bump webpack from 5.108.1 to 5.108.4 in /web/app by @dependabot[bot] in #15445
• build(deps): bump query-string from 9.4.0 to 9.4.1 in /web/app by @dependabot[bot] in #15443
• build(deps): bump the pest group with 4 updates by @dependabot[bot] in #15449
• build(deps): bump crossbeam-utils from 0.8.21 to 0.8.22 by @dependabot[bot] in #15450
• build(deps): bump cc from 1.2.65 to 1.2.66 by @dependabot[bot] in #15451
• build(deps): bump jobserver from 0.1.32 to 0.1.35 by @dependabot[bot] in #15452
• build(deps): bump memchr from 2.8.2 to 2.8.3 by @dependabot[bot] in #15453
• build(deps): bump zerocopy from 0.8.52 to 0.8.53 by @dependabot[bot] in #15454
• proxy: v2.361.0 by @l5d-bot in #15455
• chore(deps): bump kubert from 0.25.0 to 0.26.0 by @cratelyn in #15456
• build(deps): bump zerocopy from 0.8.53 to 0.8.54 by @dependabot[bot] in #15458
• build(deps): bump bytes from 1.12.0 to 1.12.1 by @dependabot[bot] in #15459
• feat(cni-plugin): update version by @raykroeker in #15457
• build(deps): bump regex from 1.12.4 to 1.13.0 by @dependabot[bot] in #15463
• build(deps): bump tokio-metrics from 0.5.0 to 0.5.1 by @dependabot[bot] in #15464
• build(deps): bump regex-automata from 0.4.14 to 0.4.15 by @dependabot[bot] in #15465
• build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #15472
• build(deps): bump sha1 from 0.10.6 to 0.10.7 by @dependabot[bot] in #15470
• build(deps): bump zmij from 1.0.21 to 1.0.22 by @dependabot[bot] in #15469
• build(deps): bump thread_local from 1.1.9 to 1.1.10 by @dependabot[bot] in #15468
• build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.0 by @dependabot[bot] in #15466
• build(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 by @dependabot[bot] in #15462
• build(deps): bump helm.sh/helm/v3 from 3.21.2 to 3.21.3 by @dependabot[bot] in #15461
• build(deps): bump ws from 8.19.0 to 8.21.0 in /web/app by @dependabot[bot] in https://github.com/linkerd/linkerd2/pul...

Overall status: RECOMMENDED

Cautions

N/A

Changes

This edge release closes out functionality for Linkerd 2.20 by fully-enabling rate limit aware load balancing!

What's Changed

• proxy: v2.358.0 by @l5d-bot in #15389
• build(deps): bump zeroize from 1.8.2 to 1.9.0 by @dependabot[bot] in #15384
• build(deps): bump cc from 1.2.63 to 1.2.64 by @dependabot[bot] in #15385
• build(deps): bump openssl-sys from 0.9.116 to 0.9.117 by @dependabot[bot] in #15386
• build(deps): bump openssl from 0.10.80 to 0.10.81 by @dependabot[bot] in #15388
• build(deps): bump syn from 2.0.117 to 2.0.118 by @dependabot[bot] in #15390
• build(deps): bump h2 from 0.4.14 to 0.4.15 by @dependabot[bot] in #15392
• proxy: v2.359.0 by @l5d-bot in #15394

Full Changelog: edge-26.6.2...edge-26.6.3

Overall status: NOT RECOMMENDED, use edge-26.6.3 instead

Cautions

This release limits ExternalWorkloads to only endpoints within their namespace only.

Changes

This release limits ExternalWorkloads to only use endpoints within their namespace only. It also adds support for annotations for the new load balancing features arriving in edge-26.6.3.

What's Changed

• fix(policy): Remove Appropriate AuthN Policy by @raykroeker in #15326
• fix(profile): Add nil check to profile validation by @raykroeker in #15325
• build(deps): bump date-fns from 4.1.0 to 4.4.0 in /web/app by @dependabot[bot] in #15336
• build(deps-dev): bump webpack from 5.106.2 to 5.107.2 in /web/app by @dependabot[bot] in #15335
• fix(destination): Add namespace restriction to external workloads and endpoints by @raykroeker in #15324
• build(deps): bump chrono from 0.4.44 to 0.4.45 by @dependabot[bot] in #15355
• build(deps): bump log from 0.4.30 to 0.4.32 by @dependabot[bot] in #15356
• build(deps): bump bitflags from 2.12.1 to 2.13.0 by @dependabot[bot] in #15364
• build(deps-dev): bump @babel/core from 7.29.0 to 7.29.7 in /web/app by @dependabot[bot] in #15362
• build(deps-dev): bump @babel/runtime from 7.29.2 to 7.29.7 in /web/app by @dependabot[bot] in #15361
• build(deps): bump the grpc group with 3 updates by @dependabot[bot] in #15363
• build(deps): bump github.com/linkerd/linkerd2-proxy-api from 0.18.0 to 0.20.0 by @dependabot[bot] in #15348
• build(deps-dev): bump @babel/eslint-parser from 7.28.6 to 7.29.7 in /web/app by @dependabot[bot] in #15360
• build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #15322
• fix(policy-k8s): correct typos in outbound index by @unleashed in #15315
• build(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #15311
• build(deps): bump dessant/lock-threads from 6.0.0 to 6.0.2 by @dependabot[bot] in #15310
• build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #15291
• build(deps): bump dev container to v49 by @alpeb in #15287
• build(deps-dev): bump babel-jest from 30.3.0 to 30.4.1 in /web/app by @dependabot[bot] in #15281
• build(deps): bump DavidAnson/markdownlint-cli2-action from 23.0.0 to 23.2.0 by @dependabot[bot] in #15241
• tests: repurpose deep-native-sidecar as deep-non-native-sidecar by @alpeb in #15279
• build(deps-dev): bump @babel/preset-env from 7.29.5 to 7.29.7 in /web/app by @dependabot[bot] in #15359
• build(deps): bump linkerd2-proxy-api from 0.18.0 to 0.20.0 by @dependabot[bot] in #15353
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #15366
• build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #15367
• build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 in /.github/actions/docker-build by @dependabot[bot] in #15368
• proxy: v2.357.0 by @l5d-bot in #15372
• build(deps): bump regex-syntax from 0.8.10 to 0.8.11 by @dependabot[bot] in #15369
• build(deps): bump zerocopy from 0.8.50 to 0.8.52 by @dependabot[bot] in #15370
• build(deps): bump regex from 1.12.3 to 1.12.4 by @dependabot[bot] in #15371
• feat(policy): unified failure accrual and response-penalty load biasing by @unleashed in #15374
• build(deps): bump smallvec from 1.15.1 to 1.15.2 by @dependabot[bot] in #15376
• build(deps): bump memchr from 2.8.1 to 2.8.2 by @dependabot[bot] in #15377
• build(deps): bump golang.org/x/tools from 0.45.0 to 0.46.0 by @dependabot[bot] in #15375
• chore(build): update golang to 1.25.11 by @arichardet in #15378

Full Changelog: edge-26.6.1...edge-26.6.2

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release fixes an off-by-one error that would incorrectly reject an HTTP body that was exactly the size of the configured limit (e.g., setting the cap to 1MiB would actually allow one byte less than 1MiB – thanks, Immanuel Tikhonov!).

What's Changed

• build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 by @dependabot[bot] in #15338
• build(deps): bump github.com/mattn/go-runewidth from 0.0.23 to 0.0.24 by @dependabot[bot] in #15337
• build(deps): bump typenum from 1.20.0 to 1.20.1 by @dependabot[bot] in #15339
• build(deps): bump cc from 1.2.62 to 1.2.63 by @dependabot[bot] in #15340
• build(deps): bump zerocopy from 0.8.49 to 0.8.50 by @dependabot[bot] in #15342
• build(deps): bump hyper from 1.10.0 to 1.10.1 by @dependabot[bot] in #15341
• build(deps-dev): bump webpack-cli from 7.0.2 to 7.0.3 in /web/app by @dependabot[bot] in #15333
• build(deps): bump query-string from 9.3.1 to 9.4.0 in /web/app by @dependabot[bot] in #15334
• proxy: v2.355.0 by @l5d-bot in #15346
• build(deps): bump bitflags from 2.11.1 to 2.12.1 by @dependabot[bot] in #15352
• Allow ReadAllLimit inputs at byte limit by @immanuwell in #15301
• proxy: v2.356.0 by @l5d-bot in #15357
• build(deps): bump launch-editor from 2.6.1 to 2.14.1 in /web/app by @dependabot[bot] in #15347
• build(deps): bump github.com/go-openapi/spec from 0.22.4 to 0.22.5 by @dependabot[bot] in #15349
• build(deps): bump github.com/prometheus/common from 0.68.0 to 0.68.1 by @dependabot[bot] in #15350

Full Changelog: edge-26.5.5...edge-26.6.1

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release bumps dependencies but has no functional changes from edge-26.5.4.

What's Changed

• build(deps): bump mio from 1.2.0 to 1.2.1 by @dependabot[bot] in #15330
• build(deps): bump socket2 from 0.6.3 to 0.6.4 by @dependabot[bot] in #15331
• chore(deps): upgrade proxy-init to v2.4.9 & cni-plugin to v1.6.8 by @arichardet in #15332

Full Changelog: edge-26.5.4...edge-26.5.5

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release fixes labeling for warning messages regarding EgressNetworks, correctly using the egress_network label rather than service. It also makes sure that debug messages use named labels rather than bare values.

What's Changed

• build(deps-dev): bump webpack-dev-server from 5.2.3 to 5.2.4 in /web/app by @dependabot[bot] in #15282
• build(deps): bump either from 1.15.0 to 1.16.0 by @dependabot[bot] in #15300
• build(deps): bump serde_json from 1.0.149 to 1.0.150 in the serde group by @dependabot[bot] in #15303
• build(deps): bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #15304
• build(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32 by @dependabot[bot] in #15302
• build(deps): bump log from 0.4.29 to 0.4.30 by @dependabot[bot] in #15313
• build(deps): bump autocfg from 1.5.0 to 1.5.1 by @dependabot[bot] in #15308
• build(deps): bump bumpalo from 3.20.2 to 3.20.3 by @dependabot[bot] in #15309
• build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 in /.github/actions/docker-build by @dependabot[bot] in #15312
• proxy: v2.354.0 by @l5d-bot in #15323
• build(deps): bump memchr from 2.8.0 to 2.8.1 by @dependabot[bot] in #15321
• chore: update linkerd-await from 0.3.2 to 0.3.3 by @cratelyn in #15329
• build(deps): bump hyper from 1.9.0 to 1.10.0 by @dependabot[bot] in #15327
• build(deps): bump zerocopy from 0.8.48 to 0.8.49 by @dependabot[bot] in #15328
• fix(policy-k8s): use correct resource labels in outbound indexer logs by @unleashed in #15314

Full Changelog: edge-26.5.3...edge-26.5.4

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release bumps dependencies but has no functional changes from edge-26.5.2.

What's Changed

• build(deps): bump openssl from 0.10.79 to 0.10.80 by @dependabot[bot] in #15285
• build(deps): bump tower-http from 0.6.10 to 0.6.11 by @dependabot[bot] in #15290
• proxy: v2.353.0 by @l5d-bot in #15296

Full Changelog: edge-26.5.2...edge-26.5.3

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release promotes native sidecars to GA and makes them the default. To disable native sidecars, set the config.linkerd.io/proxy-enable-native-sidecar annotation to false.

It also fixes a potential race in updating the status of remote cluster gateways (fixing #15096 - thanks, Asish Kumar!), prevents Servers from affecting workloads in other namespaces (fixing #15223), fixes a number of CVEs in Go 1.25.9, improves tests for port-range parsing (thanks, Immanuel Tikhonov!), and supports optionally configuring scraping to tolerate duplicate timestamps using the podMonitor.proxy.honorTimestamps and podMonitor.serviceMirror.honorTimestamps values for the linkerd-control-plane chart (fixing #14905 – thanks, beza!).

CVEs fixed: CVE-2026-42501, CVE-2026-42499, CVE-2026-39836, CVE-2026-39826, CVE-2026-39825, CVE-2026-39823, CVE-2026-39820, CVE-2026-39819, CVE-2026-39817, CVE-2026-33814, CVE-2026-33811

What's Changed

• proxy: v2.351.0 by @l5d-bot in #15229
• build(deps): bump json-patch from 4.1.0 to 4.2.0 by @dependabot[bot] in #15227
• build(deps): bump openssl-sys from 0.9.114 to 0.9.115 by @dependabot[bot] in #15232
• build(deps): bump rustls from 0.23.37 to 0.23.40 by @dependabot[bot] in #15224
• build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 by @dependabot[bot] in #15233
• build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #15234
• build(deps): bump openssl from 0.10.78 to 0.10.79 by @dependabot[bot] in #15235
• build(deps): bump tokio from 1.52.1 to 1.52.2 by @dependabot[bot] in #15236
• chore: upgrade to network-validator 0.1.9 by @adleong in #15240
• build(deps): bump h2 from 0.4.13 to 0.4.14 by @dependabot[bot] in #15237
• build(deps): bump pin-project from 1.1.11 to 1.1.12 by @dependabot[bot] in #15238
• build(deps): bump tower-http from 0.6.8 to 0.6.9 by @dependabot[bot] in #15239
• build(deps): bump postcss from 8.5.6 to 8.5.10 in /web/app by @dependabot[bot] in #15208
• build(deps-dev): bump @babel/preset-env from 7.29.2 to 7.29.3 in /web/app by @dependabot[bot] in #15231
• build(deps-dev): bump eslint-plugin-promise from 7.2.1 to 7.3.0 in /web/app by @dependabot[bot] in #15230
• build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 by @dependabot[bot] in #15214
• build(deps): bump data-encoding from 2.10.0 to 2.11.0 by @dependabot[bot] in #15211
• build(deps): bump wasip2 from 1.0.2+wasi-0.2.9 to 1.0.3+wasi-0.2.9 by @dependabot[bot] in #15209
• Synchronize gateway liveness (#15096) by @officialasishkumar in #15150
• fix(destination): Restrict Servers from affecting workloads in other namespaces by @adleong in #15243
• build(deps): bump tower-http from 0.6.9 to 0.6.10 by @dependabot[bot] in #15245
• build(deps): bump tonic from 0.14.5 to 0.14.6 in the grpc group by @dependabot[bot] in #15244
• chore: update golang to 1.25.10 by @cratelyn in #15265
• build(deps): bump cc from 1.2.61 to 1.2.62 by @dependabot[bot] in #15258
• build(deps): bump tokio from 1.52.2 to 1.52.3 by @dependabot[bot] in #15259
• build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 by @dependabot[bot] in #15256
• feat: promote native sidecars to GA and enable by default by @alpeb in #15267
• build(deps): bump google.golang.org/grpc/cmd/protoc-gen-go-grpc from 1.6.1 to 1.6.2 by @dependabot[bot] in #15270
• build(deps-dev): bump jest-environment-jsdom from 30.3.0 to 30.4.1 in /web/app by @dependabot[bot] in #15254
• build(deps-dev): bump @babel/preset-env from 7.29.3 to 7.29.5 in /web/app by @dependabot[bot] in #15253
• build(deps-dev): bump sinon from 21.1.2 to 22.0.0 in /web/app by @dependabot[bot] in #15251
• proxy: v2.352.0 by @l5d-bot in #15272
• build(deps-dev): bump jest from 30.3.0 to 30.4.2 in /web/app by @dependabot[bot] in #15252
• build(deps): bump helm.sh/helm/v3 from 3.20.2 to 3.21.0 by @dependabot[bot] in #15275
• build(deps): bump aws-lc-rs from 1.16.3 to 1.17.0 by @dependabot[bot] in #15276
• build(deps): bump pin-project from 1.1.12 to 1.1.13 by @dependabot[bot] in #15277
• build(deps): bump tonic-prost from 0.14.5 to 0.14.6 by @dependabot[bot] in #15260
• test: assert parsed port ranges by @immanuwell in #15264
• build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #15280
• charts: make honorTimestamps configurable for linkerd-proxy PodMonitor by @bezarsnba in #15080

New Contributors

• @officialasishkumar made their first contribution in #15150
• @immanuwell made their first contribution in #15264

Full Changelog: edge-26.5.1...edge-26.5.2

Overall status: RECOMMENDED

Cautions

The minimum supported Kubernetes version for this and future releases is 1.31.

Changes

This release significantly reduces the amount of memory used by the destination controller on busy systems. It also allows setting the node port for the health check of a Linkerd multicluster gateway (fixing issue #15172 – thanks, Aldo Fuster Turpin!), cleans up some CI permissions (fixing issue #15182 – thanks, Gagan H R!), and correctly handles mirroring headless Services with the same name in different namespaces (fixing issue #15200 – thanks, Cody Bond!). Finally, it corrects the instructions about how to install the Gateway API CRDs when linkerd install --crds detects that they are missing, and bumps the minimum supported Kubernetes version to 1.31.

What's Changed

• build(deps): bump pkg-config from 0.3.32 to 0.3.33 by @dependabot[bot] in #15206
• build(deps): bump aws-lc-rs from 1.16.2 to 1.16.3 by @dependabot[bot] in #15205
• build(deps): bump hyper-rustls from 0.27.7 to 0.27.9 by @dependabot[bot] in #15204
• build(deps): bump axum from 0.8.8 to 0.8.9 by @dependabot[bot] in #15194
• refactor(destination): implement shared-filtering by @adleong in #15166
• build(deps): bump rustls-webpki from 0.103.12 to 0.103.13 by @dependabot[bot] in #15207
• build(deps): bump hyper from 1.8.1 to 1.9.0 by @dependabot[bot] in #15113
• build(deps): bump libc from 0.2.185 to 0.2.186 by @dependabot[bot] in #15210
• feat: add gateway.healthCheckNodePort Helm value by @AldoFusterTurpin in #15174
• chore: update extension-init to 0.1.11 by @cratelyn in #15220
• fix(CLI): correct gateway api version in user instructions by @adleong in #15213
• fix(multicluster): make service cleanup logic respect namespaces by @cbond-cohere in #15201
• fix: adding required permissions to top level and jobs in the workflow by @gaganhr94 in #15183
• build(deps): bump cc from 1.2.60 to 1.2.61 by @dependabot[bot] in #15215
• build(deps): bump tokio from 1.51.1 to 1.52.1 by @dependabot[bot] in #15216
• build(deps): bump rustls-pki-types from 1.14.0 to 1.14.1 by @dependabot[bot] in #15217
• chore: update MSKV to 1.31 by @adleong in #15221

New Contributors

• @AldoFusterTurpin made their first contribution in #15174
• @cbond-cohere made their first contribution in #15201
• @gaganhr94 made their first contribution in #15183

Full Changelog: edge-26.4.4...edge-26.5.1