What's Changed

• fix(policy): Remove Appropriate AuthN Policy by @raykroeker in #15326
• fix(profile): Add nil check to profile validation by @raykroeker in #15325
• build(deps): bump date-fns from 4.1.0 to 4.4.0 in /web/app by @dependabot[bot] in #15336
• build(deps-dev): bump webpack from 5.106.2 to 5.107.2 in /web/app by @dependabot[bot] in #15335
• fix(destination): Add namespace restriction to external workloads and endpoints by @raykroeker in #15324
• build(deps): bump chrono from 0.4.44 to 0.4.45 by @dependabot[bot] in #15355
• build(deps): bump log from 0.4.30 to 0.4.32 by @dependabot[bot] in #15356
• build(deps): bump bitflags from 2.12.1 to 2.13.0 by @dependabot[bot] in #15364
• build(deps-dev): bump @babel/core from 7.29.0 to 7.29.7 in /web/app by @dependabot[bot] in #15362
• build(deps-dev): bump @babel/runtime from 7.29.2 to 7.29.7 in /web/app by @dependabot[bot] in #15361
• build(deps): bump the grpc group with 3 updates by @dependabot[bot] in #15363
• build(deps): bump github.com/linkerd/linkerd2-proxy-api from 0.18.0 to 0.20.0 by @dependabot[bot] in #15348
• build(deps-dev): bump @babel/eslint-parser from 7.28.6 to 7.29.7 in /web/app by @dependabot[bot] in #15360
• build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #15322
• fix(policy-k8s): correct typos in outbound index by @unleashed in #15315
• build(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #15311
• build(deps): bump dessant/lock-threads from 6.0.0 to 6.0.2 by @dependabot[bot] in #15310
• build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #15291
• build(deps): bump dev container to v49 by @alpeb in #15287
• build(deps-dev): bump babel-jest from 30.3.0 to 30.4.1 in /web/app by @dependabot[bot] in #15281
• build(deps): bump DavidAnson/markdownlint-cli2-action from 23.0.0 to 23.2.0 by @dependabot[bot] in #15241
• tests: repurpose deep-native-sidecar as deep-non-native-sidecar by @alpeb in #15279
• build(deps-dev): bump @babel/preset-env from 7.29.5 to 7.29.7 in /web/app by @dependabot[bot] in #15359
• build(deps): bump linkerd2-proxy-api from 0.18.0 to 0.20.0 by @dependabot[bot] in #15353
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #15366
• build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #15367
• build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 in /.github/actions/docker-build by @dependabot[bot] in #15368
• proxy: v2.357.0 by @l5d-bot in #15372
• build(deps): bump regex-syntax from 0.8.10 to 0.8.11 by @dependabot[bot] in #15369
• build(deps): bump zerocopy from 0.8.50 to 0.8.52 by @dependabot[bot] in #15370
• build(deps): bump regex from 1.12.3 to 1.12.4 by @dependabot[bot] in #15371
• feat(policy): unified failure accrual and response-penalty load biasing by @unleashed in #15374
• build(deps): bump smallvec from 1.15.1 to 1.15.2 by @dependabot[bot] in #15376
• build(deps): bump memchr from 2.8.1 to 2.8.2 by @dependabot[bot] in #15377
• build(deps): bump golang.org/x/tools from 0.45.0 to 0.46.0 by @dependabot[bot] in #15375
• chore(build): update golang to 1.25.11 by @arichardet in #15378

Full Changelog: edge-26.6.1...edge-26.6.2

What's Changed

• build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 by @dependabot[bot] in #15338
• build(deps): bump github.com/mattn/go-runewidth from 0.0.23 to 0.0.24 by @dependabot[bot] in #15337
• build(deps): bump typenum from 1.20.0 to 1.20.1 by @dependabot[bot] in #15339
• build(deps): bump cc from 1.2.62 to 1.2.63 by @dependabot[bot] in #15340
• build(deps): bump zerocopy from 0.8.49 to 0.8.50 by @dependabot[bot] in #15342
• build(deps): bump hyper from 1.10.0 to 1.10.1 by @dependabot[bot] in #15341
• build(deps-dev): bump webpack-cli from 7.0.2 to 7.0.3 in /web/app by @dependabot[bot] in #15333
• build(deps): bump query-string from 9.3.1 to 9.4.0 in /web/app by @dependabot[bot] in #15334
• proxy: v2.355.0 by @l5d-bot in #15346
• build(deps): bump bitflags from 2.11.1 to 2.12.1 by @dependabot[bot] in #15352
• Allow ReadAllLimit inputs at byte limit by @immanuwell in #15301
• proxy: v2.356.0 by @l5d-bot in #15357
• build(deps): bump launch-editor from 2.6.1 to 2.14.1 in /web/app by @dependabot[bot] in #15347
• build(deps): bump github.com/go-openapi/spec from 0.22.4 to 0.22.5 by @dependabot[bot] in #15349
• build(deps): bump github.com/prometheus/common from 0.68.0 to 0.68.1 by @dependabot[bot] in #15350

Full Changelog: edge-26.5.5...edge-26.6.1

What's Changed

• build(deps): bump mio from 1.2.0 to 1.2.1 by @dependabot[bot] in #15330
• build(deps): bump socket2 from 0.6.3 to 0.6.4 by @dependabot[bot] in #15331
• chore(deps): upgrade proxy-init to v2.4.9 & cni-plugin to v1.6.8 by @arichardet in #15332

Full Changelog: edge-26.5.4...edge-26.5.5

What's Changed

• build(deps-dev): bump webpack-dev-server from 5.2.3 to 5.2.4 in /web/app by @dependabot[bot] in #15282
• build(deps): bump either from 1.15.0 to 1.16.0 by @dependabot[bot] in #15300
• build(deps): bump serde_json from 1.0.149 to 1.0.150 in the serde group by @dependabot[bot] in #15303
• build(deps): bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #15304
• build(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32 by @dependabot[bot] in #15302
• build(deps): bump log from 0.4.29 to 0.4.30 by @dependabot[bot] in #15313
• build(deps): bump autocfg from 1.5.0 to 1.5.1 by @dependabot[bot] in #15308
• build(deps): bump bumpalo from 3.20.2 to 3.20.3 by @dependabot[bot] in #15309
• build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 in /.github/actions/docker-build by @dependabot[bot] in #15312
• proxy: v2.354.0 by @l5d-bot in #15323
• build(deps): bump memchr from 2.8.0 to 2.8.1 by @dependabot[bot] in #15321
• chore: update linkerd-await from 0.3.2 to 0.3.3 by @cratelyn in #15329
• build(deps): bump hyper from 1.9.0 to 1.10.0 by @dependabot[bot] in #15327
• build(deps): bump zerocopy from 0.8.48 to 0.8.49 by @dependabot[bot] in #15328
• fix(policy-k8s): use correct resource labels in outbound indexer logs by @unleashed in #15314

Full Changelog: edge-26.5.3...edge-26.5.4

What's Changed

• build(deps): bump openssl from 0.10.79 to 0.10.80 by @dependabot[bot] in #15285
• build(deps): bump tower-http from 0.6.10 to 0.6.11 by @dependabot[bot] in #15290
• proxy: v2.353.0 by @l5d-bot in #15296

Full Changelog: edge-26.5.2...edge-26.5.3

What's Changed

• proxy: v2.351.0 by @l5d-bot in #15229
• build(deps): bump json-patch from 4.1.0 to 4.2.0 by @dependabot[bot] in #15227
• build(deps): bump openssl-sys from 0.9.114 to 0.9.115 by @dependabot[bot] in #15232
• build(deps): bump rustls from 0.23.37 to 0.23.40 by @dependabot[bot] in #15224
• build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 by @dependabot[bot] in #15233
• build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #15234
• build(deps): bump openssl from 0.10.78 to 0.10.79 by @dependabot[bot] in #15235
• build(deps): bump tokio from 1.52.1 to 1.52.2 by @dependabot[bot] in #15236
• chore: upgrade to network-validator 0.1.9 by @adleong in #15240
• build(deps): bump h2 from 0.4.13 to 0.4.14 by @dependabot[bot] in #15237
• build(deps): bump pin-project from 1.1.11 to 1.1.12 by @dependabot[bot] in #15238
• build(deps): bump tower-http from 0.6.8 to 0.6.9 by @dependabot[bot] in #15239
• build(deps): bump postcss from 8.5.6 to 8.5.10 in /web/app by @dependabot[bot] in #15208
• build(deps-dev): bump @babel/preset-env from 7.29.2 to 7.29.3 in /web/app by @dependabot[bot] in #15231
• build(deps-dev): bump eslint-plugin-promise from 7.2.1 to 7.3.0 in /web/app by @dependabot[bot] in #15230
• build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 by @dependabot[bot] in #15214
• build(deps): bump data-encoding from 2.10.0 to 2.11.0 by @dependabot[bot] in #15211
• build(deps): bump wasip2 from 1.0.2+wasi-0.2.9 to 1.0.3+wasi-0.2.9 by @dependabot[bot] in #15209
• Synchronize gateway liveness (#15096) by @officialasishkumar in #15150
• fix(destination): Restrict Servers from affecting workloads in other namespaces by @adleong in #15243
• build(deps): bump tower-http from 0.6.9 to 0.6.10 by @dependabot[bot] in #15245
• build(deps): bump tonic from 0.14.5 to 0.14.6 in the grpc group by @dependabot[bot] in #15244
• chore: update golang to 1.25.10 by @cratelyn in #15265
• build(deps): bump cc from 1.2.61 to 1.2.62 by @dependabot[bot] in #15258
• build(deps): bump tokio from 1.52.2 to 1.52.3 by @dependabot[bot] in #15259
• build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 by @dependabot[bot] in #15256
• feat: promote native sidecars to GA and enable by default by @alpeb in #15267
• build(deps): bump google.golang.org/grpc/cmd/protoc-gen-go-grpc from 1.6.1 to 1.6.2 by @dependabot[bot] in #15270
• build(deps-dev): bump jest-environment-jsdom from 30.3.0 to 30.4.1 in /web/app by @dependabot[bot] in #15254
• build(deps-dev): bump @babel/preset-env from 7.29.3 to 7.29.5 in /web/app by @dependabot[bot] in #15253
• build(deps-dev): bump sinon from 21.1.2 to 22.0.0 in /web/app by @dependabot[bot] in #15251
• proxy: v2.352.0 by @l5d-bot in #15272
• build(deps-dev): bump jest from 30.3.0 to 30.4.2 in /web/app by @dependabot[bot] in #15252
• build(deps): bump helm.sh/helm/v3 from 3.20.2 to 3.21.0 by @dependabot[bot] in #15275
• build(deps): bump aws-lc-rs from 1.16.3 to 1.17.0 by @dependabot[bot] in #15276
• build(deps): bump pin-project from 1.1.12 to 1.1.13 by @dependabot[bot] in #15277
• build(deps): bump tonic-prost from 0.14.5 to 0.14.6 by @dependabot[bot] in #15260
• test: assert parsed port ranges by @immanuwell in #15264
• build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #15280
• charts: make honorTimestamps configurable for linkerd-proxy PodMonitor by @bezarsnba in #15080

New Contributors

• @officialasishkumar made their first contribution in #15150
• @immanuwell made their first contribution in #15264

Full Changelog: edge-26.5.1...edge-26.5.2

Overall status: RECOMMENDED

Cautions

The minimum supported Kubernetes version for this and future releases is 1.31.

Changes

This release significantly reduces the amount of memory used by the destination controller on busy systems. It also allows setting the node port for the health check of a Linkerd multicluster gateway (fixing issue #15172 – thanks, Aldo Fuster Turpin!), cleans up some CI permissions (fixing issue #15182 – thanks, Gagan H R!), and correctly handles mirroring headless Services with the same name in different namespaces (fixing issue #15200 – thanks, Cody Bond!). Finally, it corrects the instructions about how to install the Gateway API CRDs when linkerd install --crds detects that they are missing, and bumps the minimum supported Kubernetes version to 1.31.

What's Changed

• build(deps): bump pkg-config from 0.3.32 to 0.3.33 by @dependabot[bot] in #15206
• build(deps): bump aws-lc-rs from 1.16.2 to 1.16.3 by @dependabot[bot] in #15205
• build(deps): bump hyper-rustls from 0.27.7 to 0.27.9 by @dependabot[bot] in #15204
• build(deps): bump axum from 0.8.8 to 0.8.9 by @dependabot[bot] in #15194
• refactor(destination): implement shared-filtering by @adleong in #15166
• build(deps): bump rustls-webpki from 0.103.12 to 0.103.13 by @dependabot[bot] in #15207
• build(deps): bump hyper from 1.8.1 to 1.9.0 by @dependabot[bot] in #15113
• build(deps): bump libc from 0.2.185 to 0.2.186 by @dependabot[bot] in #15210
• feat: add gateway.healthCheckNodePort Helm value by @AldoFusterTurpin in #15174
• chore: update extension-init to 0.1.11 by @cratelyn in #15220
• fix(CLI): correct gateway api version in user instructions by @adleong in #15213
• fix(multicluster): make service cleanup logic respect namespaces by @cbond-cohere in #15201
• fix: adding required permissions to top level and jobs in the workflow by @gaganhr94 in #15183
• build(deps): bump cc from 1.2.60 to 1.2.61 by @dependabot[bot] in #15215
• build(deps): bump tokio from 1.51.1 to 1.52.1 by @dependabot[bot] in #15216
• build(deps): bump rustls-pki-types from 1.14.0 to 1.14.1 by @dependabot[bot] in #15217
• chore: update MSKV to 1.31 by @adleong in #15221

New Contributors

• @AldoFusterTurpin made their first contribution in #15174
• @cbond-cohere made their first contribution in #15201
• @gaganhr94 made their first contribution in #15183

Full Changelog: edge-26.4.4...edge-26.5.1

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release improves support for newer Gateway API versions by allowing the policy validator to correctly function when new Gateway API resources are created with stanzas it doesn't understand, fixing issue #14986. It also improves the logic around using annotations to name metrics (fixing issue #15175 – thanks, Simon Dickhoven!), and correctly supports linkerd upgrade when using an external CA (fixing issue #15025).

What's Changed

• Chore(deps): upgrade to go 1.25.9 by @arichardet in #15178
• build(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 by @dependabot[bot] in #15179
• build(deps): bump rustls-webpki from 0.103.11 to 0.103.12 by @dependabot[bot] in #15180
• build(deps): bump tj-actions/changed-files from 47.0.5 to 47.0.6 by @dependabot[bot] in #15186
• build(deps-dev): bump webpack from 5.106.0 to 5.106.2 in /web/app by @dependabot[bot] in #15185
• build(deps-dev): bump html-webpack-plugin from 5.6.6 to 5.6.7 in /web/app by @dependabot[bot] in #15184
• build(deps): bump the kube group across 1 directory with 7 updates by @dependabot[bot] in #15177
• build(deps): bump openssl-sys from 0.9.112 to 0.9.113 by @dependabot[bot] in #15169
• build(deps): bump openssl from 0.10.76 to 0.10.77 by @dependabot[bot] in #15170
• build(deps): bump follow-redirects from 1.15.6 to 1.16.0 in /web/app by @dependabot[bot] in #15168
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #15163
• build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @dependabot[bot] in #15164
• build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #15165
• build(deps-dev): bump sinon from 21.0.3 to 21.1.2 in /web/app by @dependabot[bot] in #15158
• fix(policy): skip admission validation for Gateway routes with unsupported fields by @alpeb in #15118
• build(deps): bump libc from 0.2.184 to 0.2.185 by @dependabot[bot] in #15171
• build(deps): bump indexmap from 2.13.1 to 2.14.0 by @dependabot[bot] in #15155
• fix(inject): use more robust logic to convert annotation to metric label by @sdickhoven in #15176
• Update proxy-init to v2.4.8 & cni-plugin to v1.6.7 by @arichardet in #15190
• Apply overrides to chart values on install #15025 by @raykroeker in #15181
• build(deps): bump openssl from 0.10.77 to 0.10.78 by @dependabot[bot] in #15202
• build(deps): bump typenum from 1.19.0 to 1.20.0 by @dependabot[bot] in #15192
• fix(policy): minor correctness fixes in outbound index by @unleashed in #15157
• build(deps): bump bitflags from 2.11.0 to 2.11.1 by @dependabot[bot] in #15193
• proxy: v2.350.0 by @l5d-bot in #15198

New Contributors

• @arichardet made their first contribution in #15178
• @sdickhoven made their first contribution in #15176
• @raykroeker made their first contribution in #15181
• @unleashed made their first contribution in #15157

Full Changelog: edge-26.4.3...edge-26.4.4

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release adds support for the config.linkerd.io/proxy-additional-env annotation, which allows overriding environment variables on the proxy at the namespace or workload level (fixing issue #15152 – thanks, Aurel Canciu!)

What's Changed

• build(deps): bump helm.sh/helm/v3 from 3.20.1 to 3.20.2 by @dependabot[bot] in #15154
• build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 by @dependabot[bot] in #15153
• chore: bump max k8s version to 1.35 in tests by @alpeb in #15149
• build(deps): bump rustls-webpki from 0.103.10 to 0.103.11 by @dependabot[bot] in #15160
• build(deps): bump cc from 1.2.59 to 1.2.60 by @dependabot[bot] in #15161
• build(deps): bump rand from 0.10.0 to 0.10.1 by @dependabot[bot] in #15162
• chore: run policy tests with k8s 1.35 by @alpeb in #15167
• feat(inject): add proxy-additional-env annotation for per-scope env overrides by @relu in #15156
• proxy: v2.349.0 by @l5d-bot in #15173

Full Changelog: edge-26.4.2...edge-26.4.3

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release contains internal improvements, but no new capabilities over edge-26.4.1.

What's Changed

• build(deps): bump extractions/setup-just from 3.1.0 to 4.0.0 by @dependabot[bot] in #15132
• build(deps-dev): bump sinon from 21.0.2 to 21.0.3 in /web/app by @dependabot[bot] in #15130
• build(deps-dev): bump webpack-bundle-analyzer from 5.2.0 to 5.3.0 in /web/app by @dependabot[bot] in #15129
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #15122
• build(deps): bump github.com/clarketm/json from 1.15.7 to 1.17.1 by @dependabot[bot] in #15116
• build(deps-dev): bump jest-environment-jsdom from 30.2.0 to 30.3.0 in /web/app by @dependabot[bot] in #15128
• build(deps): bump lodash from 4.17.23 to 4.18.1 in /web/app by @dependabot[bot] in #15127
• build(deps): bump github.com/mattn/go-runewidth from 0.0.21 to 0.0.22 by @dependabot[bot] in #15120
• build(deps): bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in #15115
• build(deps): bump indexmap from 2.13.0 to 2.13.1 by @dependabot[bot] in #15121
• build(deps): bump libc from 0.2.183 to 0.2.184 by @dependabot[bot] in #15117
• build(deps): bump semver from 1.0.27 to 1.0.28 by @dependabot[bot] in #15138
• build(deps): bump fastrand from 2.3.0 to 2.4.1 by @dependabot[bot] in #15137
• test(destination): Add destination controller API tests by @adleong in #15123
• proxy: v2.348.0 by @l5d-bot in #15142
• build(deps): bump cc from 1.2.58 to 1.2.59 by @dependabot[bot] in #15140
• build(deps): bump tokio from 1.50.0 to 1.51.0 by @dependabot[bot] in #15139
• build(deps): bump tokio from 1.51.0 to 1.51.1 by @dependabot[bot] in #15147
• build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 by @dependabot[bot] in #15146
• chore(deps): ignore major lingui updates by @alpeb in #15135
• build(deps-dev): bump webpack from 5.105.4 to 5.106.0 in /web/app by @dependabot[bot] in #15148
• build(deps): bump github.com/mattn/go-runewidth from 0.0.22 to 0.0.23 by @dependabot[bot] in #15145
• tests: introduce kubectlRun to avoid conflating stdin and stdout in tests by @alpeb in #15151

Full Changelog: edge-26.4.1...edge-26.4.2