Edge release for 2026-08-03.

build(deps): bump github.com/mattn/go-runewidth from 0.0.24 to 0.0.27 (…

…#15516)

Bumps [github.com/mattn/go-runewidth](https://github.com/mattn/go-runewidth) from 0.0.24 to 0.0.27.
- [Commits](mattn/go-runewidth@v0.0.24...v0.0.27)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-runewidth
  dependency-version: 0.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix(destination)!: Disallow requests to undefined service ports (#15473)

#14149 fixed #13922 in the case where no ServiceProfile was defined for the target service.

However, when a ServiceProfile is defined for a service, Linkerd will use the `GetProfile` API instead of the client policy API and requests will be allowed to ports not defined in the service.

Unfortunately, the `GetProfile` API does not have a mechanism to signal that connections should be denied.  Therefore, when we encounter a `GetProfile` request for a port which is not defined on the service, we return an empty `DestinationProfile`. This causes the proxy to fall back to the client policy API which correctly returns a Forbidden filter and causes the connection to be denied.

We also add an integration test for both the ServiceProfile and non-ServiceProfile cases.

Signed-off-by: Alex Leong <alex@buoyant.io>

chore(deps): upgrade containerd (#15405)

Signed-off-by: Alex Leong <alex@buoyant.io>

proxy: v2.359.0 (#15394)

Release notes: https://github.com/linkerd/linkerd2-proxy/releases/tag/release/v2.359.0

Signed-off-by: l5d-bot <l5d-bot@users.noreply.github.com>
Co-authored-by: l5d-bot <l5d-bot@users.noreply.github.com>

chore(build): update golang to 1.25.11 (#15378)

This addresses the following CVEs:
[GO-2026-5039](https://pkg.go.dev/vuln/GO-2026-5039) with alias [CVE-2026-42507](https://www.cve.org/CVERecord?id=CVE-2026-42507)
[GO-2026-5038](https://pkg.go.dev/vuln/GO-2026-5038) with alias [CVE-2026-42504](https://www.cve.org/CVERecord?id=CVE-2026-42504)
[GO-2026-5037](https://pkg.go.dev/vuln/GO-2026-5037) with alias [CVE-2026-27145](https://www.cve.org/CVERecord?id=CVE-2026-27145)

Signed-off-by: Allison Richardet <allison@buoyant.io>

Edge release for 2026-06-05.

fix(policy-k8s): use correct resource labels in outbound indexer logs (…

…#15314)

* fix(policy-k8s): use egress_network label in EgressNetwork indexer logs

The EgressNetwork indexer warning messages used service=name as the
structured log field, which is misleading when the resource being
indexed is an EgressNetwork. Change to egress_network=name in the four
warning lines (accrual config, timeouts, http retry, grpc retry) so
operators see the correct resource type when investigating parse
errors.

Signed-off-by: Alejandro Martinez Ruiz <amr@buoyant.io>

* fix(policy-k8s): use labeled fields in outbound indexer debug logs

The Service and EgressNetwork indexer debug!() calls used bare name
and ns fields, while their sibling warn!() calls used explicit
service=name and egress_network=name labels. Use labeled fields in
the debug lines as well so structured log output is consistent within
each indexer implementation.

Signed-off-by: Alejandro Martinez Ruiz <amr@buoyant.io>

---------

Signed-off-by: Alejandro Martinez Ruiz <amr@buoyant.io>

proxy: v2.353.0 (#15296)

Release notes: https://github.com/linkerd/linkerd2-proxy/releases/tag/release/v2.353.0

Signed-off-by: l5d-bot <l5d-bot@users.noreply.github.com>
Co-authored-by: l5d-bot <l5d-bot@users.noreply.github.com>