Changelog

• chore(deps): bump golang.org/x/net from 0.48.0 to 0.53.0 #16538 @renovate
• chore(deps): bump helm.sh/helm/v4 from 4.0.2 to 4.1.4 #16258 @renovate
• feat(charts): expose CP HPA behavior (backport of #16576) #16581 @kumahq
• fix(dp-server): bound shutdown, propagate appCtx (backport of #16541) #16565 @kumahq
• fix(xds): enable reuse_port on inbound:passthrough listener (backport of #16605) #16607 @kumahq

This is a patch release that every user should upgrade to.

Changelog

• fix(api-server): harden localhost admin auth (backport of #16416) #16427 @kumahq
• fix(kds): reconnect mux client when GlobalToZone stream is closed by … (backport of #16326) #16433 @kumahq
• fix(meshaccesslog): deduplicate access logs for shared inbound port (backport of #16374) #16381 @lobkovilya
• fix(meshidentity): env-aware UsesWorkloadLabel (backport of #16356) #16363 @kumahq
• fix(policy): race condition when listener state is switched from Ignored to Ready (backport of #16323) #16338 @kumahq
• chore(deps): bump envoy from 1.36.5 to 1.36.6 #16267 @kumahq
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.58.0 to 1.65.0 #16158 @renovate
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda from 1.77.4 to 1.88.5 #16159 @renovate
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.88.1 to 1.97.3 #16160 @renovate
• chore(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.9.2 #16288 #16383 @renovate
• chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 #16293 @renovate
• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 #16208 @renovate

This is a patch release that every user should upgrade to.

Changelog

• fix(api-server): harden localhost admin auth (backport of #16416) #16423 @kumahq
• fix(kds): reconnect mux client when GlobalToZone stream is closed by … (backport of #16326) #16434 @kumahq
• fix(meshaccesslog): deduplicate access logs for shared inbound port (backport of #16374) #16377 @kumahq
• fix(policy): race condition when listener state is switched from Ignored to Ready (backport of #16323) #16341 @kumahq
• chore(deps): bump envoy from 1.35.9 to 1.35.10 #16264 @kumahq
• chore(deps): security update #16177 @kumahq
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.44.0 to 1.65.0 #16154 @renovate
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda from 1.69.0 to 1.88.5 #16155 @renovate
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.69.0 to 1.97.3 #16156 @renovate
• chore(deps): bump github.com/jackc/pgx/v5 from 5.7.5 to 5.9.2 #16287 #16389 @renovate
• chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 #16300 @renovate

This is a patch release that every user should upgrade to.

Changelog

• fix(api-server): harden localhost admin auth (backport of #16416) #16425 @kumahq
• fix(kds): reconnect mux client when GlobalToZone stream is closed by … (backport of #16326) #16437 @kumahq
• fix(meshaccesslog): deduplicate access logs for shared inbound port (backport of #16374) #16378 @kumahq
• fix(policy): race condition when listener state is switched from Ignored to Ready (backport of #16323) #16340 @kumahq
• chore(deps): bump envoy from 1.34.13 to 1.34.14 #16266 @kumahq
• chore(deps): security update #16137 @kumahq
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.44.0 to 1.65.0 #16150 @renovate
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda from 1.69.0 to 1.88.5 #16151 @renovate
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.69.0 to 1.97.3 #16152 @renovate
• chore(deps): bump github.com/jackc/pgx/v5 from 5.7.5 to 5.9.2 #16286 #16391 @renovate
• chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 #16299 @renovate
• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 #16179 @renovate

This is a patch release that every user should upgrade to.

Changelog

• fix(api-server): harden localhost admin auth (backport of #16416) #16424 @kumahq
• fix(kds): reconnect mux client when GlobalToZone stream is closed by … (backport of #16326) #16436 @kumahq
• fix(meshaccesslog): deduplicate access logs for shared inbound port (backport of #16374) #16376 @kumahq
• fix(policy): race condition when listener state is switched from Ignored to Ready (backport of #16323) #16342 @kumahq
• chore(deps): bump envoy from 1.34.13 to 1.34.14 #16265 @kumahq
• chore(deps): security update #16136 @kumahq
• chore(deps): bump github.com/jackc/pgx/v5 from 5.7.1 to 5.9.2 #16285 #16382 @renovate
• chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 #16298 @renovate

This is a patch release that every user should upgrade to.

Changelog

• fix(api-server): harden localhost admin auth (backport of #16416) #16426 @kumahq
• fix(kds): reconnect mux client when GlobalToZone stream is closed by … (backport of #16326) #16435 @kumahq
• fix(meshaccesslog): deduplicate access logs for shared inbound port (backport of #16374) #16375 @kumahq
• fix(policy): race condition when listener state is switched from Ignored to Ready (backport of #16323) #16339 @kumahq
• chore(deps): bump envoy from 1.34.13 to 1.34.14 #16268 @kumahq
• chore(deps): security update #16135 @kumahq
• chore(deps): bump github.com/jackc/pgx/v5 from 5.5.5 to 5.9.2 #16283 #16390 @renovate
• chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 #16297 @renovate

Changelog

• chore(deps): bump github.com/prometheus/common from v0.65.0 to v0.66.1 #16073 @kumahq
• fix(xds): prevent panic on send to closed channel during stream closure (backport of #15511) #16091 @kumahq

Changelog

• fix(helm): allow to define annotation and disable ttl for prehook (backport of #16084) #16087 @kumahq
• fix(xds): deduplicate filter in inbound:passthrough filter chain (backport of #16080) #16085 @kumahq
• fix(xds): pass namespace in reachable backends ref lookup #16099 @kumahq
• fix(xds): prevent panic on send to closed channel during stream closure (backport of #15511) #16092 @kumahq

Changelog

• chore(deps): bump github.com/prometheus/common from v0.65.0 to v0.66.1 #16072 @kumahq
• fix(helm): allow to define annotation and disable ttl for prehook (backport of #16084) #16088 @kumahq
• fix(xds): pass namespace in reachable backends ref lookup #16098 @kumahq
• fix(xds): prevent panic on send to closed channel during stream closure (backport of #15511) #16094 @kumahq

Changelog

• chore(deps): bump github.com/prometheus/common from v0.65.0 to v0.66.1 #16075 @kumahq
• fix(xds): prevent panic on send to closed channel during stream closure (backport of #15511) #16093 @kumahq