update release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>

Author: cnvergence

internal/gatewayapi/status/conditions.go

@@ -38,10 +38,10 @@ func MergeConditions(conditions []metav1.Condition, updates ...metav1.Condition)
 			if conditions[j].Type == updates[i].Type {
 				add = false
 				if conditionChanged(&conditions[j], &update) {
-					conditions[j].Status = updates[i].Status
-					conditions[j].Reason = updates[i].Reason
-					conditions[j].Message = updates[i].Message
-					conditions[j].ObservedGeneration = updates[i].ObservedGeneration
+					conditions[j].Status = update.Status
+					conditions[j].Reason = update.Reason
+					conditions[j].Message = update.Message
+					conditions[j].ObservedGeneration = update.ObservedGeneration
 					break
 				}
 			}

release-notes/current.yaml

@@ -5,41 +5,14 @@ breaking changes: |
 
 # Updates addressing vulnerabilities, security flaws, or compliance requirements.
 security updates: |
-  Bump golang to `1.25.9` for security fixes to the `crypto/tls` and `crypto/x509` packages.
-  Bump Envoy Proxy image to v1.37.2 for fixing several bugs. For more details, please refer to the [Envoy Proxy v1.37.2 release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.37.2).
-  Bump Envoy ratelimit image to `b8d893f3`.
-  Fixed xDS server authentication bypass in GatewayNamespaceMode, adding Unary Interceptor and validating SotW requests.
 
 # New features or capabilities added in this release.
 new features: |
 
 bug fixes: |
-  Rejected ClientTrafficPolicy if invalid TLS cipher suites are configured.
-  Fixed validation of XListenerSet certificateRefs
-  Fixed standalone mode emitting non-actionable error logs for missing secrets and unsupported ratelimit deletion on every startup.
-  Fixed xPolicy resources being processed from all namespaces when NamespaceSelector watch mode is configured in the Kubernetes provider.
-  Fixed route status parent aggregation when the number of parents exceeds the Gateway API cap of 32.
-  Fixed ratelimit deployment missing metrics container port (19001), which prevented PodMonitor/ServiceMonitor from targeting the metrics endpoint.
-  Fixed GRPCRoute RequestMirror filter backend not being indexed, causing "service not found" errors for mirror targets that exist in the cluster.
-  Fixed GRPCRoute not detecting conflicting RequestMirror and DirectResponse filters, which caused the mirror to be silently dropped.
-  Fixed per-endpoint hostname override not working because the auto-generated wildcard hostname.
-  Fixed Basic Authentication failing when htpasswd secrets use CRLF line endings by normalizing to LF before passing to Envoy.
-  BackendTLSPolicy was ignored when configuring TLS for telemetry backends (access logs, tracing, metrics).
-  Fixed client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy `extAuth`/`jwt`/`oidc` Backend.
-  Fixed xRoute status condition when route has mirror filter and the mirror backend has no endpoints.
-  Fixed `ws` and `wss` Backend appProtocols to force HTTP/1.1 upstream connections instead of negotiating HTTP/2, avoiding compatibility issues with WebSocket backends that do not support RFC 8441 extended CONNECT.
-  Fixed gateway-helm RBAC in GatewayNamespace mode with explicit `watch.namespaces` list by adding controller-namespace secret read permissions to infra-manager.
-  Fixed a control plane panic caused by concurrent Status mutation racing with the watchable Map coalesce goroutine.
-  Fixed status conditions not being updated when a route is rejected due to multiple errors.
-  Fixed active HTTP health checks to use Backend endpoint hostnames before falling back to the effective Route hostname.
-  Fixed TLS secrets with non-canonical PEM formatting (e.g. unusual line endings) being passed verbatim to Envoy, which could cause BoringSSL errors such as `BAD_END_LINE`. Cert and key PEM data is now re-encoded to a canonical form before being delivered as xDS resources.
-  Fixed the xDS server in GatewayNamespaceMode serving a stale certificate after cert-manager rotation by re-reading the cert from disk on every TLS handshake.
-  Fixed Gateway getting stuck at `Programmed=False` after its LoadBalancer Service IP was restored, by ignoring `LastTransitionTime` when comparing status conditions.
-  Fixed BackendTLSPolicy selection to prefer section name over wildcard match on the same backend.
 
 # Enhancements that improve performance.
 performance improvements: |
-  Reduce chances of listener drain due to Lua policy updates by migrating to LuaPerRoute.
 
 # Deprecated features or APIs.
 deprecations: |

release-notes/v1.7.2.yaml

@@ -7,7 +7,7 @@ breaking changes: |
 security updates: |
   Bump golang to `1.25.9` for security fixes to the `crypto/tls` and `crypto/x509` packages.
   Bump Envoy Proxy image to v1.37.2 for fixing several bugs. For more details, please refer to the [Envoy Proxy v1.37.2 release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.37.2).
-  Bump Envoy ratelimit image to `b8d893f3`.
+  Bump Envoy ratelimit image to `05c08d03`.
 
 # New features or capabilities added in this release.
 new features: |

release-notes/v1.7.4.yaml

@@ -1,11 +1,12 @@
-date: Pending
+date: June 1, 2026
 
 # Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs.
 breaking changes: |
 
 # Updates addressing vulnerabilities, security flaws, or compliance requirements.
 security updates: |
   Fixed xDS server authentication bypass in GatewayNamespaceMode, adding Unary Interceptor and validating SotW requests.
+  Bump Envoy ratelimit image to `b8d893f3`.
 
 # New features or capabilities added in this release.
 new features: |