|
| 1 | +date: July 8, 2026 |
| 2 | + |
| 3 | +# Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs. |
| 4 | +breaking changes: | |
| 5 | +
|
| 6 | +# Updates addressing vulnerabilities, security flaws, or compliance requirements. |
| 7 | +security updates: | |
| 8 | + Bump Envoy to `1.37.5` (through `1.37.4`), which includes multiple security fixes. Refer to the [Envoy 1.37.5 release notes](https://www.envoyproxy.io/docs/envoy/v1.37.5/version_history/v1.37/v1.37.5). |
| 9 | + Bump Envoy ratelimit image to `f2fb1577`. |
| 10 | + Bump Go to 1.26.5 and 1.25.12, which includes security fixes to the `crypto/tls` and `os` packages. |
| 11 | +
|
| 12 | +# New features or capabilities added in this release. |
| 13 | +new features: | |
| 14 | +
|
| 15 | +bug fixes: | |
| 16 | + Fixed the EnvoyProxy resource not allowing IPv6 ranges in loadBalancerSourceRanges when configuring the envoy service. |
| 17 | + Fixed Backend TLS `alpnProtocols: []` to disable upstream ALPN instead of inheriting EnvoyProxy BackendTLS defaults. |
| 18 | + Fixed API key auth credential ordering to avoid unnecessary xDS updates. |
| 19 | + Fixed an `ExternalName` Service referenced as a route backend producing an invalid xDS cluster (with an empty address) that failed IR validation and stalled config delivery for the whole snapshot. `ExternalName` Services are now explicitly rejected as backends with a `ResolvedRefs: False` route condition; use an Envoy Gateway `Backend` resource with an FQDN endpoint instead. |
| 20 | + Fixed Gateway status reporting `Programmed: False` with reason `AddressNotAssigned` when the Envoy LoadBalancer service has no load balancer ingress (e.g. bare-metal clusters without a load balancer controller) but has addresses configured in `spec.externalIPs`, such as via an EnvoyProxy service patch. The external IPs are now used as a fallback for the Gateway status addresses. |
| 21 | + Fixed EnvoyGateway config hot-reload to apply defaults before validation, so validators always run against a fully-defaulted struct on both the startup and reload paths. |
| 22 | + Fixed a nil-pointer panic when `provider.kubernetes.deploy` is configured without a `type`. |
| 23 | + Fixed DaemonSet pod not using the configured custom ServiceAccount name. |
| 24 | + Fixed the rate limit `requests` CRD field to use `format: int64` so Kubernetes 1.36 accepts the `maximum` constraint. |
| 25 | +
|
| 26 | +# Enhancements that improve performance. |
| 27 | +performance improvements: | |
| 28 | +
|
| 29 | +# Deprecated features or APIs. |
| 30 | +deprecations: | |
| 31 | +
|
| 32 | +# Other notable changes not covered by the above sections. |
| 33 | +Other changes: | |
0 commit comments