[release/v1.6] cherry pick release notes + bump version (#8867)

* [release/v1.6] update docs for v1.6.7 (#8865)

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* bump VERSION

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

---------

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

Author: rudrakhp

VERSION

@@ -1 +1 @@
-v1.6.6
+v1.6.7

release-notes/v1.6.7.yaml

@@ -0,0 +1,28 @@
+date: April 27, 2026
+
+# Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs.
+breaking changes: |
+
+# Updates addressing vulnerabilities, security flaws, or compliance requirements.
+security updates: |
+  Bumped `google.golang.org/grpc` to v1.79.3 to address CVE-2026-33186 (Critical, gRPC-Go authorization bypass via non-canonical HTTP/2 `:path` header).
+  Bumped `go.opentelemetry.io/otel/sdk` to v1.40.0 to address CVE-2026-24051 (High, OpenTelemetry Go SDK path hijacking on macOS/Darwin).
+
+# New features or capabilities added in this release.
+new features: |
+
+bug fixes: |
+  Fixed a control plane panic caused by concurrent Status mutation racing with the watchable Map coalesce goroutine.
+  Fixed status conditions not being updated when a route is rejected due to multiple errors.
+  Fixed unresolved or unsupported HTTPRoute filters using `BackendNotFound` as the `ResolvedRefs` reason; they now correctly use `UnsupportedValue`.
+  Fixed benchmark JSON report emitting `0` for p99 and p999 percentiles by using the nearest Nighthawk histogram percentiles.
+
+# Enhancements that improve performance.
+performance improvements: |
+  Introduced a translator context with preprocessed resource maps in the Gateway API translator, reducing translation time by up to ~45% on large workloads.
+
+# Deprecated features or APIs.
+deprecations: |
+
+# Other notable changes not covered by the above sections.
+Other changes: |

site/content/en/news/releases/notes/v1.6.7.md

@@ -0,0 +1,31 @@
+---
+title: "v1.6.7"
+publishdate: 2026-04-27
+---
+
+Date: April 27, 2026
+
+## Breaking changes
+-
+
+## Security updates
+- Bumped `google.golang.org/grpc` to v1.79.3 to address [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) (Critical, gRPC-Go authorization bypass via non-canonical HTTP/2 `:path` header).
+- Bumped `go.opentelemetry.io/otel/sdk` to v1.40.0 to address [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) (High, OpenTelemetry Go SDK path hijacking on macOS/Darwin).
+
+## New features
+-
+
+## Bug fixes
+- Fixed a control plane panic caused by concurrent Status mutation racing with the watchable Map coalesce goroutine.
+- Fixed status conditions not being updated when a route is rejected due to multiple errors.
+- Fixed unresolved or unsupported HTTPRoute filters using `BackendNotFound` as the `ResolvedRefs` reason; they now correctly use `UnsupportedValue`.
+- Fixed benchmark JSON report emitting `0` for p99 and p999 percentiles by using the nearest Nighthawk histogram percentiles.
+
+## Performance improvements
+- Introduced a translator context with preprocessed resource maps in the Gateway API translator, reducing translation time by up to ~45% on large workloads.
+
+## Deprecations
+-
+
+## Other changes
+-