Repository navigation
fix: reject TLS secret when certificate and private key do not match - #9487
Merged
zhaohuabing merged 6 commits intoJul 16, 2026
Merged
Conversation
zhaohuabing
force-pushed
the
fix-key-cert-mismatch-bp
branch
from
July 14, 2026 02:44
41dde4c to
ff272ee
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## release/v1.8 #9487 +/- ##
=============================================
Coverage 74.95% 74.96%
=============================================
Files 251 251
Lines 40619 40639 +20
=============================================
+ Hits 30447 30466 +19
Misses 8104 8104
- Partials 2068 2069 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
zhaohuabing
force-pushed
the
fix-key-cert-mismatch-bp
branch
2 times, most recently
from
July 14, 2026 03:08
ff272ee to
ec77845
Compare
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
zhaohuabing
force-pushed
the
fix-key-cert-mismatch-bp
branch
from
July 14, 2026 03:14
ec77845 to
d42fe2e
Compare
zhaohuabing
added
cherrypick/release-v1.8.3
and removed
cherrypick/release-v1.8.3
labels
cnvergence
previously approved these changes
Jul 14, 2026
Member
|
Thanks for splitting! |
Member
Author
|
/retest |
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
zhaohuabing
commented
Jul 14, 2026
guydc
reviewed
Jul 14, 2026
| // mergeGateways enabled that NACKs the whole SDS push, breaking TLS for all | ||
| // Gateways sharing the proxy. Reject the bad Secret here so it never reaches | ||
| // Envoy and only the affected listener degrades. | ||
| if _, err := tls.X509KeyPair(validData, pem.EncodeToMemory(keyBlock)); err != nil { |
Contributor
There was a problem hiding this comment.
I think that this might cause a false error to be reported, see comment here: #9473 (comment).
Member
Author
There was a problem hiding this comment.
Nice catch!
I've updated this PR. validateServingCertificateChain no longer filters individual certificates. Instead, it rejects the entire TLS serving certificate Secret if the certificate chain contains an invalid/expired certificate. CA bundles still drop expired CAs.
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
zhaohuabing
force-pushed
the
fix-key-cert-mismatch-bp
branch
from
July 15, 2026 02:19
b071ec4 to
770052b
Compare
Member
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
zhaohuabing
commented
Jul 15, 2026
| data: | ||
| tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKRENDQWd5Z0F3SUJBZ0lVU3JTYktMZjBiTEVHb2dXeC9nQ3cyR0N0dnhFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0V6RVJNQThHQTFVRUF3d0lWR1Z6ZENCSmJtTXdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVRNUkV3RHdZRFZRUUREQWhVWlhOMElFbHVZekNDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBSzFKempQSWlXZzNxb0hTckFkZGtlSmphTVA5aXlNVGkvQlBvOWNKUG9SRThaaTcKV2FwVXJYTC85QTlyK2pITXlHSVpOWk5kY1o1Y1kyWHYwTFA4WnhWeTJsazArM3d0WXpIbnBHWUdWdHlxMnRldApEaEZzaVBsODJZUmpDMG16V2E0UU16NFNYekZITmdJRHBSZGhmcm92bXNldVdHUUU4cFY0VWQ5VUsvU0tpbE1PCnF0QjVKaXJMUDJWczVUMW9XaWNXTFF2ZmJHd3Y3c0ZEZHI5YkcwWHRTUXAxN0hTZ281MFNERTUrQmpTbXB0RncKMVZjS0xscWFoTVhCRERpb3Jnd2hJaEdHS3BFU2VNMFA3YkZoVm1rTTNhc2gyeFNUQnVGVUJEbEU0Sk9haHp3cwpEWHJ1cFVoRGRTMWhkYzJmUHJqaEZBbEpmV0VZWjZCbFpqeXNpVlVDQXdFQUFhTndNRzR3SFFZRFZSME9CQllFCkZCUXVmSzFMaWJ1Vm05VHMvVmpCeDhMM3VpTmVNQjhHQTFVZEl3UVlNQmFBRkJRdWZLMUxpYnVWbTlUcy9WakIKeDhMM3VpTmVNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdHd1lEVlIwUkJCUXdFb0lCS29JTktpNWxlR0Z0Y0d4bApMbU52YlRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZQUzQxYWdldldNVjNaWHQwQ09GRzN1WWZQRlhuVnc2ClA0MXA5TzZHa2RZc3VxRnZQZVR5eUgyL2RBSUtLd1N6TS9wdGhnOEtuOExabG1KeUZObkExc3RKeG41WGRiVjEKcFBxajhVdllDQnp5ak1JcW1SeW9peUxpUWxib2hNYTBVZEVCS2NIL1BkTEU5SzhUR0pyWmdvR1hxcTFXbWl0RAozdmNQalNlUEtFaVVKVlM5bENoeVNzMEtZNUIraFVRRDBKajZucEZENFprMHhxZHhoMHJXdWVDcXE3dmpxRVl6CnBqNFB3cnVmbjFQQlRtZnhNdVYvVUpWNWViaWtldVpQMzVrV3pMUjdaV0FMN3d1RGRXcC82bzR5azNRTGFuRFEKQ3dnQ0ZjWCtzcyswVnl1TTNZZXJUT1VVOFFWSkp4NFVaQU5aeDYrNDNwZEpaT2NudFBaNENBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= | ||
| tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV1Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktRd2dnU2dBZ0VBQW9JQkFRQ1pTT21NUlBXWkFqN08KcVFrTVc2d3Bub3NmVCtRMzhmVWJ1U3crRXlablZ1eUNuYlVGZjhIeTVyYkx1K2dmbWszUW8xbnRBVTMzamprUQpXMGQzRHdCdWhKVUM0bkpVRks3cDk2dm9MQ2FTdmlPM0NQbytjUENPdkZ4K1ZrTzYxVkxXOEI2YW04UG5GWndhCmlGRGk0aUdyWXlIK3lsK2RUTmJoZlhIeEJ4T0E1M0IrcTI2K2ZmMFJXUWJKSWNiT1RzOENTSDZJWk1yeGNIcmsKOE1TdjFhWXlQdXpuT1BBQVFsNlRUdlEvNmhJZnF6bXJvd0RIRjRCMENFNUFvb2xFM0ZLT2kwaC9ieTJUN1dxbgo4NkdhdXA0VEtxVnV1Uk5hUU1CZDQ4azA4V3VTUENYSDBoWTVJbm1kdEMxRURKK3pQRk9NUjQycVA0THg5QWdICjNRZTBTMU5yQWdNQkFBRUNnZjk2Zy9QWXh2YVp5NEJuMU5ySkJkOExaT2djYlpjMmdueDZJa3YvVVhaME5obHgKRVlpS2plRmpWNkhXNW9FWHJaKy9tUGY0ZHVzVmFMNzRVOVZvanVQSmNlQWVScmpMM2VPaGJIdGN4KzBnY0dMZwpYeEY5VFJhcDY1VHVVZDFhaTA0aEd3WWY3NXNiUDdSS2JQaXZ3WmdVQWUwQ3BWdWZjaG5YcXJzWXI4cEpZNTFPCldWa1NxejRSWTlXbTBrNUcxSkZ5SXlFQzl1bURsdWpjSE50UlZtYWZrTmZBdENsaVByRktjL245bkpmTzZSRlAKN2c3Vi9JdnFudUlyN1BFM0duNlBhVCtCZ2c0NDh0ZDVKelBwVEE1WkJjQm8yb3J6L2t4WVBGcHIvZ1BVQnFRZApvNm5XcXc3Nlp4d1BsZHdMaEorWFlOWDdvdWN0VVNDTDl1NzdmeUVDZ1lFQXl2N0RseGYrS1FsZkR3bW8vcjFUCjBMMVpuSDQ3MmhpSWVkU2hleVZCSGJFVlRTbXI0MkJSbGpXNERiUmNRTTRWY3h4RGtHclI3NlJHZTlvZzZtemMKUnY4K1ZsQ1gyK3F5OXA1bTZaWHJiQXczMHpDLzVtUGtSV3ViaFVoaSs5ZUNNWmEvaEFJL1JGdjI2OURyQkQyLwo2a2cwRjhYME8vNndJK1dwYXRLM1cwY0NnWUVBd1U5QTZiSnBmYVhLS1hQR21PRy9uVXhUeXp5cVlqS05aSmQvCjlHaEVudUdqSzVDQUVWUEphOGtadmZRemxXbXdaYWZxMERocUk4dkxhRkNEZjhZOEU5OU1hbjNHV2hVYjNWL0oKcU5RUVMzNTZOQ2ZadzdseG9LS0JJdlQ2Y3dpaFRuc0UvUjRIQ3NhbDJ3d040Wmw5SFdOQmdhbVM3VExrejFMaApmd1JEa0wwQ2dZQlo0OWorNW53QTlncG5JVkw1Z3lORGN5WGtlNjNMVlVQU0YwdHV1YitOQTJhNFpiU2RHb0RtCmNHRlJpRVcxMk14OHpjNUpmRlA4dDVVU3NUUVVPeUtNT2VrRDFlcDVVd1B1MjVRYzZldDNUQzNJVW5VWDg3SVkKMzU3ZHRZRkhubFlqMldwemJYOVFxUnk5cmlUMEd0Z0tTZkR2ZWhRK0lQa2szRVZhYlhjT2J3S0JnR0d4QzcwTwp6UUVTcC9nSzZuS1lvNTE2MVY0QWFwcjFzVDhFMFVWUzdGcmU3UGMzTDRHU05saWlhTC8yaVpzWXJteXhUNW1xCjZQanVKUDJ5c3NJQURKeCtYTC8wa0NrMlFiNitpY3NvWUpQR2R6dWthQWpoenVxL05VUFZTanlZUCt6SmZ0dnMKTU9MaFFUQlNCekhidjc3NlNrQ2MwZ1BObEpTeDdnT2l4QUtCQW9HQUpCR1VuM2U1QWZDb21BMUUxRHhSeUxaagpUMFBrQUNlUGpEK3hrRkpod0RoQ2dzd2htNFVKZzFmQW8xaEJRUkZ0dHBWQy91QkxjazE4TUVBSTF2ZGZTeVB2CmtTZzVrVnFQanUzc2czOVRNZ09WZXdqUDNFM0FNUUd1ZzFQNzFZazJ6WUpQbGg5NWRMVTVISlZubzZvdkIrUG0KTHF5K016eDN3a0YwZDhlUFhRND0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo= | ||
| tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ3RTYzR6eUlsb042cUIKMHF3SFhaSGlZMmpEL1lzakU0dndUNlBYQ1Q2RVJQR1l1MW1xVksxeS8vUVBhL294ek1oaUdUV1RYWEdlWEdObAo3OUN6L0djVmN0cFpOUHQ4TFdNeDU2Um1CbGJjcXRyWHJRNFJiSWo1Zk5tRVl3dEpzMW11RURNK0VsOHhSellDCkE2VVhZWDY2TDVySHJsaGtCUEtWZUZIZlZDdjBpb3BURHFyUWVTWXF5ejlsYk9VOWFGb25GaTBMMzJ4c0wrN0IKUTNhL1d4dEY3VWtLZGV4MG9LT2RFZ3hPZmdZMHBxYlJjTlZYQ2k1YW1vVEZ3UXc0cUs0TUlTSVJoaXFSRW5qTgpEKzJ4WVZacEROMnJJZHNVa3diaFZBUTVST0NUbW9jOExBMTY3cVZJUTNVdFlYWE5uejY0NFJRSlNYMWhHR2VnClpXWThySWxWQWdNQkFBRUNnZ0VBSmpONGpTcmV1OFpWeE5QY0Q2MmRmUEpjUktTT3VUZFVhTEF0MXJoWGUxSTEKam0xeXlWMXNkVWNlbHcyL05KNUg2SFJWUHJ6aFVMOWVQRGtmWWFZNVZWMmg2L3VGbXl6b1NyYWRvODR1OU91SApYZmRzL0FOWXVPTkFrbkpCS1Vpcjh2Ym9UUDFBMWZ5MFY4SlU4VEFSZjFzQ1BKWGZMNEYxdHVTMDY4NUMrRi82CmRqclJxOGlqdzd3QmdmcHRYZWVjVkIxdXFyS2ZsS1U0aTg2Z0NYNmZDOUtJYTRZT0hVVXJSL2QxZXBlMUt1alcKNUpadGJnSXJzV1Q4WWsvbTQ3UjZBemsxVW90WlZ4S2JaeUNZc1FCOWlUZkxTWFU5bUlDN3VQdVl3OXF3QmlSbwpZUjAwQlZJM0J0VXJjdm9RdEwzUDdqV0EvZjBFSG1PS0NSTEdPYU5Ga1FLQmdRRHlCK01TU3FiV2h1d1hWYzJnClJWaU9VcVF0dGhxa3UrOWtaY2UxTzhOWlREakFvQ1A3SzVUSXM4Um9aTG5JUzEycjRWM1g5QjROa2t4RHdCdmoKbmdNMU1CcHBObEtyUnZHVExJcXRzdTlkc1N6ek51ZVpaTEF0b3ZJZzRhRVAyY0JMbW9jNFhjRFFpRGRVL0VqQgpUeXBUYkRtNDB6OXBCbDNFQlJYZEZDeGxhUUtCZ1FDM1NqZWpTUkMzdkF1QThRTmVYMlJ5T0I3cVU1TS81RU1KCkZlTkIzS056cGVyL2IxN2JndW1oRzhYRStmdzlPaHlXZzhraXBIYmljZGRPM1VzTllGNndPcFRmNVhVbVBoSkoKcnhYM2liQjNpbWp1TW5yQkJjOW9FUVlySFllN2U4aHFiOGU4dHNybDIzdDF6TlRZZkVBVi9tZ0dHdlNLTGtiKwp4NHprZkRUckRRS0JnUURodzFHZ29sbjJDbXozWjJZamRnd2cxaDJuTmhLc1QxSUN5SjM5QS80NHNjek9nWktPCm5CeHhDcDdPOGdZS082TG96WlFIK1FKL2psUHRicW1WTExPNVRXR1Zlc0txV2NiRmplcmVFK2NMOGxVSG1kTjMKVm1Dd2NTcUNXWFV2bitLcm96MDI2dDBNcDhOVlZ1OVd3azJzKzJyc2FNRGhhcnJVT2hvbTJzWis0UUtCZ1FDcApRWURsYVNobDh1RlFuYjkxbTNOZlFsSFNJNEU3bytiL2NkWGRVUWtqVjFrTnJtT1RJMjNwRjRObXBVNTNuNzBjCmhPL3M3S0RYOVRaVkhtY2JJQjN3Y1BoZlZUMzhKWit2cVY0SXEzNW90VWkyaGFqenJCRGVVYkkzaUZwNkdCRjMKc0dkcTdnV3BneWVjSFoyRG1DRjU3ZWRUay9xenk0NUY0akpLSUNTaDFRS0JnRG9IUk5CYzg0T2doQzNtbnBrcQpoL2RFUkhIaHNlQ3FGYTc5Wi80N2hHTTAyWU9obThQZGtJRkJ1YndHWllPOHNseCtPTEZtZzloZGYxdmFoSkJnCkczNnVOaWM1VmFyQ0w0eDNSc01pWkN3bW9rUDlBUjUyRC92dm54UjQ3amJQL3grNEIycWM2ZndKVkFRTmhGZzAKS3RPcXAwa1dlNjFvMkNPY05WL1BWeGozCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K |
Member
Author
There was a problem hiding this comment.
Fixed the mismatching key/cert in the test yaml files.
Contributor
There was a problem hiding this comment.
is this the case for all of the changed test files? If you changed the key, wouldn't you also need to change the cert itself to be based on the new key?
Member
Author
There was a problem hiding this comment.
Yes, this is the case for all of the changed test files.
I reused a pre-existing matching key from testdata/tls/ found via the cert's public-key fingerprint. I tried to not change the certs to keep the .out yaml files untouched.
guydc
approved these changes
Jul 16, 2026
guydc
left a comment
guydc
left a comment
Contributor
There was a problem hiding this comment.
LGTM.
If we want to reduce the scope of this CP to handling the expiration ==> mismatch path, which is the real regression that happened in 1.7, and later on CP additional protective measures, I think that's also fine.
Member
Author
|
I also included the mismatch fix to address #9463. It's a small fix and it should be safe to backport to 1.8. |
zirain
approved these changes
Jul 16, 2026
zhaohuabing
added a commit
to zhaohuabing/gateway
that referenced
this pull request
Jul 21, 2026
…nvoyproxy#9487) * fix: mismatch key/cert Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix benchmark test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * reject TLS sercrets with expired cert Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix lint Signed-off-by: Huabing (Robin) Zhao <[email protected]> * minor change Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]>
zhaohuabing
added a commit
that referenced
this pull request
Jul 22, 2026
…9480) * fix: reject TLS secret when certificate and private key do not match (#9487) * fix: mismatch key/cert Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix benchmark test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * reject TLS sercrets with expired cert Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix lint Signed-off-by: Huabing (Robin) Zhao <[email protected]> * minor change Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update release note Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]>
ajgon
pushed a commit
to deedee-ops/home-ops
that referenced
this pull request
Jul 22, 2026
….8.2 ➔ 1.8.3) (#403) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/envoyproxy/gateway-helm](https://gateway.envoyproxy.io/) ([source](https://github.com/envoyproxy/gateway)) | patch | `1.8.2` → `1.8.3` | --- ### Release Notes <details> <summary>envoyproxy/gateway (mirror.gcr.io/envoyproxy/gateway-helm)</summary> ### [`v1.8.3`](https://github.com/envoyproxy/gateway/releases/tag/v1.8.3) [Compare Source](envoyproxy/gateway@v1.8.2...v1.8.3) ##### Release Announcement Check out the [v1.8.3 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.3) to learn more about the release. ##### What's Changed - \[release-1.8]: bump the gomod group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9389](envoyproxy/gateway#9389) - \[release-1.8]: bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9435](envoyproxy/gateway#9435) - \[release-1.8]: bump the actions group across 1 directory with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9440](envoyproxy/gateway#9440) - \[release-1.8]: bump the actions group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9507](envoyproxy/gateway#9507) - \[release-1.8]: bump the gomod group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9502](envoyproxy/gateway#9502) - \[release-1.8]: bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9503](envoyproxy/gateway#9503) - \[release-1.8]: bump distroless/base-nossl from `20f009e` to `86554c4` in /tools/docker/envoy-gateway by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9497](envoyproxy/gateway#9497) - fix: reject TLS secret when certificate and private key do not match by [@​zhaohuabing](https://github.com/zhaohuabing) in [#​9487](envoyproxy/gateway#9487) - \[release-1.8] release notes and version bump for v1.8.3 by [@​jukie](https://github.com/jukie) in [#​9520](envoyproxy/gateway#9520) - \[release-1.8] V1.8.3 cherry picks by [@​jukie](https://github.com/jukie) in [#​9540](envoyproxy/gateway#9540) - \[release-1.8]: bump the gomod group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9547](envoyproxy/gateway#9547) - \[release-1.8]: bump the actions group across 2 directories with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9551](envoyproxy/gateway#9551) - \[release-1.8] fix: update ratelimit image fallback tag in helm helpers by [@​jukie](https://github.com/jukie) in [#​9552](envoyproxy/gateway#9552) **Full Changelog**: <envoyproxy/gateway@v1.8.2...v1.8.3> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2NvbnRhaW5lciIsInR5cGUvcGF0Y2giXX0=--> Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/403
gabrielcosi
pushed a commit
to gabrielcosi/home-ops
that referenced
this pull request
Jul 22, 2026
….8.2 ➔ 1.8.3) (#41) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/envoyproxy/gateway-helm](https://gateway.envoyproxy.io/) ([source](https://github.com/envoyproxy/gateway)) | patch | `1.8.2` → `1.8.3` | --- ### Release Notes <details> <summary>envoyproxy/gateway (mirror.gcr.io/envoyproxy/gateway-helm)</summary> ### [`v1.8.3`](https://github.com/envoyproxy/gateway/releases/tag/v1.8.3) [Compare Source](envoyproxy/gateway@v1.8.3...v1.8.3) ##### Release Announcement Check out the [v1.8.3 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.3) to learn more about the release. ##### What's Changed - \[release-1.8]: bump the gomod group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9389](envoyproxy/gateway#9389) - \[release-1.8]: bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9435](envoyproxy/gateway#9435) - \[release-1.8]: bump the actions group across 1 directory with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9440](envoyproxy/gateway#9440) - \[release-1.8]: bump the actions group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9507](envoyproxy/gateway#9507) - \[release-1.8]: bump the gomod group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9502](envoyproxy/gateway#9502) - \[release-1.8]: bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9503](envoyproxy/gateway#9503) - \[release-1.8]: bump distroless/base-nossl from `20f009e` to `86554c4` in /tools/docker/envoy-gateway by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9497](envoyproxy/gateway#9497) - fix: reject TLS secret when certificate and private key do not match by [@​zhaohuabing](https://github.com/zhaohuabing) in [#​9487](envoyproxy/gateway#9487) - \[release-1.8] release notes and version bump for v1.8.3 by [@​jukie](https://github.com/jukie) in [#​9520](envoyproxy/gateway#9520) - \[release-1.8] V1.8.3 cherry picks by [@​jukie](https://github.com/jukie) in [#​9540](envoyproxy/gateway#9540) - \[release-1.8]: bump the gomod group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9547](envoyproxy/gateway#9547) - \[release-1.8]: bump the actions group across 2 directories with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9551](envoyproxy/gateway#9551) - \[release-1.8] fix: update ratelimit image fallback tag in helm helpers by [@​jukie](https://github.com/jukie) in [#​9552](envoyproxy/gateway#9552) **Full Changelog**: <envoyproxy/gateway@v1.8.2...v1.8.3> ### [`v1.8.3`](https://github.com/envoyproxy/gateway/releases/tag/v1.8.3) [Compare Source](envoyproxy/gateway@v1.8.2...v1.8.3) ##### Release Announcement Check out the [v1.8.3 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.3) to learn more about the release. ##### What's Changed - \[release-1.8]: bump the gomod group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9389](envoyproxy/gateway#9389) - \[release-1.8]: bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9435](envoyproxy/gateway#9435) - \[release-1.8]: bump the actions group across 1 directory with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9440](envoyproxy/gateway#9440) - \[release-1.8]: bump the actions group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9507](envoyproxy/gateway#9507) - \[release-1.8]: bump the gomod group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9502](envoyproxy/gateway#9502) - \[release-1.8]: bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9503](envoyproxy/gateway#9503) - \[release-1.8]: bump distroless/base-nossl from `20f009e` to `86554c4` in /tools/docker/envoy-gateway by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9497](envoyproxy/gateway#9497) - fix: reject TLS secret when certificate and private key do not match by [@​zhaohuabing](https://github.com/zhaohuabing) in [#​9487](envoyproxy/gateway#9487) - \[release-1.8] release notes and version bump for v1.8.3 by [@​jukie](https://github.com/jukie) in [#​9520](envoyproxy/gateway#9520) - \[release-1.8] V1.8.3 cherry picks by [@​jukie](https://github.com/jukie) in [#​9540](envoyproxy/gateway#9540) - \[release-1.8]: bump the gomod group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9547](envoyproxy/gateway#9547) - \[release-1.8]: bump the actions group across 2 directories with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9551](envoyproxy/gateway#9551) - \[release-1.8] fix: update ratelimit image fallback tag in helm helpers by [@​jukie](https://github.com/jukie) in [#​9552](envoyproxy/gateway#9552) **Full Changelog**: <envoyproxy/gateway@v1.8.2...v1.8.3> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjkuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2OS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19--> Reviewed-on: https://git.xcd.dev/gabrielcosi/home-ops/pulls/41
doonga
pushed a commit
to greyrock-labs/home-ops
that referenced
this pull request
Jul 22, 2026
…1.8.2 ➔ 1.8.3) (#133) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/envoyproxy/gateway-helm](https://gateway.envoyproxy.io/) ([source](https://github.com/envoyproxy/gateway)) | patch | `v1.8.2` → `1.8.3` | --- ### Release Notes <details> <summary>envoyproxy/gateway (mirror.gcr.io/envoyproxy/gateway-helm)</summary> ### [`v1.8.3`](https://github.com/envoyproxy/gateway/releases/tag/v1.8.3) [Compare Source](envoyproxy/gateway@v1.8.2...v1.8.3) ##### Release Announcement Check out the [v1.8.3 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.3) to learn more about the release. ##### What's Changed - \[release-1.8]: bump the gomod group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9389](envoyproxy/gateway#9389) - \[release-1.8]: bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9435](envoyproxy/gateway#9435) - \[release-1.8]: bump the actions group across 1 directory with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9440](envoyproxy/gateway#9440) - \[release-1.8]: bump the actions group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9507](envoyproxy/gateway#9507) - \[release-1.8]: bump the gomod group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9502](envoyproxy/gateway#9502) - \[release-1.8]: bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9503](envoyproxy/gateway#9503) - \[release-1.8]: bump distroless/base-nossl from `20f009e` to `86554c4` in /tools/docker/envoy-gateway by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9497](envoyproxy/gateway#9497) - fix: reject TLS secret when certificate and private key do not match by [@​zhaohuabing](https://github.com/zhaohuabing) in [#​9487](envoyproxy/gateway#9487) - \[release-1.8] release notes and version bump for v1.8.3 by [@​jukie](https://github.com/jukie) in [#​9520](envoyproxy/gateway#9520) - \[release-1.8] V1.8.3 cherry picks by [@​jukie](https://github.com/jukie) in [#​9540](envoyproxy/gateway#9540) - \[release-1.8]: bump the gomod group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9547](envoyproxy/gateway#9547) - \[release-1.8]: bump the actions group across 2 directories with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9551](envoyproxy/gateway#9551) - \[release-1.8] fix: update ratelimit image fallback tag in helm helpers by [@​jukie](https://github.com/jukie) in [#​9552](envoyproxy/gateway#9552) **Full Changelog**: <envoyproxy/gateway@v1.8.2...v1.8.3> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19--> Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/133
eleboucher
pushed a commit
to eleboucher/homelab
that referenced
this pull request
Jul 23, 2026
….8.2 ➔ 1.8.3) (#1683) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/envoyproxy/gateway-helm](https://gateway.envoyproxy.io/) ([source](https://github.com/envoyproxy/gateway)) | patch | `1.8.2` → `1.8.3` | --- ### Release Notes <details> <summary>envoyproxy/gateway (mirror.gcr.io/envoyproxy/gateway-helm)</summary> ### [`v1.8.3`](https://github.com/envoyproxy/gateway/releases/tag/v1.8.3) [Compare Source](envoyproxy/gateway@v1.8.3...v1.8.3) ##### Release Announcement Check out the [v1.8.3 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.3) to learn more about the release. ##### What's Changed - \[release-1.8]: bump the gomod group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9389](envoyproxy/gateway#9389) - \[release-1.8]: bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9435](envoyproxy/gateway#9435) - \[release-1.8]: bump the actions group across 1 directory with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9440](envoyproxy/gateway#9440) - \[release-1.8]: bump the actions group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9507](envoyproxy/gateway#9507) - \[release-1.8]: bump the gomod group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9502](envoyproxy/gateway#9502) - \[release-1.8]: bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9503](envoyproxy/gateway#9503) - \[release-1.8]: bump distroless/base-nossl from `20f009e` to `86554c4` in /tools/docker/envoy-gateway by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9497](envoyproxy/gateway#9497) - fix: reject TLS secret when certificate and private key do not match by [@​zhaohuabing](https://github.com/zhaohuabing) in [#​9487](envoyproxy/gateway#9487) - \[release-1.8] release notes and version bump for v1.8.3 by [@​jukie](https://github.com/jukie) in [#​9520](envoyproxy/gateway#9520) - \[release-1.8] V1.8.3 cherry picks by [@​jukie](https://github.com/jukie) in [#​9540](envoyproxy/gateway#9540) - \[release-1.8]: bump the gomod group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9547](envoyproxy/gateway#9547) - \[release-1.8]: bump the actions group across 2 directories with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9551](envoyproxy/gateway#9551) - \[release-1.8] fix: update ratelimit image fallback tag in helm helpers by [@​jukie](https://github.com/jukie) in [#​9552](envoyproxy/gateway#9552) **Full Changelog**: <envoyproxy/gateway@v1.8.2...v1.8.3> ### [`v1.8.3`](https://github.com/envoyproxy/gateway/releases/tag/v1.8.3) [Compare Source](envoyproxy/gateway@v1.8.2...v1.8.3) ##### Release Announcement Check out the [v1.8.3 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.3) to learn more about the release. ##### What's Changed - \[release-1.8]: bump the gomod group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9389](envoyproxy/gateway#9389) - \[release-1.8]: bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9435](envoyproxy/gateway#9435) - \[release-1.8]: bump the actions group across 1 directory with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9440](envoyproxy/gateway#9440) - \[release-1.8]: bump the actions group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9507](envoyproxy/gateway#9507) - \[release-1.8]: bump the gomod group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9502](envoyproxy/gateway#9502) - \[release-1.8]: bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9503](envoyproxy/gateway#9503) - \[release-1.8]: bump distroless/base-nossl from `20f009e` to `86554c4` in /tools/docker/envoy-gateway by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9497](envoyproxy/gateway#9497) - fix: reject TLS secret when certificate and private key do not match by [@​zhaohuabing](https://github.com/zhaohuabing) in [#​9487](envoyproxy/gateway#9487) - \[release-1.8] release notes and version bump for v1.8.3 by [@​jukie](https://github.com/jukie) in [#​9520](envoyproxy/gateway#9520) - \[release-1.8] V1.8.3 cherry picks by [@​jukie](https://github.com/jukie) in [#​9540](envoyproxy/gateway#9540) - \[release-1.8]: bump the gomod group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9547](envoyproxy/gateway#9547) - \[release-1.8]: bump the actions group across 2 directories with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9551](envoyproxy/gateway#9551) - \[release-1.8] fix: update ratelimit image fallback tag in helm helpers by [@​jukie](https://github.com/jukie) in [#​9552](envoyproxy/gateway#9552) **Full Changelog**: <envoyproxy/gateway@v1.8.2...v1.8.3> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1683
This was referenced Jul 27, 2026
ajgon
pushed a commit
to deedee-ops/home-ops
that referenced
this pull request
Jul 28, 2026
….8.2 ➔ 1.8.3) (#403) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/envoyproxy/gateway-helm](https://gateway.envoyproxy.io/) ([source](https://github.com/envoyproxy/gateway)) | patch | `1.8.2` → `1.8.3` | --- ### Release Notes <details> <summary>envoyproxy/gateway (mirror.gcr.io/envoyproxy/gateway-helm)</summary> ### [`v1.8.3`](https://github.com/envoyproxy/gateway/releases/tag/v1.8.3) [Compare Source](envoyproxy/gateway@v1.8.2...v1.8.3) ##### Release Announcement Check out the [v1.8.3 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.3) to learn more about the release. ##### What's Changed - \[release-1.8]: bump the gomod group across 1 directory with 3 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9389](envoyproxy/gateway#9389) - \[release-1.8]: bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9435](envoyproxy/gateway#9435) - \[release-1.8]: bump the actions group across 1 directory with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9440](envoyproxy/gateway#9440) - \[release-1.8]: bump the actions group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9507](envoyproxy/gateway#9507) - \[release-1.8]: bump the gomod group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9502](envoyproxy/gateway#9502) - \[release-1.8]: bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9503](envoyproxy/gateway#9503) - \[release-1.8]: bump distroless/base-nossl from `20f009e` to `86554c4` in /tools/docker/envoy-gateway by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9497](envoyproxy/gateway#9497) - fix: reject TLS secret when certificate and private key do not match by [@​zhaohuabing](https://github.com/zhaohuabing) in [#​9487](envoyproxy/gateway#9487) - \[release-1.8] release notes and version bump for v1.8.3 by [@​jukie](https://github.com/jukie) in [#​9520](envoyproxy/gateway#9520) - \[release-1.8] V1.8.3 cherry picks by [@​jukie](https://github.com/jukie) in [#​9540](envoyproxy/gateway#9540) - \[release-1.8]: bump the gomod group across 1 directory with 7 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9547](envoyproxy/gateway#9547) - \[release-1.8]: bump the actions group across 2 directories with 6 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​9551](envoyproxy/gateway#9551) - \[release-1.8] fix: update ratelimit image fallback tag in helm helpers by [@​jukie](https://github.com/jukie) in [#​9552](envoyproxy/gateway#9552) **Full Changelog**: <envoyproxy/gateway@v1.8.2...v1.8.3> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2NvbnRhaW5lciIsInR5cGUvcGF0Y2giXX0=--> Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/403
1 task
gh-worker-dd-mergequeue-cf854d Bot
pushed a commit
to DataDog/datadog-agent
that referenced
this pull request
Oct 27, 2026
…b.com/envoyproxy/gateway to v1.8.3 (#56854) > [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/containerd/containerd/v2](https://redirect.github.com/containerd/containerd) | `v2.2.9` → `v2.3.5` |  |  |  |  | | [github.com/envoyproxy/gateway](https://redirect.github.com/envoyproxy/gateway) | `v1.7.4` → `v1.8.3` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>containerd/containerd (github.com/containerd/containerd/v2)</summary> ### [`v2.3.5`](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.5): containerd 2.3.5 [Compare Source](https://redirect.github.com/containerd/containerd/compare/v2.3.4...v2.3.5) Welcome to the v2.3.5 release of containerd! The fifth patch release for containerd 2.3 contains various fixes and updates including security patches. ##### Security Updates - **containerd** - [**CVE-2026-53495**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv) - [**GHSA-rp3h-jf77-q9p4**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4) ##### Highlights ##### Image Distribution - Apply hardening to strip sensitive authentication headers when fetching descriptor URLs ([#​14030](https://redirect.github.com/containerd/containerd/pull/14030)) ##### Runtime - Avoid hangs and data races when streaming container standard I/O in CRI ([#​14094](https://redirect.github.com/containerd/containerd/pull/14094)) - Fix missing error messages in OpenTelemetry trace attributes ([#​14049](https://redirect.github.com/containerd/containerd/pull/14049)) - Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ([#​13999](https://redirect.github.com/containerd/containerd/pull/13999)) - Fix configuration loading error when drop-in configuration files have a higher version than the root configuration ([#​13995](https://redirect.github.com/containerd/containerd/pull/13995)) - Avoid containerd startup hangs when loading shims ([#​13983](https://redirect.github.com/containerd/containerd/pull/13983)) - Add context to error when shim delete times out ([#​13921](https://redirect.github.com/containerd/containerd/pull/13921)) - Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC ([containerd/platforms#​34](https://redirect.github.com/containerd/platforms/pull/34)) ##### Snapshotters - Fix unpack failure for EROFS images containing the erofs OS feature ([#​14062](https://redirect.github.com/containerd/containerd/pull/14062)) Please try out the release binaries and report any issues at <https://github.com/containerd/containerd/issues>. ##### Contributors - Phil Estes - Samuel Karp - Derek McGowan - Sebastiaan van Stijn - Akhil Mohan - Maksym Pavlenko - Wei Fu - Oleh Konko - Austin Vazquez - Jing Chen - Martín Fernández - Paco Xu - XlabAI - Yuanliang Zhang ##### Changes <details><summary>33 commits</summary> <p> - [`934efa5e0`](https://redirect.github.com/containerd/containerd/commit/934efa5e09193139c810bcab1fb5ca547dbb6b90) Prepare release notes for v2.3.5 - [`be419b070`](https://redirect.github.com/containerd/containerd/commit/be419b070c178548c8e384d8bc3c8fe0ad6f154a) Merge commit from fork - [`9ec55f024`](https://redirect.github.com/containerd/containerd/commit/9ec55f024041d0641f6d79841e45c8781141ddaa) cri: cancel ExecSync IO drain on context cancellation - [`84ea25bc1`](https://redirect.github.com/containerd/containerd/commit/84ea25bc1d7e9f71390ce9d647dbdec4408c05bc) Merge commit from fork - [`c53577965`](https://redirect.github.com/containerd/containerd/commit/c535779652bc8d541328a36ba598088c09819b97) archive: skip redundant opaque whiteout walks - Fix data races and a deadlock in the byte stream helpers ([#​14094](https://redirect.github.com/containerd/containerd/pull/14094)) - [`9f6be869c`](https://redirect.github.com/containerd/containerd/commit/9f6be869c8a6144dc66befde081d6e262b7c4c7d) Fix data races and a deadlock in the byte stream helpers - plugins: remove some stray logrus imports ([#​14063](https://redirect.github.com/containerd/containerd/pull/14063)) - [`6c59399bf`](https://redirect.github.com/containerd/containerd/commit/6c59399bf07df45110770dbe28710e2e65c3e8c6) plugins: remove some stray logrus imports - snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin ([#​14062](https://redirect.github.com/containerd/containerd/pull/14062)) - [`f65732115`](https://redirect.github.com/containerd/containerd/commit/f65732115d1319a62fd35dc694d5fbe3045594f7) snapshots/erofs: test the advertised erofs feature platform - [`5ffc2bbda`](https://redirect.github.com/containerd/containerd/commit/5ffc2bbda2a878f87b56ffa2496157f3b814fbc1) erofs: advertise the erofs OS feature platform from the snapshotter - update runc to v1.5.1 ([#​14059](https://redirect.github.com/containerd/containerd/pull/14059)) - [`af445ea0a`](https://redirect.github.com/containerd/containerd/commit/af445ea0afd99c4925e5aa2c01a3210146675e2d) update runc to v1.5.1 - [`c077e43bd`](https://redirect.github.com/containerd/containerd/commit/c077e43bd7f2fe75284e10974cec0ff82d38024a) update runc to v1.5.0 - vendor: github.com/containerd/platforms v1.0.0-rc.5 ([#​14048](https://redirect.github.com/containerd/containerd/pull/14048)) - [`676a64cad`](https://redirect.github.com/containerd/containerd/commit/676a64cad58b76448d3978bc5c7c663c97f99656) vendor: github.com/containerd/platforms v1.0.0-rc.5 - pkg/tracing: handle error and typed-nil Stringer attributes ([#​14049](https://redirect.github.com/containerd/containerd/pull/14049)) - [`c7ffd8b00`](https://redirect.github.com/containerd/containerd/commit/c7ffd8b006b52ee329757d71430193e91b16b09d) pkg/tracing: handle error and typed-nil Stringer attributes - docker fetcher: strip sensitive headers on descriptor URLs ([#​14030](https://redirect.github.com/containerd/containerd/pull/14030)) - [`58fb846d5`](https://redirect.github.com/containerd/containerd/commit/58fb846d53f212330dc6be8f0b13fdf550a741dd) core/remotes/docker: normalize descriptor URL origins - [`c7625a1ff`](https://redirect.github.com/containerd/containerd/commit/c7625a1ff2826ee58fe5d8924f5612213aefa109) core/remotes/docker: strip sensitive headers on desc.urls fetch - update runhcs to v0.15.0-rc.4 ([#​13990](https://redirect.github.com/containerd/containerd/pull/13990)) - [`6fbb92c33`](https://redirect.github.com/containerd/containerd/commit/6fbb92c33c58952735577e8943adc39a8528b888) update runhcs to v0.15.0-rc.4 - pkg/oci: resolve rootfs symlinks for user lookup ([#​13999](https://redirect.github.com/containerd/containerd/pull/13999)) - [`53bf030ea`](https://redirect.github.com/containerd/containerd/commit/53bf030ea230c8c6c7b2a74f49b4860950b1af93) pkg/oci: resolve rootfs symlinks for user lookup - Revert "add check on version of drop in configs" ([#​13995](https://redirect.github.com/containerd/containerd/pull/13995)) - [`7790c4c21`](https://redirect.github.com/containerd/containerd/commit/7790c4c2108ff6667e6a222cb3c9a7a02bc459ec) ensure that the final config version is the higest in the config list - [`1125b053f`](https://redirect.github.com/containerd/containerd/commit/1125b053f59ed3d4cacc07d1b6cb9e4da17d7fc7) Revert "add check on version of drop in configs" - fix(runtime): apply load timeout to load shim ([#​13983](https://redirect.github.com/containerd/containerd/pull/13983)) - [`460c47b28`](https://redirect.github.com/containerd/containerd/commit/460c47b28dbc0f7ef463c94129489532fd708290) fix(runtime): bound shim loading with the load timeout - Add more context to the shim delete error ([#​13921](https://redirect.github.com/containerd/containerd/pull/13921)) - [`7f97bc122`](https://redirect.github.com/containerd/containerd/commit/7f97bc1220b50dab542a88b39b09e7ac78ffda42) Add more context to the shim delete error </p> </details> ##### Changes from containerd/platforms <details><summary>2 commits</summary> <p> - Fix WS2022 compat on hosts past the latest LTSC ([containerd/platforms#​34](https://redirect.github.com/containerd/platforms/pull/34)) - [`bacc690`](https://redirect.github.com/containerd/platforms/commit/bacc69061152115965f5b17fa59dc4e051ba8dc3) Fix WS2022 compat on hosts past the latest LTSC </p> </details> ##### Dependency Changes - **github.com/containerd/platforms** v1.0.0-rc.4 -> v1.0.0-rc.5 Previous release can be found at [v2.3.4](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.4) ##### Which file should I download? - `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04). - `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent. In addition to containerd, typically you will have to install [runc](https://redirect.github.com/opencontainers/runc/releases) and [CNI plugins](https://redirect.github.com/containernetworking/plugins/releases) from their official sites too. See also the [Getting Started](https://redirect.github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation. ### [`v2.3.4`](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.4): containerd 2.3.4 [Compare Source](https://redirect.github.com/containerd/containerd/compare/v2.3.3...v2.3.4) Welcome to the v2.3.4 release of containerd! The fourth patch release for containerd 2.3 contains various fixes and updates. ##### Highlights ##### Container Runtime Interface (CRI) - Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#​13913](https://redirect.github.com/containerd/containerd/pull/13913)) - Set default runtimeFeatures.UserNamespacesHostNetwork to true in CRI ([#​13914](https://redirect.github.com/containerd/containerd/pull/13914)) - Deprecate checkpoint restore in CreateContainer ([#​13868](https://redirect.github.com/containerd/containerd/pull/13868)) - Support non-UTF-8 binary environment variable values in CRI ([#​13454](https://redirect.github.com/containerd/containerd/pull/13454)) - Enable OCI runtime feature introspection for non-runc runtimes in CRI ([#​13778](https://redirect.github.com/containerd/containerd/pull/13778)) - Disable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option ([#​13734](https://redirect.github.com/containerd/containerd/pull/13734)) - Normalize sandbox image references in CRI to resolve images without domain prefixes ([#​13759](https://redirect.github.com/containerd/containerd/pull/13759)) ##### Node Resource Interface (NRI) - Emit deprecation warnings for plugins using deprecated NRI interfaces ([#​13935](https://redirect.github.com/containerd/containerd/pull/13935)) ##### Runtime - Enable log scrubbing by default on Windows ([#​13904](https://redirect.github.com/containerd/containerd/pull/13904)) - Fix memory leak in OOM watcher map when stopping container monitoring ([#​13870](https://redirect.github.com/containerd/containerd/pull/13870)) - Avoid orphaning shims on transient errors when loading process IDs ([#​13857](https://redirect.github.com/containerd/containerd/pull/13857)) - Fix corruption of binary protobuf shim start responses caused by premature whitespace trimming ([#​13803](https://redirect.github.com/containerd/containerd/pull/13803)) ##### Snapshotters - Fix EROFS snapshotter dropping lower layers stacked above merged filesystem metadata ([#​13876](https://redirect.github.com/containerd/containerd/pull/13876)) ##### Breaking - Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#​13913](https://redirect.github.com/containerd/containerd/pull/13913)) ##### Deprecations - Deprecate checkpoint restore in CreateContainer ([#​13868](https://redirect.github.com/containerd/containerd/pull/13868)) Please try out the release binaries and report any issues at <https://github.com/containerd/containerd/issues>. ##### Contributors - Samuel Karp - Maksym Pavlenko - Mike Brown - Akihiro Suda - Derek McGowan - Jordan Liggitt - Paweł Gronowski - Amir Alavi - Andrew Halaney - Bing Hongtao - Chris Henzie - Harshal Patel - Krisztian Litkey - Phil Estes - Wei Fu - ningmingxiao ##### Changes <details><summary>35 commits</summary> <p> - [`c1f5360ef`](https://redirect.github.com/containerd/containerd/commit/c1f5360ef7b9afb748d4119ad7be665ba5144480) Prepare release notes for v2.3.4 - cri: disable restore in CreateContainer by default ([#​13913](https://redirect.github.com/containerd/containerd/pull/13913)) - [`928c03c68`](https://redirect.github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f) cri: disable restore in CreateContainer by default - nri,deprecation: record and emit warnings for NRI deprecations. ([#​13935](https://redirect.github.com/containerd/containerd/pull/13935)) - [`5966e2edb`](https://redirect.github.com/containerd/containerd/commit/5966e2edb15bb939aa2bb73649fbad73a2b04094) nri,deprecation: emit warnings for old NRI plugins. - Set the default of runtimeFeatures.UserNamespacesHostNetwork to true ([#​13914](https://redirect.github.com/containerd/containerd/pull/13914)) - [`ab52c58f1`](https://redirect.github.com/containerd/containerd/commit/ab52c58f16ac50bb6724354bf36cbb4da480c2a2) Set the default of runtimeFeatures.UserNamespacesHostNetwork to true - Use ScrubLogs by default on Windows ([#​13904](https://redirect.github.com/containerd/containerd/pull/13904)) - [`0c255158a`](https://redirect.github.com/containerd/containerd/commit/0c255158aa1ecab40aafc42269cfc018a46eb627) ctr: add --scrub-logs flag for Windows - [`1c2b13dc9`](https://redirect.github.com/containerd/containerd/commit/1c2b13dc975468197e57321e25fd09163f78a75a) cri/config: use ScrubLogs by default on Windows - snapshots/erofs: keep lowers stacked above a merged fsmeta ([#​13876](https://redirect.github.com/containerd/containerd/pull/13876)) - [`0c511e068`](https://redirect.github.com/containerd/containerd/commit/0c511e068b7d6dd815418185a235b3ba3347c65a) snapshots/erofs: keep lowers stacked above a merged fsmeta - cri: deprecate restore in CreateContainer ([#​13868](https://redirect.github.com/containerd/containerd/pull/13868)) - [`dc98141df`](https://redirect.github.com/containerd/containerd/commit/dc98141df70d3d72d46125c6f30de0d2de648086) cri: deprecate restore in CreateContainer - internal/oom: Fix memory leak by removing watcher from map on Stop ([#​13870](https://redirect.github.com/containerd/containerd/pull/13870)) - [`537d82d54`](https://redirect.github.com/containerd/containerd/commit/537d82d545759d4a072d564d4937707af2650163) internal/oom: Fix memory leak by removing watcher from map on Stop - shim_load: Consider shim leaked only if we can't find pids ([#​13857](https://redirect.github.com/containerd/containerd/pull/13857)) - [`decf97a9c`](https://redirect.github.com/containerd/containerd/commit/decf97a9c7c26f92391d2c862d35832e0a291e80) shim_load: Consider shim leaked only if we can't find pids - core/runtime/v2: Drop checkpointctl module dependency ([#​13840](https://redirect.github.com/containerd/containerd/pull/13840)) - [`796f07dc8`](https://redirect.github.com/containerd/containerd/commit/796f07dc853d9ae8a3a1278fe47436755a4bc3b7) core/runtime/v2: Drop checkpointctl module dependency - Handle []byte envvar value for CRI ([#​13454](https://redirect.github.com/containerd/containerd/pull/13454)) - [`751fddddb`](https://redirect.github.com/containerd/containerd/commit/751fddddbb630631e12fd63e5dac4a9530188822) Handle []byte envvar value - [`0bce9060e`](https://redirect.github.com/containerd/containerd/commit/0bce9060ef3401e690b541dd6d2008c2abc50b0d) update to v0.36.x kubernetes dependencies - fix(cri): introspect OCI runtime features for non-runc runtimes ([#​13778](https://redirect.github.com/containerd/containerd/pull/13778)) - [`61a8f6f45`](https://redirect.github.com/containerd/containerd/commit/61a8f6f45e34660d787988e8a7e7a218f556369c) fix(cri): introspect OCI runtime features for non-runc runtimes - core/runtime/v2: Preserve protobuf shim response bytes ([#​13803](https://redirect.github.com/containerd/containerd/pull/13803)) - [`1d28017be`](https://redirect.github.com/containerd/containerd/commit/1d28017be295005bfa3aee1d47afe86341d391b6) core/runtime/v2: Preserve protobuf shim response bytes - Disable checkpoint restore codepath when CRIU is not installed ([#​13734](https://redirect.github.com/containerd/containerd/pull/13734)) - [`374091d67`](https://redirect.github.com/containerd/containerd/commit/374091d67c1966969b772594ba96a74f4357bc7a) github/workflows: install criu in node-e2e - [`db03e3968`](https://redirect.github.com/containerd/containerd/commit/db03e39685448a1d87025a2ca3a1e4e42713102d) cri: add enable_criu configuration option - [`dacd4c7d0`](https://redirect.github.com/containerd/containerd/commit/dacd4c7d00f4a5fd71197e67afdb6355e8536e4f) cri: validate CRIU availability and version early - ci: bound Go fuzzing by execution count ([#​13785](https://redirect.github.com/containerd/containerd/pull/13785)) - [`890a9c86c`](https://redirect.github.com/containerd/containerd/commit/890a9c86cd9918e53c1ef1b57c6539a943196cd5) ci: bound Go fuzzing by execution count - cri: auto-add prefix for pause image ([#​13759](https://redirect.github.com/containerd/containerd/pull/13759)) - [`0b2f1d078`](https://redirect.github.com/containerd/containerd/commit/0b2f1d078124b52f4c8030dc686f2d65c1dfc17c) cri: auto-add prefix for pause image </p> </details> ##### Dependency Changes - **k8s.io/api** v0.36.0 -> v0.36.3 - **k8s.io/apimachinery** v0.36.0 -> v0.36.3 - **k8s.io/client-go** v0.36.0 -> v0.36.3 - **k8s.io/component-base** v0.36.0 -> v0.36.3 - **k8s.io/cri-api** v0.36.0 -> v0.36.3 - **k8s.io/cri-client** v0.36.0 -> v0.36.3 - **k8s.io/cri-streaming** v0.36.0 -> v0.36.3 - **sigs.k8s.io/structured-merge-diff/v6** v6.3.2 -> v6.3.3 Previous release can be found at [v2.3.3](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.3) ##### Which file should I download? - `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04). - `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent. In addition to containerd, typically you will have to install [runc](https://redirect.github.com/opencontainers/runc/releases) and [CNI plugins](https://redirect.github.com/containernetworking/plugins/releases) from their official sites too. See also the [Getting Started](https://redirect.github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation. ### [`v2.3.3`](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.3): containerd 2.3.3 [Compare Source](https://redirect.github.com/containerd/containerd/compare/v2.3.2...v2.3.3) Welcome to the v2.3.3 release of containerd! The third patch release for containerd 2.3 contains various fixes and updates. ##### Highlights - Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ([#​13694](https://redirect.github.com/containerd/containerd/pull/13694)) ##### Container Runtime Interface (CRI) - Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ([#​13697](https://redirect.github.com/containerd/containerd/pull/13697)) - Reject CreateContainer calls when the target sandbox is not running ([#​13668](https://redirect.github.com/containerd/containerd/pull/13668)) - Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ([#​13645](https://redirect.github.com/containerd/containerd/pull/13645)) ##### Image Distribution - Surface OCI error bodies in registry 403 responses by falling back to GET requests ([#​13738](https://redirect.github.com/containerd/containerd/pull/13738)) ##### Snapshotters - Align default 4K mkfs block size for EROFS across all platforms ([#​13632](https://redirect.github.com/containerd/containerd/pull/13632)) Please try out the release binaries and report any issues at <https://github.com/containerd/containerd/issues>. ##### Contributors - Maksym Pavlenko - Samuel Karp - Chris Henzie - Phil Estes - Sebastiaan van Stijn - Akihiro Suda - Austin Vazquez - Chris Crone - Derek McGowan - Maksim An - crawfordxx - cshung - lauralorenz ##### Changes <details><summary>14 commits</summary> <p> - Prepare release notes for v2.3.3 ([#​13750](https://redirect.github.com/containerd/containerd/pull/13750)) - [`7f6cee02a`](https://redirect.github.com/containerd/containerd/commit/7f6cee02ad5afc5f3244ec36937d8eed61f7057d) Prepare release notes for v2.3.3 - CI: migrate Vagrant to Lima ([#​13744](https://redirect.github.com/containerd/containerd/pull/13744)) - [`7316210ce`](https://redirect.github.com/containerd/containerd/commit/7316210ce6bd95e8afd2856e256b5d9855385d01) CI: migrate Vagrant to Lima - remotes: surface OCI error body in registry 4xx responses ([#​13738](https://redirect.github.com/containerd/containerd/pull/13738)) - [`457fba3a3`](https://redirect.github.com/containerd/containerd/commit/457fba3a380dab10ef7e9334352352f72caf8423) remotes: surface OCI error body on HEAD 403 via GET fallback - Update go to 1.26.5 ([#​13732](https://redirect.github.com/containerd/containerd/pull/13732)) - [`dc2df934e`](https://redirect.github.com/containerd/containerd/commit/dc2df934efebc78523d6821c2520f538ff65986d) Update go to 1.26.5 - ci: pin fog-json to resolve gem conflict ([#​13711](https://redirect.github.com/containerd/containerd/pull/13711)) - [`5be0495df`](https://redirect.github.com/containerd/containerd/commit/5be0495dff529910a85b6ca1b2a1a35ea220da59) ci: pin fog-json to resolve gem conflict - Fix nil pointer dereference in NRI GetIPs ([#​13697](https://redirect.github.com/containerd/containerd/pull/13697)) - [`36c713971`](https://redirect.github.com/containerd/containerd/commit/36c7139715fee7ff2f87f78a8b3d6fea4e2e7b35) Fix nil pointer dereference in NRI GetIPs - Set SystemTemp env var to config temp on Windows ([#​13694](https://redirect.github.com/containerd/containerd/pull/13694)) - [`26dce170d`](https://redirect.github.com/containerd/containerd/commit/26dce170df24e227aeb5ccd1cec1e5c91b307595) Set SystemTemp env var to config temp on Windows - update runhcs to v0.15.0-rc.3 ([#​13693](https://redirect.github.com/containerd/containerd/pull/13693)) - [`9bc2c2349`](https://redirect.github.com/containerd/containerd/commit/9bc2c23496073c3b48b083f6bede9e82d879a7d4) update runhcs to v0.15.0-rc.3 - Update to current setup-go version ([#​13686](https://redirect.github.com/containerd/containerd/pull/13686)) - [`3e97edeb7`](https://redirect.github.com/containerd/containerd/commit/3e97edeb7d3dfcee903c37ab531b1fdfe0a49ae4) Update to current setup-go version - cri: reject CreateContainer when sandbox is not running ([#​13668](https://redirect.github.com/containerd/containerd/pull/13668)) - [`8856b0f9c`](https://redirect.github.com/containerd/containerd/commit/8856b0f9c3ae50efe6f2a84ab7337953faeb129f) cri: reject CreateContainer when sandbox is not running - update runhcs to v0.15.0-rc.2 ([#​13666](https://redirect.github.com/containerd/containerd/pull/13666)) - [`ae796cec5`](https://redirect.github.com/containerd/containerd/commit/ae796cec596341f3db4ea324199b83670aaa8162) update runhcs to v0.15.0-rc.2 - test: fix flaky image timestamp check on coarse clocks ([#​13643](https://redirect.github.com/containerd/containerd/pull/13643)) - [`168d56783`](https://redirect.github.com/containerd/containerd/commit/168d56783608354301e6f6dfb3ceb9af342c7dde) test: fix flaky image timestamp check on coarse clocks - Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks ([#​13645](https://redirect.github.com/containerd/containerd/pull/13645)) - [`d1db61db8`](https://redirect.github.com/containerd/containerd/commit/d1db61db8d6b59cdb27e5e1843911ad12e25a5e7) Add deferred call to ShutdownSandbox to avoid leaks - erofs: align default mkfs block size across platforms ([#​13632](https://redirect.github.com/containerd/containerd/pull/13632)) - [`01b0f03f6`](https://redirect.github.com/containerd/containerd/commit/01b0f03f676c19bf5beca591524f274b61537694) erofs: align default mkfs block size across platforms </p> </details> ##### Dependency Changes This release has no dependency changes Previous release can be found at [v2.3.2](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.2) ##### Which file should I download? - `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04). - `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent. In addition to containerd, typically you will have to install [runc](https://redirect.github.com/opencontainers/runc/releases) and [CNI plugins](https://redirect.github.com/containernetworking/plugins/releases) from their official sites too. See also the [Getting Started](https://redirect.github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation. ### [`v2.3.2`](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.2): containerd 2.3.2 [Compare Source](https://redirect.github.com/containerd/containerd/compare/v2.3.1...v2.3.2) Welcome to the v2.3.2 release of containerd! The second patch release for containerd 2.3 contains various fixes and updates including security patches. ##### Security Updates - **containerd** - [**CVE-2026-50195**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574) - [**CVE-2026-53488**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp) - [**CVE-2026-53492**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc) - [**CVE-2026-53489**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388) - [**CVE-2026-47262**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq) ##### Highlights - Fix a data race when reading shim logs on Windows ([#​13522](https://redirect.github.com/containerd/containerd/pull/13522)) ##### Image Distribution - Allow the last host to retry on transient network errors ([#​13591](https://redirect.github.com/containerd/containerd/pull/13591)) ##### Runtime - Fix container startup failures caused by concurrent task RPC timeouts during slow container creation ([#​13512](https://redirect.github.com/containerd/containerd/pull/13512)) Please try out the release binaries and report any issues at <https://github.com/containerd/containerd/issues>. ##### Contributors - Samuel Karp - Chris Henzie - Akihiro Suda - Derek McGowan - Akhil Mohan - Austin Vazquez - Ben Cressey - Brian Goff - Maksym Pavlenko - Sebastiaan van Stijn - Sergey Kanzhelev ##### Changes <details><summary>30 commits</summary> <p> - Prepare release notes for v2.3.2 ([#​13627](https://redirect.github.com/containerd/containerd/pull/13627)) - [`fb8ca00b0`](https://redirect.github.com/containerd/containerd/commit/fb8ca00b051fa9a9187502b16620fdb46595f1b7) Prepare release notes for v2.3.2 - [`9c69960ba`](https://redirect.github.com/containerd/containerd/commit/9c69960ba495c0aa08797be3f17b3c7712d17a22) Merge commit from fork - [`0f6251520`](https://redirect.github.com/containerd/containerd/commit/0f6251520569a25f0b52158a97d035726e6af9d2) Merge commit from fork - [`91d7471e2`](https://redirect.github.com/containerd/containerd/commit/91d7471e2cc7113c31dbcc62007756ba88f8cf9f) cri: filter CDI annotations on checkpoint restore - [`7c2e086bf`](https://redirect.github.com/containerd/containerd/commit/7c2e086bf31a4402cc19817df3b05ffd74d454e6) Merge commit from fork - [`dae67765f`](https://redirect.github.com/containerd/containerd/commit/dae67765f2d51ca3e67190c26e51edf496dd4cf4) cri: do not re-tag restored checkpoints - [`94aa1e2c1`](https://redirect.github.com/containerd/containerd/commit/94aa1e2c1a6ebadf2578fabe85ba7845e1e553c0) Merge commit from fork - [`09599078f`](https://redirect.github.com/containerd/containerd/commit/09599078f66bb98f6e83087893e3f2349b019fe7) cri: make checkpoint restore robust to unexpected archive content - [`e1fdb8d22`](https://redirect.github.com/containerd/containerd/commit/e1fdb8d221a27ce017264875e3658d021511ba0c) Merge commit from fork - [`ff1d116ef`](https://redirect.github.com/containerd/containerd/commit/ff1d116ef9c2d7505306d7d367ef46ff0756460b) Bound user-database file reads in openUserFile - [`d156e07cb`](https://redirect.github.com/containerd/containerd/commit/d156e07cbe61331f77b72e3603d8b6d67dda59e5) Merge commit from fork - [`f99aad54a`](https://redirect.github.com/containerd/containerd/commit/f99aad54af507168a1393dfae1559fde4cae9b2c) Do not propagate reserved labels from image configs - vendor: golang.org/x/crypto v0.53.0 ([#​13608](https://redirect.github.com/containerd/containerd/pull/13608)) - [`0b9469501`](https://redirect.github.com/containerd/containerd/commit/0b9469501257584fc8ff32c8160dbda3501e99cc) [release/2.3] vendor: golang.org/x/crypto v0.53.0 - resolver: retry on transient network errors ([#​13591](https://redirect.github.com/containerd/containerd/pull/13591)) - [`983bbddc1`](https://redirect.github.com/containerd/containerd/commit/983bbddc139c607700259a2bec519e7026018c6f) resolver: retry on transient network errors - update runc binary to v1.4.3 ([#​13601](https://redirect.github.com/containerd/containerd/pull/13601)) - [`3f76f2dc1`](https://redirect.github.com/containerd/containerd/commit/3f76f2dc1863820a2192af9dcf07584b61db778e) update runc binary to v1.4.3 - update go to 1.26.4 ([#​13580](https://redirect.github.com/containerd/containerd/pull/13580)) - [`8a49dfe85`](https://redirect.github.com/containerd/containerd/commit/8a49dfe854c1fe869e1531662bef76720104f20b) update go to 1.26.4 - [`5aa6bb2b7`](https://redirect.github.com/containerd/containerd/commit/5aa6bb2b7155a246a05872c70ea8e63e1e69ee70) remove 1.26.2 from CI builds as it is not supported any longer due to the dependency - Configure udevd children-max for root-test ([#​13568](https://redirect.github.com/containerd/containerd/pull/13568)) - [`bfb8aebc0`](https://redirect.github.com/containerd/containerd/commit/bfb8aebc07d75608fdb70a6f5592a5bfd753475b) Configure udevd children-max for root-test - core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read ([#​13522](https://redirect.github.com/containerd/containerd/pull/13522)) > [!IMPORTANT] > ✂ PR body was truncated to here. </details> </details> <details> <summary>envoyproxy/gateway (github.com/envoyproxy/gateway)</summary> ### [`v1.8.3`](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.8.3) [Compare Source](https://redirect.github.com/envoyproxy/gateway/compare/v1.8.2...v1.8.3) ##### Release Announcement Check out the [v1.8.3 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.3) to learn more about the release. ##### What's Changed - [release-1.8]: bump the gomod group across 1 directory with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9389> - [release-1.8]: bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9435> - [release-1.8]: bump the actions group across 1 directory with 6 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9440> - [release-1.8]: bump the actions group across 1 directory with 7 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9507> - [release-1.8]: bump the gomod group across 1 directory with 4 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9502> - [release-1.8]: bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9503> - [release-1.8]: bump distroless/base-nossl from `20f009e` to `86554c4` in /tools/docker/envoy-gateway by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9497> - fix: reject TLS secret when certificate and private key do not match by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/9487> - [release-1.8] release notes and version bump for v1.8.3 by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/9520> - [release-1.8] V1.8.3 cherry picks by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/9540> - [release-1.8]: bump the gomod group across 1 directory with 7 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9547> - [release-1.8]: bump the actions group across 2 directories with 6 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9551> - [release-1.8] fix: update ratelimit image fallback tag in helm helpers by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/9552> **Full Changelog**: <https://github.com/envoyproxy/gateway/compare/v1.8.2...v1.8.3> ### [`v1.8.2`](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.8.2) [Compare Source](https://redirect.github.com/envoyproxy/gateway/compare/v1.8.1...v1.8.2) ##### Release Announcement Check out the [v1.8.2 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.2) to learn more about the release. ##### What's Changed - [chore] bump codecov by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/9264> - [release-1.8] chore: bump base image by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/9263> - build(deps): bump the actions group across 1 directory with 8 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9284> - build(deps): bump busybox from `1487d0a` to `fd8d9aa` in /tools/docker/envoy-gateway by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9275> - [release-1.8]: bump the gomod group across 1 directory with 24 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9304> - [release-1.8]: bump helm.sh/helm/v3 from 3.21.0 to 3.21.2 in the gomod group across 1 directory by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9326> - [release-1.8]: bump actions/setup-go from 6.4.0 to 6.5.0 in /tools/github-actions/setup-deps in the actions group across 1 directory by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/9330> - [release-1.8] release notes and version bump for v1.8.2 by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/9364> - [release-1.8] cherry-pick for v1.8.2 by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/9376> **Full Changelog**: <https://github.com/envoyproxy/gateway/compare/v1.8.1...v1.8.2> ### [`v1.8.1`](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.8.1) [Compare Source](https://redirect.github.com/envoyproxy/gateway/compare/v1.8.0...v1.8.1) ##### Release Announcement Check out the [v1.8.1 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.1) to learn more about the release. ##### What's Changed - [release/v1.8] fix: add unary interceptor and fix fail-open auth in GatewayNamespaceMode (#8986) by [@​cnvergence](https://redirect.github.com/cnvergence) in <https://github.com/envoyproxy/gateway/pull/9118> - [release-1.8] bump envoy to 1.38.1 by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/9168> - [release/v1.8] cherry-pick for v1.8.1 by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/9169> - [release-1.8] fix github SA for June release by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/9172> - [release-1.8] cherry-pick release notes and version bump by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/9174> **Full Changelog**: <https://github.com/envoyproxy/gateway/compare/v1.8.0...v1.8.1> ### [`v1.8.0`](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.8.0) [Compare Source](https://redirect.github.com/envoyproxy/gateway/compare/v1.7.5...v1.8.0) ##### Release Announcement Check out the [v1.8.0 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.8.0) to learn more about the release. ##### What's Changed - e2e: speed tracing tests by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8124> - fix(translator): allow single-label backends in host mode by [@​codefromthecrypt](https://redirect.github.com/codefromthecrypt) in <https://github.com/envoyproxy/gateway/pull/8123> - ci: release json report by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8107> - fix oidc flakiness by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8119> - fix: skip_test_workflow doesn't exist by [@​dylanmtaylor](https://redirect.github.com/dylanmtaylor) in <https://github.com/envoyproxy/gateway/pull/8116> - fix e2e test panic by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8109> - chore: bump func-e to v1.4.0 by [@​codefromthecrypt](https://redirect.github.com/codefromthecrypt) in <https://github.com/envoyproxy/gateway/pull/8105> - fix: route idle timeout by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8058> - docs: add Mirakl to adopters list by [@​twandja](https://redirect.github.com/twandja) in <https://github.com/envoyproxy/gateway/pull/8138> - docs: add security warning to control plane extensions by [@​guydc](https://redirect.github.com/guydc) in <https://github.com/envoyproxy/gateway/pull/7967> - chore: add lint for release notes filenames by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8137> - fix: remove global logger in message package by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8131> - docs: fix url result of regex rewrite by [@​SadmiB](https://redirect.github.com/SadmiB) in <https://github.com/envoyproxy/gateway/pull/7864> - chore: log skipped xds by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8132> - docs: fixes for OPA sidecar + Unix Domain Socket task by [@​millermatt](https://redirect.github.com/millermatt) in <https://github.com/envoyproxy/gateway/pull/8142> - fix: basic auth validation by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8053> - fix: controller cache-sync readiness check by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/7430> - fix: replace context.TODO with timeout context in config dump by [@​jaffarkeikei](https://redirect.github.com/jaffarkeikei) in <https://github.com/envoyproxy/gateway/pull/8122> - refactor: convert IR map fields to slices to ensure deterministic Dee… by [@​Junnygram](https://redirect.github.com/Junnygram) in <https://github.com/envoyproxy/gateway/pull/7953> - fix links in releasing and develop docs by [@​cnvergence](https://redirect.github.com/cnvergence) in <https://github.com/envoyproxy/gateway/pull/8141> - docs: add provider guide for entra by [@​oliverbaehler](https://redirect.github.com/oliverbaehler) in <https://github.com/envoyproxy/gateway/pull/7977> - chore: clean up test output files by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8154> - fix: TCPRoute mTLS didn't work by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8152> - v1.7.0-rc2 release notes by [@​cnvergence](https://redirect.github.com/cnvergence) in <https://github.com/envoyproxy/gateway/pull/8163> - chore(docs): Update Azure Entra link in OIDC guide by [@​guydc](https://redirect.github.com/guydc) in <https://github.com/envoyproxy/gateway/pull/8167> - fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8153> - build(deps): bump the actions group across 1 directory with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8178> - fix: skip provision when IR Infra is invalid by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/7754> - docs: add HTTP header and method based authentication task by [@​Aditya7880900936](https://redirect.github.com/Aditya7880900936) in <https://github.com/envoyproxy/gateway/pull/7990> - fix: Validation of XListenerSet certificateRefs by [@​krishicks](https://redirect.github.com/krishicks) in <https://github.com/envoyproxy/gateway/pull/8168> - fix: Remove whitespace for nodeSelector in deployment YAML - helm chart change by [@​jess-belliveau](https://redirect.github.com/jess-belliveau) in <https://github.com/envoyproxy/gateway/pull/8185> - [release/v1.7.0] release notes by [@​cnvergence](https://redirect.github.com/cnvergence) in <https://github.com/envoyproxy/gateway/pull/8188> - [release/v1.7] v1.7.0 release docs and announcement by [@​cnvergence](https://redirect.github.com/cnvergence) in <https://github.com/envoyproxy/gateway/pull/8191> - [release/v1.7.0] update eg upgrade test and fix ordering by [@​cnvergence](https://redirect.github.com/cnvergence) in <https://github.com/envoyproxy/gateway/pull/8195> - docs: reword updating shortcode prefixes in releasing.md by [@​cnvergence](https://redirect.github.com/cnvergence) in <https://github.com/envoyproxy/gateway/pull/8196> - build(deps): bump busybox from `e226d63` to `b3255e7` in /tools/docker/envoy-gateway by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8175> - build(deps): bump distroless/base-nossl from `16b3bc2` to `d90f132` in /tools/docker/envoy-gateway by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8174> - chore: enable `DisallowUnknownFields` for xds translator by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8203> - chore bump golang 1.25.7 by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8205> - build(deps): bump the gomod group across 1 directory with 11 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8177> - feat(helm): add commonLabels support to helm chart by [@​gaganhr94](https://redirect.github.com/gaganhr94) in <https://github.com/envoyproxy/gateway/pull/8078> - build(deps): bump the helm group across 1 directory with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8179> - fix(gatewayapi): reject ClientTrafficPolicy with invalid TLS cipher by [@​Junnygram](https://redirect.github.com/Junnygram) in <https://github.com/envoyproxy/gateway/pull/8040> - feat (translator): support optional health check configuration by [@​cryoshida](https://redirect.github.com/cryoshida) in <https://github.com/envoyproxy/gateway/pull/7959> - chore: install crds separated by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8223> - chore: fix make gen-check by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/7937> - fix: XListenerSet allows route from same namespace by [@​krishicks](https://redirect.github.com/krishicks) in <https://github.com/envoyproxy/gateway/pull/8226> - fix gateway api crd gen by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8238> - chore: fix flaky retry test by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8020> - feat: support ShadowMode in local ratelimit by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8076> - chore: add missing release notes for #8076 by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8243> - chore: remove useless address by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8216> - release notes for v1.6.4 by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8221> - release notes for v1.5.9 by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8219> - update release notes by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8253> - fix: re-enable ext-auth timeout test by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8070> - chore: fix ExtAuthTimeout flaky by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8255> - doc: bump v1.5.9 by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8256> - docs: bump version by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8257> - chore: Update default kind and metallb versions by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/8254> - chore: update v1.6 compatibility matrix versions by [@​rudrakhp](https://redirect.github.com/rudrakhp) in <https://github.com/envoyproxy/gateway/pull/8260> - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2 in the actions group across 1 directory by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8248> - build(deps): bump the k8s-io group across 1 directory with 6 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8249> - build(deps): bump the gomod group across 2 directories with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8246> - build(deps): bump the helm group across 1 directory with 5 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8250> - feat: enable command operators for httproute filter directresponse by [@​6ixfalls](https://redirect.github.com/6ixfalls) in <https://github.com/envoyproxy/gateway/pull/8183> - fix test race by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8180> - chore: update experimental conformance by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8269> - feat: jaX fingerprint support by [@​Inode1](https://redirect.github.com/Inode1) in <https://github.com/envoyproxy/gateway/pull/7983> - feat: support egctl config envoy-gateway by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8251> - fix: API key auth by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8267> - feat: Add WeightedZones to PreferLocalZones by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/7251> - docs: render crds in example install command by [@​NilsGriebner](https://redirect.github.com/NilsGriebner) in <https://github.com/envoyproxy/gateway/pull/8225> - chore: Fix JA Fingerprint ipv6 e2e by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/8298> - build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.36.1-0.20260127060829-c81ce9094f67 to 1.37.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8292> - build(deps): bump the actions group across 1 directory with 6 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8296> - build(deps): bump distroless/base-nossl from `d90f132` to `f8ebb45` in /tools/docker/envoy-gateway by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8290> - build(deps): bump prometheus from 28.9.0 to 28.9.1 in /charts/gateway-addons-helm in the helm group across 1 directory by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8297> - build(deps): bump the gomod group across 1 directory with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8303> - Use sub-chart for CRDs to reduce chart size by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/8283> - chore: gh action for running gen check by [@​rudrakhp](https://redirect.github.com/rudrakhp) in <https://github.com/envoyproxy/gateway/pull/8304> - fix: add mutex lock to snapshot cache OnStreamResponse/OnStreamDeltaResponse by [@​jaffarkeikei](https://redirect.github.com/jaffarkeikei) in <https://github.com/envoyproxy/gateway/pull/8277> - docs: update proxy protocol docs for client traffic policies by [@​kraashen](https://redirect.github.com/kraashen) in <https://github.com/envoyproxy/gateway/pull/8310> - fix release notes order in the docs by [@​cnvergence](https://redirect.github.com/cnvergence) in <https://github.com/envoyproxy/gateway/pull/8316> - e2e: improve SessionPersistence tests by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8207> - bump Gateway API v1.5.0-rc.1 by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8161> - feat: Add support for Dynamic Modules by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/8278> - fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies by [@​rudrakhp](https://redirect.github.com/rudrakhp) in <https://github.com/envoyproxy/gateway/pull/8210> - fix: exclude unmanaged route parents from xPolicy status ancestors by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8321> - fix(kubernetes): apply namespace selector filtering to List operations by [@​shahar-h](https://redirect.github.com/shahar-h) in <https://github.com/envoyproxy/gateway/pull/8312> - fix: samplingFraction not working by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8317> - chore: skip head repo check in gen check command by [@​rudrakhp](https://redirect.github.com/rudrakhp) in <https://github.com/envoyproxy/gateway/pull/8347> - build(deps): bump the actions group across 1 directory with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8342> - revist TLSRoute conformance test by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8345> - chore: adopt FailFast by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8335> - fix ConsistentHashLoadBalancing flaky by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8349> - build(deps): bump the helm group across 1 directory with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8343> - build(deps): bump sigs.k8s.io/gateway-api-inference-extension from 1.3.0 to 1.3.1 in /examples/extension-server by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8340> - fix ListenerSet conformance test by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8344> - bump Gateway API v1.5.0 by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8348> - fix: watch TLSRoute v1 by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8327> - fix attachedRoutes by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8187> - chore: update testdata on main by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/8370> - docs: add custom redirect BTP task by [@​rudrakhp](https://redirect.github.com/rudrakhp) in <https://github.com/envoyproxy/gateway/pull/8357> - feat: Implement RoutingType BTP by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/8173> - Add retriableStatuses for healthchecks by [@​akardaspg](https://redirect.github.com/akardaspg) in <https://github.com/envoyproxy/gateway/pull/8306> - [gatewayapi] skip unused BTP routing index work by [@​arkodg](https://redirect.github.com/arkodg) in <https://github.com/envoyproxy/gateway/pull/8375> - fix(host): eliminate spurious error logs in standalone mode by [@​codefromthecrypt](https://redirect.github.com/codefromthecrypt) in <https://github.com/envoyproxy/gateway/pull/8287> - feat: Support AlwaysEjectOneHost configuration in Outlier Detection by [@​Inode1](https://redirect.github.com/Inode1) in <https://github.com/envoyproxy/gateway/pull/8149> - chore: remove existence check for v1 CRDs by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8365> - feat(envoyextensionpolicy): Implement TLS configuration for WASM code source. by [@​achernev](https://redirect.github.com/achernev) in <https://github.com/envoyproxy/gateway/pull/7865> - feat: invalid listener should not block IR by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8194> - fix TestWasmTLSIndexers and test gen by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8384> - feat: HTTPRoute support 303 307 308 redirect by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8182> - chore: bump golang.org/x/net by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8394> - fix: computeHosts doesn't work when listener and route both wildcard by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8186> - docs: fix cors exemples in security-policy.md by [@​TanguyPatte](https://redirect.github.com/TanguyPatte) in <https://github.com/envoyproxy/gateway/pull/8408> - fix: support cross-ns for SecretObjectReference by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8074> - api: Add source type structure for dynamic modules by [@​jukie](https://redirect.github.com/jukie) in <https://github.com/envoyproxy/gateway/pull/8359> - ci: fix flaky e2e tests by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8388> - ci: run conformance test with standard channel by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8367> - chore: fix gen by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8418> - fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8387> - api: GeoIP by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8002> - feat(securitypolicy): add MergeType support for policy merging by [@​rajatvig](https://redirect.github.com/rajatvig) in <https://github.com/envoyproxy/gateway/pull/7918> - chore: lower the qps to mitigate flaky upgrade test by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8415> - chore: fix gen by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8426> - chore: fix gen check by [@​rudrakhp](https://redirect.github.com/rudrakhp) in <https://github.com/envoyproxy/gateway/pull/8437> - feat: support grpc web settings by [@​kkk777-7](https://redirect.github.com/kkk777-7) in <https://github.com/envoyproxy/gateway/pull/8147> - build(deps): bump the actions group across 2 directories with 7 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8433> - build(deps): bump the helm group across 1 directory with 5 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8404> - build(deps): bump distroless/base-nossl from `f8ebb45` to `ae8c000` in /tools/docker/envoy-gateway by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8398> - build(deps): bump the gomod group across 1 directory with 12 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8400> - chore: fix gen by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8440> - test: fix flaky RouteStatNameTest and refactor by [@​Arpit529Srivastava](https://redirect.github.com/Arpit529Srivastava) in <https://github.com/envoyproxy/gateway/pull/8368> - e2e: remove HTTPRoute CORS test by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8443> - fix: add ownerReferences to ratelimit ConfigMap and HPA by [@​Teja079](https://redirect.github.com/Teja079) in <https://github.com/envoyproxy/gateway/pull/8358> - test: add unit tests for ratelimit UnitToSeconds and UnitToDuration by [@​archy-rock3t-cloud](https://redirect.github.com/archy-rock3t-cloud) in <https://github.com/envoyproxy/gateway/pull/8396> - chore: fix oidc flakiness by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8423> - fix: handle network errors in rate limit e2e tests by [@​rudrakhp](https://redirect.github.com/rudrakhp) in <https://github.com/envoyproxy/gateway/pull/8446> - chore: mute OSV scanner & Trivy by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8444> - refactor/perf: use LuaPerRoute instead of FilterConfig by [@​rudrakhp](https://redirect.github.com/rudrakhp) in <https://github.com/envoyproxy/gateway/pull/8355> - e2e: reduce consistent hash flaky by [@​zirain](https://redirect.github.com/zirain) in <https://github.com/envoyproxy/gateway/pull/8371> - fix: multiple gc e2e by [@​kkk777-7](https://redirect.github.com/kkk777-7) in <https://github.com/envoyproxy/gateway/pull/8448> - build(deps): bump sigs.k8s.io/gateway-api-inference-extension from 1.3.1 to 1.4.0 in /examples/extension-server by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8402> - build(deps): bump the k8s-io group across 1 directory with 6 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in <https://github.com/envoyproxy/gateway/pull/8401> - raise RL rule imit to 256 by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8451> - fix oidc flakiness by [@​zhaohuabing](https://redirect.github.com/zhaohuabing) in <https://github.com/envoyproxy/gateway/pull/8469> > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: rdesgroppes <[email protected]> Co-authored-by: dd-octo-sts[bot] <200755185…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Simplified, backport-safe version of #9480 fixing the TLS regressions in #9473, #9463 and #9225. Validates TLS Secrets at translation and isolates failures to the affected listener instead of pushing a broken chain that Envoy NACKs with
KEY_VALUES_MISMATCH(which stalls all Gateways under mergeGateways): rejects mismatched key/cert pairs, and rejects serving chains containing an expired/malformed cert instead of silently dropping the member. CA bundles still drop expired CAs. #9480's broader validation could break existing v1.8 use cases.Related: #9225 #9473 #9463