edge-25.9.1

What's Changed

• build(deps): bump tracing-subscriber from 0.3.19 to 0.3.20 by @dependabot[bot] in #14427
• build(deps): bump indexmap from 2.10.0 to 2.11.0 by @dependabot[bot] in #14419
• build(deps): bump form_urlencoded from 1.2.1 to 1.2.2 by @dependabot[bot] in #14420
• build(deps): bump io-uring from 0.7.9 to 0.7.10 by @dependabot[bot] in #14422
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14421
• build(deps): bump thiserror from 2.0.12 to 2.0.16 by @dependabot[bot] in #14423
• build(deps): bump the kube group with 8 updates by @dependabot[bot] in #14424
• build(deps): bump google-github-actions/auth from 2.1.12 to 3.0.0 by @dependabot[bot] in #14425
• build(deps): bump google-github-actions/setup-gcloud from 3.0.0 to 3.0.1 in /.github/actions/helm-publish by @dependabot[bot] in #14426
• build(deps-dev): bump @babel/runtime from 7.27.6 to 7.28.3 in /web/app by @dependabot[bot] in #14429
• build(deps): bump core-js from 3.44.0 to 3.45.1 in /web/app by @dependabot[bot] in #14430
• build(deps): bump @fortawesome/react-fontawesome from 0.2.2 to 0.2.6 in /web/app by @dependabot[bot] in #14431
• build(deps-dev): bump jest-environment-jsdom from 30.0.4 to 30.1.1 in /web/app by @dependabot[bot] in #14432
• build(deps): bump proc-macro2 from 1.0.96 to 1.0.101 by @dependabot[bot] in #14435
• build(deps): bump cc from 1.2.34 to 1.2.35 by @dependabot[bot] in #14437
• build(deps): bump prettyplease from 0.2.36 to 0.2.37 by @dependabot[bot] in #14438
• build(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @dependabot[bot] in #14436
• proxy: v2.317.0 by @l5d-bot in #14439
• build(deps): bump bitflags from 2.9.3 to 2.9.4 by @dependabot[bot] in #14440
• build(deps): bump the clap group with 3 updates by @dependabot[bot] in #14441
• build(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10 by @dependabot[bot] in #14442
• build(deps): bump regex-syntax from 0.8.5 to 0.8.6 by @dependabot[bot] in #14443
• Add Sophotech to adopters list by @archy-rock3t-cloud in #14448
• build(deps): bump regex-automata from 0.4.8 to 0.4.10 by @dependabot[bot] in #14444
• build(deps): bump log from 0.4.27 to 0.4.28 by @dependabot[bot] in #14449
• build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in #14450
• build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by @dependabot[bot] in #14446

New Contributors

• @archy-rock3t-cloud made their first contribution in #14448

Full Changelog: edge-25.8.5...edge-25.9.1

edge-25.8.5

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release adds timeout and gateway error metrics to linkerd multicluster check, to better validate multicluster functionality.

What's Changed

• fix(ci): remove windows_static_cli_tests by @cratelyn in #14406
• build(deps): bump ppv-lite86 from 0.2.20 to 0.2.21 by @dependabot[bot] in #14376
• build(deps): bump cfg-if from 1.0.1 to 1.0.3 by @dependabot[bot] in #14408
• build(deps): bump bitflags from 2.9.1 to 2.9.3 by @dependabot[bot] in #14409
• build(deps): bump async-trait from 0.1.88 to 0.1.89 by @dependabot[bot] in #14377
• build(deps-dev): bump @babel/core from 7.28.0 to 7.28.3 in /web/app by @dependabot[bot] in #14381
• build(deps-dev): bump html-webpack-plugin from 5.6.3 to 5.6.4 in /web/app by @dependabot[bot] in #14384
• build(deps): bump helm.sh/helm/v3 from 3.18.5 to 3.18.6 by @dependabot[bot] in #14394
• build(deps): bump azure/setup-helm from 4.3.0 to 4.3.1 by @dependabot[bot] in #14396
• build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @dependabot[bot] in #14400
• build(deps-dev): bump @babel/preset-env from 7.28.0 to 7.28.3 in /web/app by @dependabot[bot] in #14383
• build(deps): bump google.golang.org/grpc from 1.74.2 to 1.75.0 by @dependabot[bot] in #14395
• build(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.8 by @dependabot[bot] in #14399
• build(deps): bump ahash from 0.8.11 to 0.8.12 by @dependabot[bot] in #14378
• fix(multicluster): Do not ignore timeout and gateway metrics errors during multicluster check by @zaharidichev in #14418
• proxy: v2.316.0 by @l5d-bot in #14417
• build(deps): bump cc from 1.2.33 to 1.2.34 by @dependabot[bot] in #14414
• build(deps): bump regex-lite from 0.1.6 to 0.1.7 by @dependabot[bot] in #14415
• build(deps): bump percent-encoding from 2.3.1 to 2.3.2 by @dependabot[bot] in #14416
• build(deps): bump regex from 1.11.1 to 1.11.2 by @dependabot[bot] in #14413
• build(deps): bump tj-actions/changed-files from 2036da178f85576f1940fedb74bb93a36cd89ab7 to 3b04099b21072562f07469c10deb182b24236ca9 by @dependabot[bot] in #14411
• build(deps): bump google-github-actions/setup-gcloud from 2.2.0 to 3.0.0 in /.github/actions/helm-publish by @dependabot[bot] in #14410
• build(deps-dev): bump webpack from 5.100.2 to 5.101.3 in /web/app by @dependabot[bot] in #14407

Full Changelog: edge-25.8.4...edge-25.8.5

edge-25.8.4

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release supports setting proxy.securityContext and networkValidator.securityContext to provide a custom security context for the linkerd-proxy container, and the network-validator container, respectively. It also switches the proxy to prefer post-quantum key exchange algorithm X25519MLKEM768.

What's Changed

• chore(ci)!: update CLI build pipeline by @olix0r in #14360
• build(deps): bump hashbrown from 0.15.2 to 0.15.5 by @dependabot[bot] in #14379
• proxy: v2.314.0 by @l5d-bot in #14388
• build(deps): bump hyper from 1.6.0 to 1.7.0 by @dependabot[bot] in #14390
• build(deps): bump cc from 1.2.32 to 1.2.33 by @dependabot[bot] in #14391
• chore(deps): bump extension-init from 0.1.6 to 0.1.7 by @cratelyn in #14392
• build(deps): bump sigs.k8s.io/kustomize/kyaml from 0.19.0 to 0.20.1 by @dependabot[bot] in #14375
• build(deps): bump syn from 2.0.105 to 2.0.106 by @dependabot[bot] in #14393
• feature(values): provide way to set custom securityContext for the pr… by @zaharidichev in #14347
• proxy: v2.315.0 by @l5d-bot in #14401
• fix(cli): install openssl in dockerfile by @cratelyn in #14403
• build(deps): bump serde_json from 1.0.142 to 1.0.143 by @dependabot[bot] in #14398
• fix(ci): cli tests need cli by @cratelyn in #14404
• fix(ci): double cli-build workflow timeout by @cratelyn in #14405

Full Changelog: edge-25.8.3...edge-25.8.4

edge-25.8.3

Overall status: RECOMMENDED

Cautions

This release eliminates the separate policy-controller image, instead including the policy controller in the main controller image. This means that the policyController.image Helm value is now ignored.

Changes

This release eliminates the separate policy-controller image to reduce image-pull traffic somewhat. It also adds a new rustls_info metric to make visible which cryptographic provider and algorithms are in use.

What's Changed

• build(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 by @dependabot[bot] in #14335
• build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.7 by @dependabot[bot] in #14337
• build(deps): bump cc from 1.2.31 to 1.2.32 by @dependabot[bot] in #14343
• build(deps): bump rustversion from 1.0.21 to 1.0.22 by @dependabot[bot] in #14340
• build(deps): bump proc-macro2 from 1.0.95 to 1.0.96 by @dependabot[bot] in #14342
• build(deps): bump slab from 0.4.10 to 0.4.11 by @dependabot[bot] in #14341
• build(deps): bump google-github-actions/setup-gcloud from 2.1.5 to 2.2.0 in /.github/actions/helm-publish by @dependabot[bot] in #14344
• build(deps): bump golang.org/x/tools from 0.35.0 to 0.36.0 by @dependabot[bot] in #14336
• chore(inject): remove PatchProducer abstraction by @zaharidichev in #14346
• chore(identity): add !windows tag in run_proxy_unix.go by @zaharidichev in #14345
• chore(ci): disable fail-fast on test matrixes by @olix0r in #14349
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #14353
• build(deps): bump libc from 0.2.174 to 0.2.175 by @dependabot[bot] in #14355
• build(deps): bump glob from 0.3.2 to 0.3.3 by @dependabot[bot] in #14352
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14356
• build(deps): bump anyhow from 1.0.98 to 1.0.99 by @dependabot[bot] in #14357
• chore(ci): reduce integration test timeouts by @olix0r in #14358
• proxy: v2.313.0 by @l5d-bot in #14362
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14361
• build(deps): bump tj-actions/changed-files from 8cdfb7636d150253dee416a80f11c67f5ba7e9be to 239aef84a5502c79a1cea96e495d17588c66c659 by @dependabot[bot] in #14363
• chore(bin): remove install-pr script by @olix0r in #14364
• chore(ci): use docker/login-action by @olix0r in #14359
• chore(deps): Update tonic deps to 0.13 by @sfleen in #14365
• build(controller)!: eliminate policy-controller image by @olix0r in #14348
• build(deps): bump syn from 2.0.104 to 2.0.105 by @dependabot[bot] in #14366
• build(deps): bump indexmap from 2.2.6 to 2.10.0 by @dependabot[bot] in #14367
• build(deps): bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #14373
• build(deps): bump rand_core from 0.9.0 to 0.9.3 by @dependabot[bot] in #14368
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #14369
• build(deps): bump tj-actions/changed-files from 239aef84a5502c79a1cea96e495d17588c66c659 to 2036da178f85576f1940fedb74bb93a36cd89ab7 by @dependabot[bot] in #14372
• build(deps): bump github.com/linkerd/linkerd2-proxy-api from 0.16.0 to 0.17.0 by @dependabot[bot] in #14371
• build(deps): bump helm.sh/helm/v3 from 3.18.4 to 3.18.5 by @dependabot[bot] in #14370
• fix(ci): use correct GHCR creds by @zaharidichev in #14374

Full Changelog: edge-25.8.2...edge-25.8.3

edge-25.8.2

Overall status: RECOMMENDED

Cautions

This release switches the default command for programming the routing table from iptables-legacy to iptables-nft.

Changes

This release switches the default command for programming the routing table from iptables-legacy to iptables-nft. (If you need to continue to use iptables-legacy, set proxyInit.iptablesMode: legacy in the linkerd2-control-plane chart if you're using the init container, or iptablesMode: legacy in the linkerd2-cni chart if you're using the CNI plugin.)

What's Changed

• build(deps): bump tokio from 1.47.0 to 1.47.1 by @dependabot[bot] in #14316
• build(deps): bump event-listener from 5.4.0 to 5.4.1 by @dependabot[bot] in #14318
• build(deps): bump tokio-util from 0.7.15 to 0.7.16 by @dependabot[bot] in #14319
• build(deps): bump cc from 1.2.30 to 1.2.31 by @dependabot[bot] in #14317
• build(deps): bump signal-hook-registry from 1.4.5 to 1.4.6 by @dependabot[bot] in #14320
• build(deps): bump tj-actions/changed-files from 94d97fe3f88298bf8b2f2db6fa2ab150f3c1ab77 to c2ca2493190021783138cb8aac49bcee14b4bb89 by @dependabot[bot] in #14321
• build(deps): bump google-github-actions/auth from 2.1.11 to 2.1.12 by @dependabot[bot] in #14322
• chore(policy-controller): Use the aws-lc-rs TLS backend by @sfleen in #14300
• build(deps): bump tj-actions/changed-files from c2ca2493190021783138cb8aac49bcee14b4bb89 to 8cdfb7636d150253dee416a80f11c67f5ba7e9be by @dependabot[bot] in #14323
• chore(policy): Remove OpenSSL from the policy controller by @sfleen in #14292
• chore(extension-init): Bump extension-init to v0.1.5 by @sfleen in #14324
• fix: Allow aws-lc-fips-sys licenses in deny.toml by @sfleen in #14328
• proxy: v2.312.0 by @l5d-bot in #14327
• chore(extension-init): Bump extension-init to v0.1.6 by @sfleen in #14329
• chore(helm)!: change iptables default mode to nft by @alpeb in #14326
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #14325
• build(deps): bump tokio-metrics from 0.4.3 to 0.4.4 by @dependabot[bot] in #14332
• build(deps): bump h2 from 0.4.11 to 0.4.12 by @dependabot[bot] in #14331
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14330
• fix(policy): Fix env vars for building for arm64 by @sfleen in #14334

Full Changelog: edge-25.8.1...edge-25.8.2

edge-25.8.1

Overall status: RECOMMENDED

Cautions

This release removes support for ARMv7, notably including 32-bit Raspberry Pi platforms. As far as we know, no one is actively using Linkerd on these platforms.

Changes

This release fixes an issue (#14289) where native-sidecar proxies would land in an error state after the main container exited. It also correctly sets app.kubernetes.io/version label to list linkerd/cli instead of linkerd/helm when installing a Linkerd extension using the CLI, and it removes support for ARMv7, notably including 32-bit Raspberry Pi platforms.

What's Changed

• build(deps): bump backon from 1.5.1 to 1.5.2 by @dependabot[bot] in #14301
• build(deps): bump rustls from 0.23.30 to 0.23.31 by @dependabot[bot] in #14296
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14295
• build(deps): bump tj-actions/changed-files from db8d0bfea5a44e51abd5dc1454386c668ae901f9 to 18b05b98fcd9dc0bd3870d7a6571535999ba0c3f by @dependabot[bot] in #14302
• feat!(ci): Remove arm/v7 support by @sfleen in #14308
• build(deps): bump tj-actions/changed-files from 18b05b98fcd9dc0bd3870d7a6571535999ba0c3f to 94d97fe3f88298bf8b2f2db6fa2ab150f3c1ab77 by @dependabot[bot] in #14306
• build(deps): bump github.com/prometheus/client_golang from 1.22.0 to 1.23.0 by @dependabot[bot] in #14305
• build(deps): bump serde_json from 1.0.141 to 1.0.142 by @dependabot[bot] in #14304
• fix(proxy-identity): use execve call on Linux to start the proxy by @zaharidichev in #14307
• fix(helm): Fix cli version string in extensions by @adleong in #14309
• build(deps): bump linkerd-cni from 1.6.3 to 1.6.4 by @alpeb in #14310
• build(deps): bump network-validator from 0.1.3 to 0.1.4 by @alpeb in #14311

Full Changelog: edge-25.7.6...edge-25.8.1

edge-25.7.6

Overall status: NOT RECOMMENDED, use edge-25.8.1 instead

Cautions

N/A

Changes

This release supports percentages, as well as integers, when setting the maxUnavailable field in the podDisruptionBudget in Helm values (thanks, Wim de Groot!), cleans up the descriptions for some proxy metrics (thanks, @joedrf!), produces auditable binaries for the policy controller and proxy, and prefers AES algorithms over ChaCha20 for mTLS. It also correctly performs reproducible builds, fixing issue #13873.

What's Changed

• fix(values): make Controller values untyped by @wim-de-groot in #14205
• build(deps): bump tokio from 1.46.1 to 1.47.0 by @dependabot[bot] in #14285
• build(deps): bump rustls from 0.23.29 to 0.23.30 by @dependabot[bot] in #14283
• build(deps): bump rustc-demangle from 0.1.25 to 0.1.26 by @dependabot[bot] in #14282
• build(deps): bump dyn-clone from 1.0.19 to 1.0.20 by @dependabot[bot] in #14284
• build(deps): bump linkerd/dev to v47 by @olix0r in #14275
• build(deps): bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0 by @dependabot[bot] in #14273
• build(deps): bump tj-actions/changed-files from a0370f61698fcac830a08949da9fdf96ea0f3ab7 to db8d0bfea5a44e51abd5dc1454386c668ae901f9 by @dependabot[bot] in #14287
• build(policy-controller): produce auditable binaries by @olix0r in #14290
• chore(proxy): update linkerd-await to v0.3.1 by @olix0r in #14291
• fix(policy): Include aws-lc-rs as optional policy controller crypto… by @sfleen in #14264
• chore(inject): make PatchProducer and ValueOverrider more generic by @zaharidichev in #14254
• build(deps): bump aws-lc-rs from 1.13.1 to 1.13.3 by @dependabot[bot] in #14294
• Revert "fix(policy): Include aws-lc-rs as optional policy controller crypto backend (#14264) by @sfleen in #14299
• proxy: v2.311.0 by @l5d-bot in #14297
• refactor(helm): Replace VFS with embed for Helm chart rendering by @adleong in #14272

Full Changelog: edge-25.7.5...edge-25.7.6

edge-25.7.5

Overall status: NOT RECOMMENDED, use edge-25.8.1 instead

Cautions

N/A

Changes

This release contains internal improvements, but no new capabilities over edge-25.7.4.

What's Changed

• chore(ci): enable overriding the runner in workflows by @olix0r in #14256
• build(deps): bump google.golang.org/grpc from 1.73.0 to 1.74.0 by @dependabot[bot] in #14252
• build(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 by @dependabot[bot] in #14253
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #14251
• build(deps-dev): bump webpack from 5.99.9 to 5.100.2 in /web/app by @dependabot[bot] in #14258
• build(deps): bump rand from 0.9.1 to 0.9.2 by @dependabot[bot] in #14259
• build(deps): bump cc from 1.2.29 to 1.2.30 by @dependabot[bot] in #14260
• build(deps): bump serde_json from 1.0.140 to 1.0.141 by @dependabot[bot] in #14261
• build(deps): bump google-github-actions/auth from 2.1.10 to 2.1.11 by @dependabot[bot] in #14262
• build(deps): bump google-github-actions/setup-gcloud from 2.1.4 to 2.1.5 in /.github/actions/helm-publish by @dependabot[bot] in #14263
• proxy: v2.310.0 by @l5d-bot in #14270
• build(deps): bump google.golang.org/grpc from 1.74.0 to 1.74.2 by @dependabot[bot] in #14267
• build(deps): bump io-uring from 0.7.8 to 0.7.9 by @dependabot[bot] in #14269
• build(deps): bump tj-actions/changed-files from 055970845dd036d7345da7399b7e89f2e10f2b04 to a0370f61698fcac830a08949da9fdf96ea0f3ab7 by @dependabot[bot] in #14271
• build(deps): bump hyper-util from 0.1.15 to 0.1.16 by @dependabot[bot] in #14268

Full Changelog: edge-25.7.4...edge-25.7.5

edge-25.7.4

Overall status: NOT RECOMMENDED, use edge-25.8.1 instead

Cautions

N/A

Changes

This release contains a fix to reduce the proxy's memory usage when handling many HTTP/1 connections.

What's Changed

• test(destination): Replace sleeps with RetryFor in ClusterStoreTest by @adleong in #14250
• proxy: v2.309.0 by @l5d-bot in #14255

Full Changelog: edge-25.7.3...edge-25.7.4

edge-25.7.3

Overall status: NOT RECOMMENDED, use edge-25.8.1 instead

Cautions

N/A

Changes

This release reintroduces idle timeouts for HTTP/1 connections, and supports the AES_256_GCM cipher for mTLS. It also fixes an issue (#14228) where the Helm chart could fail to render when upgrading from a previous version.

What's Changed

• build(deps): bump rustls from 0.23.28 to 0.23.29 by @dependabot[bot] in #14230
• build(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 by @dependabot[bot] in #14229
• chore(build): remove choco by @alpeb in #14234
• chore: remove empty lines from manifests by @alpeb in #14233
• refactor(helm): Replace VFS with embed for Helm chart rendering by @adleong in #14206
• build(deps): bump query-string from 9.2.1 to 9.2.2 in /web/app by @dependabot[bot] in #14236
• build(deps): bump core-js from 3.43.0 to 3.44.0 in /web/app by @dependabot[bot] in #14238
• build(deps-dev): bump babel-jest from 30.0.2 to 30.0.4 in /web/app by @dependabot[bot] in #14239
• build(deps-dev): bump @babel/preset-env from 7.27.2 to 7.28.0 in /web/app by @dependabot[bot] in #14240
• build(deps): bump tj-actions/changed-files from 5f66af5912c4f9c360c03a612f98606fb0f83790 to 055970845dd036d7345da7399b7e89f2e10f2b04 by @dependabot[bot] in #14243
• build(deps): bump delegate from 0.13.3 to 0.13.4 by @dependabot[bot] in #14245
• chore(deps): update rust kube dependencies by @olix0r in #14235
• build(deps): bump golang.org/x/tools from 0.34.0 to 0.35.0 by @dependabot[bot] in #14242
• fix(helm): Fix helm rendering error when upgrading by @adleong in #14244
• test(policy): update postman tests to expect 200 response code by @adleong in #14248
• proxy: v2.308.0 by @l5d-bot in #14247
• revert(helm): Replace VFS with embed for Helm chart rendering (#14206) by @adleong in #14246

Full Changelog: edge-25.7.2...edge-25.7.3