v5.3.4

What's Changed

⬆️ Dependencies

• Update python:3.14-trixie Docker digest to abc08a8 (release-5.3) by @renovate[bot] in #9106
• Update module sigs.k8s.io/structured-merge-diff/v6 to v6.3.2 (release-5.3) by @renovate[bot] in #9101
• Update nginx:1.29.5 Docker digest to 341bf0f (release-5.3) by @renovate[bot] in #9100
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to 3754cfe (release-5.3) by @renovate[bot] in #9097, #9128, #9151
• Update nginx:1.29.5-alpine3.23 Docker digest to 1d13701 (release-5.3) by @renovate[bot] in #9104
• Update golang:1.25-alpine Docker digest to f6751d8 (release-5.3) by @renovate[bot] in #9099
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to e06094a (release-5.3) by @renovate[bot] in #9098, #9129, #9152, #9180
• Loosen F5 WAF package versions to allow patch releases by @nginx-bot in #9117
• Update redhat/ubi8 Docker digest to a287489 (release-5.3) by @renovate[bot] in #9113, #9143
• Update module golang.org/x/tools to v0.42.0 (release-5.3) by @renovate[bot] in #9114
• Update quay.io/keycloak/keycloak Docker tag to v26.5.3 (release-5.3) by @renovate[bot] in #9133
• Update golangci/golangci-lint Docker tag to v2.9.0 (release-5.3) by @renovate[bot] in #9136
• Update k8s.io/utils digest to b8788ab (release-5.3) by @renovate[bot] in #9130
• Update pre-commit hook DavidAnson/markdownlint-cli2 to v0.21.0 (release-5.3) by @renovate[bot] in #9170
• Update dependency dominikh/go-tools to v2026 (release-5.3) by @renovate[bot] in #9164
• Update pre-commit hook rhysd/actionlint to v1.7.11 (release-5.3) by @renovate[bot] in #9168
• Update kindest/node Docker tag to v1.35.1 (release-5.3) by @renovate[bot] in #9161
• Update Go to v1.26 by @nginx-bot in #9177
• Update module sigs.k8s.io/controller-tools to v0.20.1 (release-5.3) by @renovate[bot] in #9162
• Update module github.com/gruntwork-io/terratest to v0.56.0 (release-5.3) by @renovate[bot] in #9163
• Update kubernetes packages to v0.35.1 (release-5.3) by @renovate[bot] in #9131
• Update pre-commit hook python-jsonschema/check-jsonschema to v0.36.2 (release-5.3) by @renovate[bot] in #9181
• Update WAF to 5.11.2 by @AlexFenlon in #9189

Full Changelog: v5.3.3...v5.3.4

Upgrade

• For NGINX, use the v5.3.4 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.3.4 images from the F5 Container registry or build your own image using the v5.3.4 source code.
• For Helm, use version 2.4.4 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.4/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.4/charts/nginx-ingress
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.3.3

What's Changed

🔨 Maintenance

• Fix release workflow issues by @pdabelf5 in #8993

⬆️ Dependencies

• Update module github.com/golang-jwt/jwt/v5 to v5.3.1 (release-5.3) by @renovate[bot] in #9009
• Update nginx:1.29.4-alpine3.23 Docker digest to 4870c12 (release-5.3) by @renovate[bot] in #9008, #9019
• Update golang:1.25-alpine Docker digest to f4622e3 (release-5.3) by @renovate[bot] in #9007, #9069
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to 8697918 (release-5.3) by @renovate[bot] in #8997, #9030, #9048, #9068
• Update alpine:3.22 Docker digest to 55ae5d2 (release-5.3) by @renovate[bot] in #9006
• Update opentelemetry-go monorepo to v1.40.0 (release-5.3) by @renovate[bot] in #9037
• Update module github.com/cert-manager/cert-manager to v1.19.3 [SECURITY] (release-5.3) by @renovate[bot] in #9040
• Update quay.io/jetstack/cert-manager-cainjector Docker tag to v1.19.3 (release-5.3) by @renovate[bot] in #9034
• Update quay.io/jetstack/cert-manager-webhook Docker tag to v1.19.3 (release-5.3) by @renovate[bot] in #9036
• Update redhat/ubi8 Docker digest to bf6868a (release-5.3) by @renovate[bot] in #9031, #9071
• Update quay.io/jetstack/cert-manager-controller Docker tag to v1.19.3 (release-5.3) by @renovate[bot] in #9035
• Update python:3.14-trixie Docker digest to ca9350a (release-5.3) by @renovate[bot] in #9051, #9070
• Update debian:12-slim Docker digest to 98f4b71 (release-5.3) by @renovate[bot] in #9047
• Update nginx:1.29.4 Docker digest to 9dd2888 (release-5.3) by @renovate[bot] in #9050
• Update NGINX versions by @nginx-bot in #9075
• Update dependency go to v1.25.7 (release-5.3) by @renovate[bot] in #9072
• Update redhat/ubi9-minimal Docker tag to v9.7-1770267347 (release-5.3) by @renovate[bot] in #9074
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to 901482f (release-5.3) by @renovate[bot] in #9049

Other Changes

• Update NGINX Agent to 3.7 by @nginx-bot in #9076

Full Changelog: v5.3.2...v5.3.3

Upgrade

• For NGINX, use the v5.3.3 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.3.3 images from the F5 Container registry or build your own image using the v5.3.3 source code.
• For Helm, use version 2.4.3 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.3/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.3/charts/nginx-ingress
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.3.2

What's Changed

🔨 Maintenance

• Update nginxplus version in package tests by @nginx-bot in #8771
• Tweak some maintenance make targets by @nginx-bot in #8772
• Use nginx-bot to checkout & commit renovate PR's by @pdabelf5 in #8774
• Use stdlib for slices package by @nginx-bot in #8815

📝 Documentation

• Release 5.3.2 by @nginx-bot in #8990

⬆️ Dependencies

• Update module github.com/aws/aws-sdk-go-v2/config to v1.32.6 (release-5.3) by @renovate[bot] in #8752
• Update nginx:1.29.4-alpine3.23 Docker digest to 8491795 (release-5.3) by @renovate[bot] in #8767, #8779, #8854
• Update redhat/ubi8 Docker digest to a7e3d45 (release-5.3) by @renovate[bot] in #8768, #8924, #8980
• Update k8s.io/utils digest to 914a6e7 (release-5.3) by @renovate[bot] in #8766, #8778, #8843
• Update golang:1.25-alpine Docker digest to e689855 (release-5.3) by @renovate[bot] in #8765, #8893, #8911
• Update ghcr.io/nginx/alpine-fips Docker tag to v0.5.0 (release-5.3) by @renovate[bot] in #8753
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to 8352fd3 (release-5.3) by @renovate[bot] in #8785, #8791, #8852
• Update redhat/ubi9 Docker tag to v9.7-1766364927 (release-5.3) by @renovate[bot] in #8786, #8822, #8926, #8982
• Update kindest/node Docker tag to v1.35.0 (release-5.3) by @renovate[bot] in #8754
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to 998262b (release-5.3) by @renovate[bot] in #8784, #8851, #8905, #8931, #8964
• Update nginx:1.29.4 Docker digest to c881927 (release-5.3) by @renovate[bot] in #8793, #8853
• Update pre-commit hook rhysd/actionlint to v1.7.10 (release-5.3) by @renovate[bot] in #8800
• Update python:3.14-trixie Docker digest to d9ce54c (release-5.3) by @renovate[bot] in #8799, #8806, #8873, #8943
• Update debian:12-slim Docker digest to 94c4d59 (release-5.3) by @renovate[bot] in #8798, #8863, #8884
• Update module github.com/gkampitakis/go-snaps to v0.5.19 (release-5.3) by @renovate[bot] in #8804
• Update quay.io/keycloak/keycloak Docker tag (release-5.3) by @renovate[bot] in #8824
• update app protect threat campaign version by @javorszky in #8839
• Update coredns/coredns Docker tag to v1.14.1 (release-5.3) by @renovate[bot] in #8845, #8906
• Update app-protect-attack-signatures to 2026 versions by @nginx-bot in #8865
• Update module golang.org/x/tools to v0.41.0 (release-5.3) by @renovate[bot] in #8864
• Update aws-sdk-go-v2 monorepo (release-5.3) by @renovate[bot] in #8855
• Update waf to 5.11.0 on release 5.3 by @javorszky in #8875
• Update nap to 511 on release branch by @javorszky in #8879
• Update quay.io/keycloak/keycloak Docker tag to v26.5.2 (release-5.3) by @renovate[bot] in #8885, #8967
• Update golangci/golangci-lint Docker tag to v2.8.0 (release-5.3) by @renovate[bot] in #8833
• Update module sigs.k8s.io/controller-tools to v0.20.0 (release-5.3) by @renovate[bot] in #8769
• Update module github.com/gruntwork-io/terratest to v0.55.0 (release-5.3) by @renovate[bot] in #8886
• Update dependency go to v1.25.6 (release-5.3) by @renovate[bot] in #8894
• Update module sigs.k8s.io/structured-merge-diff/v6 to v6.3.1 (release-5.3) by @renovate[bot] in #8895
• Update pre-commit hook psf/black-pre-commit-mirror to v26 (release-5.3) by @renovate[bot] in #8912
• Update redhat/ubi9-minimal Docker tag to v9.7-1768783948 (release-5.3) by @renovate[bot] in #8927, #8983
• Update docker/dockerfile Docker tag to v1.21 (release-5.3) by @renovate[bot] in #8955
• Update module github.com/aws/aws-sdk-go-v2/service/marketplacemetering to v1.35.6 (release-5.3) by @renovate[bot] in #8954
• Update pre-commit hook python-jsonschema/check-jsonschema to v0.36.1 (release-5.3) by @renovate[bot] in #8981

Full Changelog: v5.3.1...v5.3.2

Upgrade

• For NGINX, use the v5.3.2 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.3.2 images from the F5 Container registry or build your own image using the v5.3.2 source code.
• For Helm, use version 2.4.2 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.2/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.2/deployments/helm-chart
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.3.1

What's Changed

🐛 Bug Fixes

• Update stub_status client path by @vepatel in #8690
• Update service template for ipFamilies by @vepatel in #8731
• [Security] Fix CVE-2025-14727 Adding more validation on rewrite-target by @vepatel in #8743

🔨 Maintenance

• Bump NIC version to 5.3.1 and helm chart version to 2.4.1 by @javorszky in #8739

📝 Documentation

• Update versions of nic (5.3.1), helm chart (2.4.1), operator (3.4.1) by @javorszky in #8741

⬆️ Dependencies

• Update NGINX Agent to 3.6.0 by @AlexFenlon in #8703
• update nginx oss to 1.29.4 and alpine base to 3.23 by @vepatel in #8736
• Update redhat/ubi9 Docker tag to v9.7-1764794285 (release-5.3) by @renovate[bot] in #8636
• Update nginx:1.29.3 Docker digest to 2f4e101 (release-5.3) by @renovate[bot] in #8663
• Update quay.io/jetstack/cert-manager-controller Docker tag to v1.19.2 (release-5.3) by @renovate[bot] in #8682
• Update redhat/ubi9-minimal Docker tag to v9.7-1764794109 (release-5.3) by @renovate[bot] in #8637
• Update module golang.org/x/tools to v0.40.0 (release-5.3) by @renovate[bot] in #8664
• Update quay.io/skopeo/stable Docker tag to v1.21.0 (release-5.3) by @renovate[bot] in #8702
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to c69c8a1 (release-5.3) by @renovate[bot] in #8699
• Update pre-commit hook psf/black-pre-commit-mirror to v25.12.0 (release-5.3) by @renovate[bot] in #8666
• Update module github.com/gkampitakis/go-snaps to v0.5.18 (release-5.3) by @renovate[bot] in #8635
• Update kubernetes packages to v0.34.3 (release-5.3) by @renovate[bot] in #8701
• Update golangci/golangci-lint Docker tag to v2.7.2 (release-5.3) by @renovate[bot] in #8639
• Update quay.io/jetstack/cert-manager-cainjector Docker tag to v1.19.2 (release-5.3) by @renovate[bot] in #8681
• Update module github.com/cert-manager/cert-manager to v1.19.2 (release-5.3) by @renovate[bot] in #8679
• Update quay.io/jetstack/cert-manager-webhook Docker tag to v1.19.2 (release-5.3) by @renovate[bot] in #8683
• Update coredns/coredns Docker tag to v1.13.2 (release-5.3) by @renovate[bot] in #8700
• Update pre-commit hook DavidAnson/markdownlint-cli2 to v0.20.0 (release-5.3) by @renovate[bot] in #8647
• Update debian:12-slim Docker digest to e899040 (release-5.3) by @renovate[bot] in #8662
• Update python:3.14-trixie Docker digest to 5093d1e (release-5.3) by @renovate[bot] in #8632, #8727
• Update opentelemetry-go monorepo to v1.39.0 (release-5.3) by @renovate[bot] in #8665
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to 6b69a5d (release-5.3) by @renovate[bot] in #8698
• Update kindest/node Docker tag to v1.34.2 (release-5.3) by @renovate[bot] in #8718
• Update aws-sdk-go-v2 monorepo (release-5.3) by @renovate[bot] in #8633
• Update pre-commit hook python-jsonschema/check-jsonschema to v0.36.0 (release-5.3) by @renovate[bot] in #8729

Full Changelog: v5.3.0...v5.3.1

Upgrade

• For NGINX, use the v5.3.1 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.3.1 images from the F5 Container registry or build your own image using the v5.3.1 source code.
• For Helm, use version 2.4.1 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.1/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.1/deployments/helm-chart
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.3.0

What's Changed

🚀 Features

• add sslVerify for jwksUri by @vepatel in #8292
• Add support for ssl ciphers related annotations by @vepatel in #8447
• Implement OIDC front channel logout NGINX directives by @javorszky in #8340
• Add OIDC timeout customization to ConfigMap by @AlexFenlon in #8495
• Support namespaced upstream service reference in VirtualServer by @haywoodsh in #8453
• add rewrite-target annotation by @vepatel in #8508
• Add client-body-buffer-size directive to Ingress Annotations & Configmap by @AlexFenlon in #8548
• Add client-body-buffer-size directive to VirtualServer by @AlexFenlon in #8557
• Add OIDC Policy IDP TLS validation by @pdabelf5 in #8556
• extend cache policy for more configurable parameters by @haywoodsh in #8533

🐛 Bug Fixes

• remove type field for objects with schema ref by @vepatel in #8299
• Cleanup stale socket files on startup by @AlexFenlon in #8455

📦 Helm Chart

• Include metrics in the helm agent config by @dareste in #8404
• Optionally create HorizontalPodAutoscaler by @pdabelf5 in #8452

🧪 Tests

• Wrap oidc fclo initiated test in a while loop by @javorszky in #8460
• Disable failing foreign upstream test by @pdabelf5 in #8546
• Change foreign upstream resource creation order by @haywoodsh in #8535

🔨 Maintenance

• Version Bump for 5.3.0 by @github-actions[bot] in #8241
• update script to include statefulset yaml by @vepatel in #8259
• fix dry-run logic for docs PR by @vepatel in #8261
• add cache policy to telemetry by @vepatel in #8265
• Use F5 self-hosted runners by @AlexFenlon in #8268
• Fix helm not found in CI pipeline by @AlexFenlon in #8281
• Login to dockerhub when building authenticated images by @pdabelf5 in #8293
• Update Community Call dates by @AlexFenlon in #8295
• Pin all NAP WAF package versions by @pdabelf5 in #8317
• Pin goreleaser version & update with renovate by @pdabelf5 in #8319
• Add assertions document to binary build workflow by @pdabelf5 in #8336
• Only add assertion doc on release runs by @pdabelf5 in #8345
• Update k8s variable syntax for minikube & kind by @pdabelf5 in #8347
• Re-enable NGINX bot by @pdabelf5 in #8354
• Fix Snapshots failing in Version Bump workflow by @AlexFenlon in #8357
• Update k8s version fetch logic by @vepatel in #8379
• Group python and actions changes into one PR of each type by @pdabelf5 in #8393
• Allow easier updates to Agent versions on NAP images by @AlexFenlon in #8303
• Update release with f5 runner by @vepatel in #8402
• Publish helm chart to nginx-charts by @pdabelf5 in #8403
• Remove assertion doc from CI by @AlexFenlon in #8422
• Update goproxy logic & cleanup netrc by @pdabelf5 in #8421
• Add versions to bug report template by @pdabelf5 in #8434
• Split Python tests to reduce run time by @pdabelf5 in #8419
• Replace discouraged PlayWright functions in our pytests by @javorszky in #8467
• Remove unused pytest option by @pdabelf5 in #8531
• Migrate client secret to OIDC for Azure Marketplace by @pdabelf5 in #8532
• Migrate additional Github secrets to Azure Vault by @AlexFenlon in #8528
• Migrate OpenShift & Plus secrets to Azure Vault by @pdabelf5 in #8515
• Migrate NGINX Plus secrets to Azure Vault by @pdabelf5 in #8517
• Migrate docker & nginx bot credentials to Azure Vault by @pdabelf5 in #8530
• Migrate GCR secrets to Azure Vault by @pdabelf5 in #8518
• Fix spacing in README tables by @AlexFenlon in #8597
• Update automated release docs to match previous version by @AlexFenlon in #8591
• update nginx plus waf pkg and alpine base version by @vepatel in #8600
• [cherry-pick] fix git user for release wf by @nginx-bot in #8602
• Fix shell variable globbing issue using quotes by @nginx-bot in #8605
• Update permissions on image promotion CI by @nginx-bot in #8610

📝 Documentation

• Fix foreign service example by @haywoodsh in #8516
• Update README links to reflect documentation URL changes by @ADubhlaoich in #8519
• Update Helm chart NOTES.txt with newer documentation links by @ADubhlaoich in #8586
• update release branch docs by @vepatel in #8653

⬆️ Dependencies

87 changes

• chore(deps): bump the python group with 2 updates by @dependabot[bot] in #8243
• Docker image update e10758e1 by @github-actions[bot] in #8244
• chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 in the actions group by @dependabot[bot] in #8249, #8263
• chore(deps): bump python from d99178e to a805109 in /tests by @dependabot[bot] in #8248, #8254
• Bump preflight version to v1.14.1 by @pdabelf5 in #8252
• chore(deps): bump the actions group with 2 updates by @dependabot[bot] in #8269
• chore(deps): bump the python group with 5 updates by @dependabot[bot] in #8270
• chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 in the actions group by @dependabot[bot] in #8275
• Docker image update 80954460 by @github-actions[bot] in #8279
• Docker image update 11a34148 by @github-actions[bot] in #8284
• chore(deps): bump the python group with 5 updates by @dependabot[bot] in #8287
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #8286, #8369, #8423, #8539, #8566
• chore: Configure Renovate by @renovate[bot] in #8298
• chore(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #8300
• Update quay.io/keycloak/keycloak Docker tag to v26.4.7 (main) by @renovate[bot] in #8308, #8459, #8510, #8565, #8576, #8595
• Update docker/dockerfile Docker tag to v1.20 (main) by @renovate[bot] in #8307, #8374, #8570, #8584
• Update dependency requests to v2.32.5 by @renovate[bot] in #8312
• Docker ima...

v5.2.1

What's Changed

🐛 Bug Fixes

• Remove type field for objects with schema ref by @vepatel in #8302

🔨 Maintenance

• Pin NGINX OSS to 1.29.1 by @AlexFenlon in #8386
• Re-enable NGINX bot by @pdabelf5 in #8363
• Version Bump for 5.2.1 by @github-actions[bot] in #8353
• Update kubernetes version to v1.34.0 in helm schema by @nginx-bot in #8378

📝 Documentation

• Release 5.2.1 by @vepatel in #8368

⬆️ Dependencies

• Update WAF 5.9.0 by @AlexFenlon in #8348
• Update dependencies by @vepatel in #8273
• Docker image update 80954460 by @github-actions[bot] in #8280
• Docker image update 11a34148 by @github-actions[bot] in #8291
• Docker image update 119a0c53 by @github-actions[bot] in #8320
• Docker image update 40eeffe2 by @github-actions[bot] in #8331
• Update aws-sdk-go-v2 monorepo by @github-actions[bot] in #8321
• Update module github.com/gkampitakis/go-snaps to v0.5.15 by @github-actions[bot] in #8330
• Update module github.com/golang-jwt/jwt/v4 to v5 by @github-actions[bot] in #8352
• Update k8s.io/utils digest to bc988d5 by @github-actions[bot] in #8358

Other Changes

• [pre-commit.ci] pre-commit autoupdate by @github-actions[bot] in #8297
• Update dependency cryptography to v46.0.2 by @github-actions[bot] in #8325
• Update dependency certifi to v2025.8.3 by @github-actions[bot] in #8346
• Update dependency grpcio to v1.75.1 by @github-actions[bot] in #8359
• Update examples with keycloak 26.x by @nginx-bot in #8365
• [pre-commit.ci] pre-commit autoupdate by @nginx-bot in #8370
• Update balabit/syslog-ng Docker tag to v4.10.1 by @nginx-bot in #8373
• Update docker/dockerfile Docker tag to v1.19 by @nginx-bot in #8377

Full Changelog: v5.2.0...v5.2.1

Upgrade

• For NGINX, use the v5.2.1 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.2.1 images from the F5 Container registry or build your own image using the v5.2.1 source code.
• For Helm, use version 2.3.1 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.2.1/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.2.1/deployments/helm-chart
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.2.0

What's Changed

🚀 Features

• Add nginx content cache as cache policy by @vepatel in #8005
• StatefulSet support by @haywoodsh in #8159
• Add support for automatic adjustment of buffer related directives by @javorszky in #8133
• Allow StartupProbe to be configured via helm by @vepatel in #8011
• Add SNI to NIC JWT Policy by @javorszky in #7993
• Add support for VIOL_BOT_CLIENT and VIOL_GEOLOCATION violations by @mikegoltsman in #8093
• Add globalConfigurationCustomName parameter by @frantsao and @mohamadaldawamnah in #8142
• Add support for FIPS 140-3 compliance by @AlexFenlon in #8195
• Add support for N+ license expiry in prometheus metrics by @vepatel in #8229

🧪 Tests

• Update tests README by @vepatel in #7951
• Update snaps by @vepatel in #8032
• Ensure packages are installed on images by @pdabelf5 in #7991
• Add service insight pytest for cross namespace VSR by @pdabelf5 in #8055
• Add integration test for agent by @mohamadaldawamnah in #8094
• Add integration test to App Protect agent file by @mohamadaldawamnah in #8116
• Fix Helm tests failing with latest version by @AlexFenlon in #8179

🔨 Maintenance

• add helm gh action by @vepatel in #8175
• Add namespaced secret to example by @vepatel in #7941
• Refine label additions that drive release categories by @pdabelf5 in #7957
• Clean up docker scout scan job names by @pdabelf5 in #7965
• Update release notes scripts by @pdabelf5 in #7962
• Version Bump for 5.2.0 by @github-actions[bot] in #7939
• Pin OSS version in Dockerfile by @pdabelf5 in #7989
• Always build the binary when we force a rebuild by @pdabelf5 in #7981
• Update community call dates by @AlexFenlon in #8034
• add crd docs in dev docs by @vepatel in #7992
• Collapse package report comment by @pdabelf5 in #8045
• Add GOPROXY to binary builds by @pdabelf5 in #8053
• Add control labels to Agent for N1C by @AlexFenlon in #8068
• Remove extra double quote in variable assignment by @pdabelf5 in #8067
• update crd descriptions by @mohamadaldawamnah in #8038
• Remove aws marketplace images from patching workflow by @pdabelf5 in #8050
• Update to ubuntu 24.04 runners by @pdabelf5 in #8081
• Remove unnecessary crd files by @pdabelf5 in #8117
• Setup netrc when forcing build by @pdabelf5 in #8151
• CRD changes trigger pytests by @pdabelf5 in #8165
• Always run tests when inputs.run_tests is true by @pdabelf5 in #8166
• Bring Release 5.1.1 to main by @AlexFenlon in #8163
• Remove existence check from templates before range by @javorszky in #8181
• Update CI workflow_call boolean inputs by @pdabelf5 in #8197
• remove http cache for jwks by @vepatel in #8198
• Update proxy endpoint for published builds by @pdabelf5 in #8194
• Adds sha256 hash to quay.io/skopeo import by @javorszky in #8196
• remove shared cache config from helm by @vepatel in #8211
• Fix gofumpt empty string errors by @AlexFenlon in #8221
• update golang to 1.25 by @vepatel in #8220
• Correct yaml indentation for daemon-set readiness probe by @pdabelf5 in #8233
• Fix Proxy Buffer Config Adjustments by @AlexFenlon in #8226
• update dependencies by @vepatel in #8251

📝 Documentation

• update main version by @vepatel in #8087
• Fix hyperlink to image build procedure in README.md by @ogipierogi in #8157
• Fix broken hyperlink to F5 Container Registry Download doc in README.md by @ogipierogi in #8158
• Ensure all links resolve correctly in README.md by @pdabelf5 in #8171
• Release 5.2.0 by @github-actions[bot] in #8258

⬆️ Dependencies

• Update NGINX Agent to 3.3 by @AlexFenlon in #8208
• Docker image update 1e04714a by @github-actions[bot] in #7946
• Docker image update e4f97356 by @github-actions[bot] in #7961
• chore(deps): bump the go group with 2 updates by @dependabot[bot] in #7959
• Docker image update 203eea12 by @github-actions[bot] in #7977
• Docker image update 230ecec3 by @github-actions[bot] in #7979
• chore(deps): bump the docker-images group in /build with 3 updates by @dependabot[bot] in #7978
• chore(deps): bump github.com/cert-manager/cert-manager from 1.18.1 to 1.18.2 in the go group by @dependabot[bot] in #7983
• Docker image update 7a5ba83b by @github-actions[bot] in #7984
• Docker image update 6a8781f0 by @github-actions[bot] in #7996
• Docker image update 5f914290 by @github-actions[bot] in #8012
• chore(deps): bump the go group across 1 directory with 6 updates by @dependabot[bot] in #8037
• Docker image update 8f0038c0 by @github-actions[bot] in #8036
• Docker image update 39f71fa3 by @github-actions[bot] in #8044
• chore(deps): bump the go group with 2 updates by @dependabot[bot] in #8057
• Docker image update b2e33b58 by @github-actions[bot] in #8063
• chore(deps): bump the go group across 1 directory with 4 updates by @dependabot[bot] in #8083
• Docker image update 92ebb2db by @github-actions[bot] in #8085
• Docker image update f1ecbe96 by @github-actions[bot] in #8107
• chore(deps): bump the go group across 1 directory with 3 updates by @dependabot[bot] in #8096
• Docker image update 68bc681d by @github-actions[bot] in #8114
• chore(deps): bump the go group with 2 updates by @dependabot[bot] in #8126
• Docker image update 15b09e30 by @github-actions[bot] in #8128
• Docker image update 8f6021bc by @github-actions[bot] in #8134
• Docker image update 883e338e by @github-actions[bot] in #8147
• chore(deps): bump the go group with 5 updates by @dependabot[bot] in #8143
• Docker image update 3952b73e by @github-actions[bot] in #8154
• chore(deps): bump the go group with 3 updates by @dependabot[bot] in #8183
• Docker image update 24ce9eb1 by @github-actions[bot] in #8173
• chore(deps): bump the go group with 3 updates by @dependabot[bot] in #8186
• Docker image update 5784bad7 by @github-actions[bot] in #818...

v5.1.1

What's Changed

🐛 Bug Fixes

• Update interval checks for mgmt directive by @vepatel in #8043
• Status updates for VS endpoints by @vepatel in #8074
• Don't send request headers & body to jwks uri by @pdabelf5 in #8119

📦 Helm Chart

• Update agent endpoint by @pdabelf5 in #8028

🧪 Tests

• update test dockerfile by @vepatel in #8136

🔨 Maintenance

• Update release upload to azure workflow by @pdabelf5 in #8017

📝 Documentation

• Add production documentation link for OpenTelemetry by @ADubhlaoich in #8041

⬆️ Dependencies

• Docker image update dbfdbafc (#8024) by @pdabelf5 in #8030
• Docker image update b2e33b58 by @github-actions[bot] in #8080
• Docker image update 783e8763 by @github-actions[bot] in #8112
• chore(deps): bump the go group across 1 directory with 3 updates (#8096) by @pdabelf5 in #8115
• Update Go Group on release-5.1 by @AlexFenlon in #8131
• Update to NGINX OSS 1.29.1, PLUS R35, Agent v3.2, App Protect and Alpine 3.22 by @AlexFenlon in #8139
• Dependancies update for 5.1.1 by @AlexFenlon in #8148
• Docker image update 8f6021bc by @github-actions[bot] in #8140

Full Changelog: v5.1.0...v5.1.1

Upgrade

• For NGINX, use the v5.1.1 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.1.1 images from the F5 Container registry or build your own image using the v5.1.1 source code.
• For Helm, use version 2.2.2 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.1.1/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.1.1/deployments/helm-chart
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.1.0

What's Changed

🚀 Features

• Add ConfigMapKeys & MGMTConfigMapKeys to Telemetry by @AlexFenlon in #7695
• Add Context to logging for JSON and TEXT formats by @AlexFenlon in #7705
• Add request_method to rate-limit Policy by @vepatel in #7832
• Add OpenTelemetry support by @haywoodsh in #7642
• Add OIDC PKCE configuration through Policy by @javorszky in #7765
• Add support for Agent V3 and Connecting to NGINX One Console by @AlexFenlon in #7916
• Tiered rate limits with variables by @pdabelf5 in #7884

🐛 Bug Fixes

• Use pod labels as headless selector labels by @pdabelf5 in #7651
• Avoid applying updates on Ingress Controller shutdown by @vepatel in #7691
• Add ; in oidc files by @vepatel in #7748
• Correct namespace for mgmt secrets by @pdabelf5 in #7786
• Update template for custom redirect URI by @vepatel in #7853
• Maintain HeadlessService on upgrade by @vepatel in #7865

📦 Helm Chart

• Release 5.1.0 by @github-actions in #7940

🧪 Tests

• Add retries to test logic by @vepatel in #7643
• Docker image update a48c8357 by @github-actions in #7980

🔨 Maintenance

• Remove community slack notification by @pdabelf5 in #7663
• Add separator to the end of the new release notes by @pdabelf5 in #7676
• Update OIDC files with reference implementation by @vepatel in #7722
• Update ci files to build on oidc conf changes by @vepatel in #7753
• Add oidc refactor commit from ref impl by @vepatel in #7762
• Remove s390x, arm/7 and ppc64le by @AlexFenlon in #7784
• Clean up Agent values file and tests by @AlexFenlon in #7758
• Add pull policy to Minikube local tests by @AlexFenlon in #7759
• Replace archive.builds with .ids in goreleaser by @javorszky in #7801
• Fix markdown linter issues by @jjngx in #7822
• Trigger an image rebuild if the js or conf files change by @pdabelf5 in #7843
• Reference main mend job by @jjngx in #7834
• Run codeql from referenced workflow by @jjngx in #7837
• Update mend and codeql versions to commit at v0.2 by @javorszky in #7851
• Pin NGINX App Protect images to use NGINX Agent V2 by @AlexFenlon in #7858
• Update agent test marker in regression matrix by @vepatel in #7863
• Tidy NGINX PAT usage by @pdabelf5 in #7886
• Add BUILD OS & Arch to rhel system registration host name by @pdabelf5 in #7895
• Move internal docs folder outside of website docs folder by @ADubhlaoich in #7892
• Add dev docs exception by @vepatel in #7908
• Run mend workflow on main and release branches by @jjngx in #7881
• Disable release note generation by @pdabelf5 in #7921
• Pin mvdan/gofumpt in github workflow ci and fix bash variable quoting by @javorszky in #7923
• Remove arm, s390x & ppc64le references by @pdabelf5 in #7924
• Use GITHUB_TOKEN for auto merge by @pdabelf5 in #7928
• Update release process by @pdabelf5 in #7922
• Update Dockerfile syntax version to 1.16 by @pdabelf5 in #7898
• Update references to migrated nginxinc projects by @pdabelf5 in #7936
• Pin OSS version in Dockerfile by @github-actions in #7990

📝 Documentation

• Update the zone-sync ConfigMap key note by @AlexFenlon in #7641
• Update OpenTracing ConfigMap docs by @vepatel in #7652
• Remove extra characters in zone-sync note by @AlexFenlon in #7658
• Update tech spec with supported versions by @vepatel in #7674
• Update the ConfigMap Zone Sync documentation by @ADubhlaoich in #7681
• Adds installation guide for NIC and NGINX App Protect WAF by @javorszky in #7688
• Update all self-referential Release links from production URLs by @ADubhlaoich in #7708
• Removed unused configurations parameters for helm installation by @cdxker in #7729
• Formatted example clone repo command as codeblock by @travisamartin in #7728
• Update docs for watch-secret-namespace by @vepatel in #7744
• Update NIC about page by @vepatel in #7755
• NIC+NAP wafv5 install guide perm fix by @javorszky in #7760
• Add note to the Tech Specs about removal of archs by @AlexFenlon in #7782
• Update AWS LB doc by @vepatel in #7818
• Remove release page links to marketplaces by @ADubhlaoich in #7871
• Remove 3.1.1 from tech specs by @vepatel in #7894
• Remove documentation website files by @ADubhlaoich in #7915

⬆️ Dependencies

• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/marketplacemetering from 1.28.2 to 1.29.0 in the go group by @dependabot in #7647
• chore(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 in the go_modules group by @dependabot in #7666
• Docker image update c1e42434 by @nginx-bot in #7714
• chore(deps): bump the go group across 1 directory with 8 updates by @dependabot in #7711
• chore(deps): bump the go group with 2 updates by @dependabot in #7767
• Docker image update 78a6243e by @nginx-bot in #7788
• chore(deps): bump the go group with 4 updates by @dependabot in #7798
• Update kubernetes version to v1.33.1 in helm schema by @nginx-bot in #7808
• chore(deps): bump the go group with 2 updates by @dependabot in #7824
• Docker image update 5b83e3f7 by @nginx-bot in #7825
• Docker image update 1de54b35 by @nginx-bot in #7855
• chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.11 to 0.5.12 in the go group by @dependabot in #7854
• Update NGINX OSS to 1.27.5 by @pdabelf5 in #7890
• Update go version to 1.24.4 by @pdabelf5 in #7896
• Docker image update 61b675bc by @github-actions in #7888
• Update UBI9 version to 9.6 as 9.5 is no longer updated by @pdabelf5 in #7893
• chore(deps): bump the go group across 1 directory with 5 updates by @dependabot in #7900
• Docker image update 6913142a by @github-actions in #7903
• chore(deps): bump the go group with 3 updates by @dependabot in #7918
• chore(deps): bump the go group with 4 updates by @dependabot in #7926
• Docker image update 1e04714a by @github-actions in #7948
• Docker image update 79d70b3a by @github-actions in #7963
  *...

v5.0.0

What's Changed

💣 Breaking Changes

• Remove support for Open Tracing for NGINX Plus by @jjngx in #7567
• Remove OpenTracing Support from NIC by @pdabelf5 in #7633

🚀 Features

• Increase port number range by @saedx1 in #7054
• Ratelimit based on JWT claim by @pdabelf5 in #7175
• add auth_jwt_claim_set in nginx plus virtualserver template by @haywoodsh in #7205
• Add initial zone_sync values to the ConfigMap by @AlexFenlon in #7239
• Update to NGINX OSS 1.27.4 by @pdabelf5 in #7299
• generate auth_jwt_claim_set directive by @haywoodsh in #7238
• Tiered Rate limit group maps by @pdabelf5 in #7390
• Rate limit group example by @pdabelf5 in #7393
• Add zone-sync with no TLS to ConfigMap by @AlexFenlon in #7347
• Update zone-sync headless service selector label by @pdabelf5 in #7445
• Rate limit zone sync by @pdabelf5 in #7468
• Rate limit with zone sync and scale by @pdabelf5 in #7521
• Update NGINX Plus to R34 and App Protect to 4.14 & 5.6 by @pdabelf5 in #7597
• Add forward proxy support to Plus mgmt config by @AlexFenlon in #7560
• Use pod labels as headless selector labels by @nginx-bot in #7654

🐛 Bug Fixes

• Clean up and fix for NIC Pod failing to bind when NGINX exits unexpectedly by @AlexFenlon in #7121
• Correct typo in helm lease annotations template by @pdabelf5 in #7185
• Add tracking.info and copy into plus images by @javorszky in #7400
• Add NGINX state directory for ReadOnlyRootFilesystem by @haywoodsh in #7519

📦 Helm Chart

• Allow customization of service http and https port names through helm by @arussellf5 in #7318
• Release 5.0.0 by @nginx-bot in #7617

🧪 Tests

• Add mgmt configmap tests by @j1m-ryan in #6957
• Expand mgmt configmap tests by @pdabelf5 in #6987
• Add minikube as option for running tests by @pdabelf5 in #7018
• Add plus jwt to local tests by @pdabelf5 in #7032
• Add OIDC test using keycloak as idp by @vepatel in #7242
• Enable jwksuri tests with keycloak by @vepatel in #7396
• Add delay & retry to flakey weight splits test by @pdabelf5 in #7324
• Update split tests to use delete and create lib function by @vepatel in #7418
• tiered rate limit jwt e2e tests by @pdabelf5 in #7412
• Add zone-sync support to OIDC tests by @vepatel in #7440
• replace patch with delete and create by @vepatel in #7638

🔨 Maintenance

72 changes

• ensure tag exists before scanning by @pdabelf5 in #6958
• allow scan uploads to fail by @pdabelf5 in #6961
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #6944, #7044, #7072, #7124, #7168, #7261, #7373, #7402, #7487, #7548, #7587
• Re-add FIPs images to tests, image patching & release by @haywoodsh in #6948
• chore(deps): bump the actions group across 1 directory with 2 updates by @dependabot in #6960
• update regression matrix to include old k8s by @vepatel in #6974
• Remove unused packages from UBI images by @pdabelf5 in #6989
• chore(deps): bump the actions group with 2 updates by @dependabot in #6991
• Certify UBI images for Redhat catalog by @pdabelf5 in #7011
• chore(deps): bump the actions group with 2 updates by @dependabot in #7005
• chore(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0 in the actions group by @dependabot in #7019
• Symlink to central secret by @pdabelf5 in #6714
• remove all attestation layers from AWS marketplace images by @pdabelf5 in #7033
• chore(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2 in the actions group by @dependabot in #7030
• Add tests for kubernetes versions by @pdabelf5 in #7035
• chore(deps): bump the actions group across 1 directory with 5 updates by @dependabot in #7055
• remove index annotations from AWS marketplace images by @pdabelf5 in #7058
• Add unprivileged port validation by @pdabelf5 in #7034
• pre-commit: silence markdownlint by @javorszky in #7067
• chore(deps): bump reviewdog/action-actionlint from 1.61.0 to 1.62.0 in the actions group by @dependabot in #7070
• remove ubi images from CI by @pdabelf5 in #7093
• remove additional ubi config by @pdabelf5 in #7104
• chore(deps): bump the actions group across 1 directory with 4 updates by @dependabot in #7107
• Update from nginxinc to nginx by @lucacome in #7103
• chore(deps): bump the actions group with 3 updates by @dependabot in #7123
• chore(deps): bump docker/build-push-action from 6.11.0 to 6.12.0 in the actions group by @dependabot in #7139
• Avoid floating semi-colon on rate-limiting newline by @pdabelf5 in #7156
• chore(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.5.1 in the actions group by @dependabot in #7159, #7344, #7503
• chore(deps): bump the actions group with 2 updates by @dependabot in #7172
• chore(deps): bump the actions group with 3 updates by @dependabot in #7180
• Docker image update 00f989f4 by @nginx-bot in #7199
• Remove kind 1.32.1 from available kind versions by @pdabelf5 in #7208
• chore(deps): bump the actions group across 1 directory with 5 updates by @dependabot in #7209
• VS template test tidy up by @pdabelf5 in #7211
• Add central event reasons to the log package by @pdabelf5 in #7215
• chore(deps): bump the actions group across 1 directory with 3 updates by @dependabot in #7224
• Refactor policy config structs by @pdabelf5 in #7232
• chore(deps): bump the actions group across 1 directory with 2 updates by @dependabot in #7241
• re-enable ubi image build & publish by @pdabelf5 in #7246
• chore(deps): bump the actions group across 1 directory with 3 updates by @dependabot in #7270
• chore(deps): bump sigstore/cosign-installer from 3.7.0 to 3.8.0 in the actions group by @dependabot in #7291
• Pin app protect version by @pdabelf5 in #7298
• update helm snaps versions when creating release PR...