Merge branch 'main' into test/agent-3.5.0

Author: dhurley

.github/CHANGELOG_TEMPLATE.md

@@ -30,6 +30,7 @@ KNOWN ISSUES:
 COMPATIBILITY:
 
 - Gateway API version: ``
+- Gateway API Inference Extension version: ``
 - NGINX version: ``
 - NGINX Plus version: ``
 - NGINX Agent version: ``

.github/workflows/build.yml

@@ -193,7 +193,7 @@ jobs:
           fail-build: false
 
       - name: Upload scan result to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/upload-sarif@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
         if: ${{ !inputs.dry_run }}
         continue-on-error: true
         with:

.github/workflows/ci.yml

@@ -374,7 +374,7 @@ jobs:
 
       - name: Generate Assertion Document
         id: assertiondoc
-        uses: nginxinc/compliance-rules/.github/actions/assertion@b0bda4baf00b030fd4e365821878b4857078e494
+        uses: nginxinc/compliance-rules/.github/actions/assertion@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
         with:
           artifact-name: ${{ github.event.repository.name }}_${{ github.sha }}_${{ github.run_number }}_${{ matrix.gateway.os }}_${{ matrix.gateway.arch }}
           artifact-digest: ${{ matrix.gateway.digest }}
@@ -393,7 +393,7 @@ jobs:
 
       - name: Sign and Store Assertion Document
         id: sign
-        uses: nginxinc/compliance-rules/.github/actions/sign@b0bda4baf00b030fd4e365821878b4857078e494
+        uses: nginxinc/compliance-rules/.github/actions/sign@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
         with:
           assertion-doc: ${{ steps.assertiondoc.outputs.assertion-document-path }}
 

.github/workflows/codeql-analysis.yml

@@ -26,6 +26,6 @@ jobs:
       actions: read # for github/codeql-action/init to get workflow details
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/autobuild to send a status report
-    uses: nginxinc/compliance-rules/.github/workflows/codeql.yml@a27656f8f9a8748085b434ebe007f5b572709aad # v0.2
+    uses: nginxinc/compliance-rules/.github/workflows/codeql.yml@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
     with:
       requested_languages: go,javascript-typescript,actions

.github/workflows/conformance.yml

@@ -196,7 +196,7 @@ jobs:
         if: ${{ inputs.production-release && inputs.enable-experimental }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload ${{ github.ref_name }} conformance-profile.yaml --clobber
+        run: gh release upload ${{ inputs.release_version }} conformance-profile.yaml --clobber
         working-directory: ./tests
 
       - name: Run inference conformance tests
@@ -217,5 +217,5 @@ jobs:
         if: ${{ inputs.production-release && inputs.enable-experimental }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload ${{ github.ref_name }} conformance-profile-inference.yaml --clobber
+        run: gh release upload ${{ inputs.release_version }} conformance-profile-inference.yaml --clobber
         working-directory: ./tests

.github/workflows/lint.yml

@@ -50,7 +50,7 @@ jobs:
         uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
         with:
           working-directory: ${{ matrix.directory }}
-          version: v2.6.1 # renovate: datasource=github-tags depName=golangci/golangci-lint
+          version: v2.6.2 # renovate: datasource=github-tags depName=golangci/golangci-lint
 
   njs-lint:
     name: NJS Lint

.github/workflows/mend.yml

@@ -32,7 +32,7 @@ permissions:
 jobs:
   mend:
     if: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) || (github.event_name == 'push' && github.event.repository.fork == false) }}
-    uses: nginxinc/compliance-rules/.github/workflows/mend.yml@a27656f8f9a8748085b434ebe007f5b572709aad # v0.2
+    uses: nginxinc/compliance-rules/.github/workflows/mend.yml@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
     secrets: inherit
     with:
       product_name: nginx-gateway-fabric_${{ github.ref_name }}

.github/workflows/scorecards.yml

@@ -60,6 +60,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/upload-sarif@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
         with:
           sarif_file: results.sarif

.pre-commit-config.yaml

@@ -38,7 +38,7 @@ repos:
           - javascript
 
   - repo: https://github.com/golangci/golangci-lint
-    rev: v2.6.1
+    rev: v2.6.2
     hooks:
       - id: golangci-lint-full
         name: golangci-lint-root
@@ -52,7 +52,7 @@ repos:
   # Rules are in .markdownlint-cli2.yaml file
   # See https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md for rule descriptions
   - repo: https://github.com/DavidAnson/markdownlint-cli2
-    rev: v0.18.1
+    rev: v0.19.0
     hooks:
       - id: markdownlint-cli2
 

CHANGELOG.md

@@ -4,6 +4,47 @@ This document includes a curated changelog for each release. We also publish a c
 a [GitHub release](https://github.com/nginx/nginx-gateway-fabric/releases), which, by contrast, is auto-generated
 and includes links to all PRs that went into the release.
 
+## Release 2.2.1
+
+_November 13, 2025_
+
+FEATURES:
+
+- Add support to make endpoint picker communication settings configurable. [4105](https://github.com/nginx/nginx-gateway-fabric/pull/4105)
+
+BUG FIXES:
+
+- Support mixed externalname and local services in single route. [4188](https://github.com/nginx/nginx-gateway-fabric/pull/4188)
+- Preserve HPA replicas on deployment. [4214](https://github.com/nginx/nginx-gateway-fabric/pull/4214)
+- Preserve external controller annotations. [4182](https://github.com/nginx/nginx-gateway-fabric/pull/4182)
+- Fix bug where user mounted files were being removed by NGINX. [4178](https://github.com/nginx/nginx-gateway-fabric/pull/4178)
+- Fix bug that prevented HPA from working when Inference Extension was enabled. [4247](https://github.com/nginx/nginx-gateway-fabric/pull/4247)
+
+HELM CHART:
+
+- Allow disabling cert-generator with a Helm value. [4186](https://github.com/nginx/nginx-gateway-fabric/pull/4186). Thanks to [fabian4](https://github.com/fabian4)
+- The version of the Helm chart is now 2.2.1
+
+
+KNOWN ISSUES:
+
+- Data plane sometimes does not sync upstream server IPs. [3626](https://github.com/nginx/nginx-gateway-fabric/issues/3626)
+
+COMPATIBILITY:
+
+- Gateway API version: `1.3.0`
+- Gateway API Inference Extension version: `1.0.1`
+- NGINX version: `1.29.2`
+- NGINX Plus version: `R35`
+- NGINX Agent version: `v3.5.0`
+- Kubernetes version: `1.25+`
+
+CONTAINER IMAGES:
+
+- Control plane: `ghcr.io/nginx/nginx-gateway-fabric:2.2.1`
+- Data plane: `ghcr.io/nginx/nginx-gateway-fabric/nginx:2.2.1`
+- Data plane with NGINX Plus: `private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:2.2.1`
+
 ## Release 2.2.0
 
 _October 22, 2025_
@@ -27,6 +68,10 @@ HELM CHART:
 - The version of the Helm chart is now 2.2.0
 - Set NGINX Plus default image. [3919](https://github.com/nginx/nginx-gateway-fabric/pull/3919)
 
+KNOWN ISSUES:
+
+- Data plane sometimes does not sync upstream server IPs. [3626](https://github.com/nginx/nginx-gateway-fabric/issues/3626)
+
 COMPATIBILITY:
 
 - Gateway API version: `1.3.0`