Merge branch 'main' into proposal/authentication-filter

Author: shaun-nx

.github/CHANGELOG_TEMPLATE.md

@@ -30,6 +30,7 @@ KNOWN ISSUES:
 COMPATIBILITY:
 
 - Gateway API version: ``
+- Gateway API Inference Extension version: ``
 - NGINX version: ``
 - NGINX Plus version: ``
 - NGINX Agent version: ``

.github/workflows/ci.yml

@@ -374,7 +374,7 @@ jobs:
 
       - name: Generate Assertion Document
         id: assertiondoc
-        uses: nginxinc/compliance-rules/.github/actions/assertion@b0bda4baf00b030fd4e365821878b4857078e494
+        uses: nginxinc/compliance-rules/.github/actions/assertion@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
         with:
           artifact-name: ${{ github.event.repository.name }}_${{ github.sha }}_${{ github.run_number }}_${{ matrix.gateway.os }}_${{ matrix.gateway.arch }}
           artifact-digest: ${{ matrix.gateway.digest }}
@@ -393,7 +393,7 @@ jobs:
 
       - name: Sign and Store Assertion Document
         id: sign
-        uses: nginxinc/compliance-rules/.github/actions/sign@b0bda4baf00b030fd4e365821878b4857078e494
+        uses: nginxinc/compliance-rules/.github/actions/sign@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
         with:
           assertion-doc: ${{ steps.assertiondoc.outputs.assertion-document-path }}
 

.github/workflows/codeql-analysis.yml

@@ -26,6 +26,6 @@ jobs:
       actions: read # for github/codeql-action/init to get workflow details
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/autobuild to send a status report
-    uses: nginxinc/compliance-rules/.github/workflows/codeql.yml@a27656f8f9a8748085b434ebe007f5b572709aad # v0.2
+    uses: nginxinc/compliance-rules/.github/workflows/codeql.yml@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
     with:
       requested_languages: go,javascript-typescript,actions

.github/workflows/conformance.yml

@@ -196,7 +196,7 @@ jobs:
         if: ${{ inputs.production-release && inputs.enable-experimental }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload ${{ github.ref_name }} conformance-profile.yaml --clobber
+        run: gh release upload ${{ inputs.release_version }} conformance-profile.yaml --clobber
         working-directory: ./tests
 
       - name: Run inference conformance tests
@@ -217,5 +217,5 @@ jobs:
         if: ${{ inputs.production-release && inputs.enable-experimental }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload ${{ github.ref_name }} conformance-profile-inference.yaml --clobber
+        run: gh release upload ${{ inputs.release_version }} conformance-profile-inference.yaml --clobber
         working-directory: ./tests

.github/workflows/dependency-review.yml

@@ -15,6 +15,6 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: "Dependency Review"
-        uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
         with:
           config-file: "nginx/k8s-common/dependency-review-config.yml@main"

.github/workflows/lint.yml

@@ -47,7 +47,7 @@ jobs:
           go-version: stable
 
       - name: Lint Go
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
         with:
           working-directory: ${{ matrix.directory }}
           version: v2.6.1 # renovate: datasource=github-tags depName=golangci/golangci-lint

.github/workflows/mend.yml

@@ -32,7 +32,7 @@ permissions:
 jobs:
   mend:
     if: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) || (github.event_name == 'push' && github.event.repository.fork == false) }}
-    uses: nginxinc/compliance-rules/.github/workflows/mend.yml@a27656f8f9a8748085b434ebe007f5b572709aad # v0.2
+    uses: nginxinc/compliance-rules/.github/workflows/mend.yml@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
     secrets: inherit
     with:
       product_name: nginx-gateway-fabric_${{ github.ref_name }}

.pre-commit-config.yaml

@@ -52,7 +52,7 @@ repos:
   # Rules are in .markdownlint-cli2.yaml file
   # See https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md for rule descriptions
   - repo: https://github.com/DavidAnson/markdownlint-cli2
-    rev: v0.18.1
+    rev: v0.19.0
     hooks:
       - id: markdownlint-cli2
 

CHANGELOG.md

@@ -4,6 +4,47 @@ This document includes a curated changelog for each release. We also publish a c
 a [GitHub release](https://github.com/nginx/nginx-gateway-fabric/releases), which, by contrast, is auto-generated
 and includes links to all PRs that went into the release.
 
+## Release 2.2.1
+
+_November 13, 2025_
+
+FEATURES:
+
+- Add support to make endpoint picker communication settings configurable. [4105](https://github.com/nginx/nginx-gateway-fabric/pull/4105)
+
+BUG FIXES:
+
+- Support mixed externalname and local services in single route. [4188](https://github.com/nginx/nginx-gateway-fabric/pull/4188)
+- Preserve HPA replicas on deployment. [4214](https://github.com/nginx/nginx-gateway-fabric/pull/4214)
+- Preserve external controller annotations. [4182](https://github.com/nginx/nginx-gateway-fabric/pull/4182)
+- Fix bug where user mounted files were being removed by NGINX. [4178](https://github.com/nginx/nginx-gateway-fabric/pull/4178)
+- Fix bug that prevented HPA from working when Inference Extension was enabled. [4247](https://github.com/nginx/nginx-gateway-fabric/pull/4247)
+
+HELM CHART:
+
+- Allow disabling cert-generator with a Helm value. [4186](https://github.com/nginx/nginx-gateway-fabric/pull/4186). Thanks to [fabian4](https://github.com/fabian4)
+- The version of the Helm chart is now 2.2.1
+
+
+KNOWN ISSUES:
+
+- Data plane sometimes does not sync upstream server IPs. [3626](https://github.com/nginx/nginx-gateway-fabric/issues/3626)
+
+COMPATIBILITY:
+
+- Gateway API version: `1.3.0`
+- Gateway API Inference Extension version: `1.0.1`
+- NGINX version: `1.29.2`
+- NGINX Plus version: `R35`
+- NGINX Agent version: `v3.5.0`
+- Kubernetes version: `1.25+`
+
+CONTAINER IMAGES:
+
+- Control plane: `ghcr.io/nginx/nginx-gateway-fabric:2.2.1`
+- Data plane: `ghcr.io/nginx/nginx-gateway-fabric/nginx:2.2.1`
+- Data plane with NGINX Plus: `private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:2.2.1`
+
 ## Release 2.2.0
 
 _October 22, 2025_
@@ -27,6 +68,10 @@ HELM CHART:
 - The version of the Helm chart is now 2.2.0
 - Set NGINX Plus default image. [3919](https://github.com/nginx/nginx-gateway-fabric/pull/3919)
 
+KNOWN ISSUES:
+
+- Data plane sometimes does not sync upstream server IPs. [3626](https://github.com/nginx/nginx-gateway-fabric/issues/3626)
+
 COMPATIBILITY:
 
 - Gateway API version: `1.3.0`

README.md

@@ -36,7 +36,7 @@ You can find the comprehensive NGINX Gateway Fabric user documentation on the [N
 We publish NGINX Gateway Fabric releases on GitHub. See
 our [releases page](https://github.com/nginx/nginx-gateway-fabric/releases).
 
-The latest release is [2.2.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v2.2.0).
+The latest release is [2.2.1](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v2.2.1).
 
 The edge version is useful for experimenting with new features that are not yet published in a release. To use, choose
 the _edge_ version built from the [latest commit](https://github.com/nginx/nginx-gateway-fabric/commits/main)
@@ -47,7 +47,7 @@ to the correct versions:
 
 | Version        | Description                              | Installation Manifests                                                         | Documentation and Examples                                                                                                                                           |
 |----------------|------------------------------------------|--------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Latest release | For production use                       | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.0/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.0/examples).                        |
+| Latest release | For production use                       | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.1/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.1/examples).                        |
 | Edge           | For experimental use and latest features | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/main/deploy).   | [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/main/examples). |
 
 ### Versioning
@@ -68,7 +68,8 @@ The following table lists the software versions NGINX Gateway Fabric supports.
 
 | NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus | NGINX Agent |
 |----------------------|-------------|------------|-----------|------------|-------------|
-| Edge                 | 1.4.0       | 1.25+      | 1.29.2    | R35        | v3.4.2      |
+| Edge                 | 1.4.0       | 1.25+      | 1.29.3    | R35        | v3.5.0      |
+| 2.2.1                | 1.3.0       | 1.25+      | 1.29.2    | R35        | v3.5.0      |
 | 2.2.0                | 1.3.0       | 1.25+      | 1.29.2    | R35        | v3.3.2      |
 | 2.1.4                | 1.3.0       | 1.25+      | 1.29.1    | R35        | v3.3.1      |
 | 2.1.3                | 1.3.0       | 1.25+      | 1.29.1    | R35        | v3.3.1      |