From fc9b2804f0dbd96a4297199d5c5b36d8519def9d Mon Sep 17 00:00:00 2001 From: "kumahq[bot]" <110050114+kumahq[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 08:06:33 +0000 Subject: [PATCH] chore(deps): update docs from repo source Signed-off-by: kumahq[bot] <110050114+kumahq[bot]@users.noreply.github.com> --- app/_data/products/mesh.yml | 11 +- app/assets/mesh/raw/CHANGELOG.md | 385 +++++++++++++++++++++++++++++++ 2 files changed, 394 insertions(+), 2 deletions(-) diff --git a/app/_data/products/mesh.yml b/app/_data/products/mesh.yml index b465841170b..b6bba052696 100644 --- a/app/_data/products/mesh.yml +++ b/app/_data/products/mesh.yml @@ -75,9 +75,16 @@ releases: lts: true - version: 2.14.6 release: "2.14" - latest: true + releaseDate: "2026-06-12" + eol: "2027-06-12" branch: release-2.14 - - version: preview + - version: 3.0.0 release: "3.0" + latest: true + releaseDate: "2026-10-15" + eol: "2027-10-15" + branch: release-3.0 + - version: preview + release: "3.1" branch: master label: dev diff --git a/app/assets/mesh/raw/CHANGELOG.md b/app/assets/mesh/raw/CHANGELOG.md index 89172ed01cb..1afc00577fb 100644 --- a/app/assets/mesh/raw/CHANGELOG.md +++ b/app/assets/mesh/raw/CHANGELOG.md @@ -1,6 +1,391 @@ # Changelog +## 3.0.0 +> Released on 2026/10/15 + +* feat(api): serve Kong Mesh config on /config [#10961](https://github.com/Kong/kong-mesh/pull/10961) @lukidzi +* feat(ca): increase default cert lifetime to 5 days [#10378](https://github.com/Kong/kong-mesh/pull/10378) @lukidzi +* feat(deps)!: migrate module path to github.com/Kong/kong-mesh/v3 [#10000](https://github.com/Kong/kong-mesh/pull/10000) @Automaat +* feat(konnect)!: remove POST /provision-zone [#10640](https://github.com/Kong/kong-mesh/pull/10640) @bartsmykla +* feat(konnect): block /config [#10800](https://github.com/Kong/kong-mesh/pull/10800) @slonka +* feat(konnect): block v3 CPs from the v1 API [#10801](https://github.com/Kong/kong-mesh/pull/10801) @slonka +* feat(mink): set tenant version on create [#10056](https://github.com/Kong/kong-mesh/pull/10056) @slonka +* feat(mink): tenants GET/PATCH [#10021](https://github.com/Kong/kong-mesh/pull/10021) @slonka +* feat(oapi): add license to generated OAS [#10866](https://github.com/Kong/kong-mesh/pull/10866) @Automaat +* feat(opa): remove legacy proto xDS config gen [#10105](https://github.com/Kong/kong-mesh/pull/10105) @lukidzi +* feat(policy)!: remove MeshGlobalRateLimit [#10284](https://github.com/Kong/kong-mesh/pull/10284) @slonka +* feat(postgres): add version column to tenants table [#10018](https://github.com/Kong/kong-mesh/pull/10018) @lobkovilya +* feat(rbac)!: remove legacy AccessRole qualifiers [#11112](https://github.com/Kong/kong-mesh/pull/11112) @lukidzi +* feat(rbac)!: stop granting admin to unauthenticated callers [#10678](https://github.com/Kong/kong-mesh/pull/10678) @bartsmykla +* feat(rbac): expose KRI for RBAC resources [#10051](https://github.com/Kong/kong-mesh/pull/10051) @slonka +* feat(rbac): match AccessRole targetRef by labels [#10144](https://github.com/Kong/kong-mesh/pull/10144) @bartsmykla +* feat(rls): shard tenant work by version when CP versions share a database [#10058](https://github.com/Kong/kong-mesh/pull/10058) @slonka +* fix(config): sanitize the Konnect client secret and RLS password [#10690](https://github.com/Kong/kong-mesh/pull/10690) @bartsmykla +* fix(helm): name the current kubeadm admin group in the prod profiles [#10687](https://github.com/Kong/kong-mesh/pull/10687) @bartsmykla +* fix(konnect): stop cross-org control plane deletion [#10675](https://github.com/Kong/kong-mesh/pull/10675) @bartsmykla +* fix(kuma-cp): log control plane on startup [#10940](https://github.com/Kong/kong-mesh/pull/10940) @slonka +* fix(kuma-cp): name the real skip-admin-role key [#10679](https://github.com/Kong/kong-mesh/pull/10679) @bartsmykla +* fix(license): respect API server base path [#10002](https://github.com/Kong/kong-mesh/pull/10002) @Automaat +* fix(meshidentity): avoid startup errors when cert-manager CRDs are not installed [#11036](https://github.com/Kong/kong-mesh/pull/11036) @lobkovilya +* fix(meshidentity): drop cert-manager universal log [#10941](https://github.com/Kong/kong-mesh/pull/10941) @slonka +* fix(meshopa): avoid panic on unset sendRawBody [#11122](https://github.com/Kong/kong-mesh/pull/11122) @lukidzi +* fix(oapi): add kri to RBAC resource OAS schemas [#10128](https://github.com/Kong/kong-mesh/pull/10128) @slonka +* fix(policies): drop gateway support in MeshGlobalRateLimit, MeshOPA [#10098](https://github.com/Kong/kong-mesh/pull/10098) @Automaat +* fix(rbac): compute default RBAC resource labels [#10129](https://github.com/Kong/kong-mesh/pull/10129) @slonka +* fix(rbac): decide a delete from the object it carries [#10685](https://github.com/Kong/kong-mesh/pull/10685) @bartsmykla +* fix(rbac): gate /config on the access type made for it [#10683](https://github.com/Kong/kong-mesh/pull/10683) @bartsmykla +* fix(rls): forget the organization when the tenant is deleted [#10688](https://github.com/Kong/kong-mesh/pull/10688) @bartsmykla +* fix(rls): key the organization cache the way Postgres reads the id [#10738](https://github.com/Kong/kong-mesh/pull/10738) @bartsmykla +* fix(rls): make a delete with no relation an actual no-op [#10737](https://github.com/Kong/kong-mesh/pull/10737) @bartsmykla +* fix(rls): report the real error when a tenant delete fails [#10677](https://github.com/Kong/kong-mesh/pull/10677) @bartsmykla +* konnect-authn now verifies token signatures against kauth's JWKS and requires `kmesh.konnect.authn.jwksPath` [#10358](https://github.com/Kong/kong-mesh/pull/10358) @bartsmykla +* reject symlink escapes when writing the AWS IAM dataplane token, and create its directory traversable [#10375](https://github.com/Kong/kong-mesh/pull/10375) @bartsmykla +* chore(deps): bump Kong shared-go [#11088](https://github.com/Kong/kong-mesh/pull/11088) @renovate +* chore(deps): bump Kong/kong-mesh-v3-readiness from 0.4.0 to 0.5.0 [#10411](https://github.com/Kong/kong-mesh/pull/10411) @renovate +* chore(deps): bump aws-sdk-go-v2 monorepo [#9899](https://github.com/Kong/kong-mesh/pull/9899) [#10239](https://github.com/Kong/kong-mesh/pull/10239) [#10397](https://github.com/Kong/kong-mesh/pull/10397) [#10466](https://github.com/Kong/kong-mesh/pull/10466) [#10832](https://github.com/Kong/kong-mesh/pull/10832) [#10933](https://github.com/Kong/kong-mesh/pull/10933) [#11023](https://github.com/Kong/kong-mesh/pull/11023) @renovate +* chore(deps): bump cert-manager from 1.16.0 to 1.21.2 [#9907](https://github.com/Kong/kong-mesh/pull/9907) [#10160](https://github.com/Kong/kong-mesh/pull/10160) [#10398](https://github.com/Kong/kong-mesh/pull/10398) [#10825](https://github.com/Kong/kong-mesh/pull/10825) @renovate +* chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from 487f66a to 72b5ad8 [#9895](https://github.com/Kong/kong-mesh/pull/9895) [#10337](https://github.com/Kong/kong-mesh/pull/10337) [#10822](https://github.com/Kong/kong-mesh/pull/10822) @renovate +* chore(deps): bump github.com/DataDog/dd-trace-go/v2 from 2.5.0 to 2.8.1 [#10131](https://github.com/Kong/kong-mesh/pull/10131) @renovate +* chore(deps): bump github.com/Kong/kauth-api from 1.178.0 to 1.181.0 [#10166](https://github.com/Kong/kong-mesh/pull/10166) [#10408](https://github.com/Kong/kong-mesh/pull/10408) [#10835](https://github.com/Kong/kong-mesh/pull/10835) @renovate +* chore(deps): bump github.com/Kong/shared-go/identity from 1.48.0 to 1.57.0 [#9888](https://github.com/Kong/kong-mesh/pull/9888) [#10262](https://github.com/Kong/kong-mesh/pull/10262) [#10348](https://github.com/Kong/kong-mesh/pull/10348) [#10564](https://github.com/Kong/kong-mesh/pull/10564) [#10813](https://github.com/Kong/kong-mesh/pull/10813) [#10872](https://github.com/Kong/kong-mesh/pull/10872) [#10976](https://github.com/Kong/kong-mesh/pull/10976) @renovate +* chore(deps): bump github.com/Kong/shared-go/rest/v2 from 2.18.0 to 2.20.0 [#10049](https://github.com/Kong/kong-mesh/pull/10049) [#10333](https://github.com/Kong/kong-mesh/pull/10333) [#10582](https://github.com/Kong/kong-mesh/pull/10582) [#10977](https://github.com/Kong/kong-mesh/pull/10977) @renovate +* chore(deps): bump github.com/Kong/shared-go/slogdiscard from 1.2.0 to 1.2.2 [#10379](https://github.com/Kong/kong-mesh/pull/10379) [#11013](https://github.com/Kong/kong-mesh/pull/11013) @renovate +* chore(deps): bump github.com/Kong/shared-go/zap-utils/v2 from 2.4.2 to 2.7.2 [#10050](https://github.com/Kong/kong-mesh/pull/10050) [#10380](https://github.com/Kong/kong-mesh/pull/10380) [#10978](https://github.com/Kong/kong-mesh/pull/10978) @renovate +* chore(deps): bump github.com/aws/smithy-go from 1.27.3 to 1.28.5 [#9945](https://github.com/Kong/kong-mesh/pull/9945) [#10833](https://github.com/Kong/kong-mesh/pull/10833) [#11136](https://github.com/Kong/kong-mesh/pull/11136) @renovate +* chore(deps): bump github.com/cert-manager/cert-manager from 1.20.2 to 1.21.2 [#10161](https://github.com/Kong/kong-mesh/pull/10161) [#10401](https://github.com/Kong/kong-mesh/pull/10401) [#10828](https://github.com/Kong/kong-mesh/pull/10828) @renovate +* chore(deps): bump github.com/onsi/gomega from 1.43.1 to 1.44.0 [#10929](https://github.com/Kong/kong-mesh/pull/10929) @renovate +* chore(deps): bump github.com/open-policy-agent/opa from 1.17.0 to 1.21.1 [#9940](https://github.com/Kong/kong-mesh/pull/9940) [#10409](https://github.com/Kong/kong-mesh/pull/10409) [#10836](https://github.com/Kong/kong-mesh/pull/10836) [#10930](https://github.com/Kong/kong-mesh/pull/10930) [#11029](https://github.com/Kong/kong-mesh/pull/11029) @renovate +* chore(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0 [#10413](https://github.com/Kong/kong-mesh/pull/10413) [#10837](https://github.com/Kong/kong-mesh/pull/10837) @renovate +* chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.45.0 [#10915](https://github.com/Kong/kong-mesh/pull/10915) @renovate +* chore(deps): bump kumahq/kuma from 0fcd9c983f82 to v3.0.0 [#9929](https://github.com/Kong/kong-mesh/pull/9929) [#9952](https://github.com/Kong/kong-mesh/pull/9952) [#10005](https://github.com/Kong/kong-mesh/pull/10005) [#10007](https://github.com/Kong/kong-mesh/pull/10007) [#10013](https://github.com/Kong/kong-mesh/pull/10013) [#10023](https://github.com/Kong/kong-mesh/pull/10023) [#10025](https://github.com/Kong/kong-mesh/pull/10025) [#10055](https://github.com/Kong/kong-mesh/pull/10055) [#10072](https://github.com/Kong/kong-mesh/pull/10072) [#10073](https://github.com/Kong/kong-mesh/pull/10073) [#10108](https://github.com/Kong/kong-mesh/pull/10108) [#10116](https://github.com/Kong/kong-mesh/pull/10116) [#10135](https://github.com/Kong/kong-mesh/pull/10135) [#10145](https://github.com/Kong/kong-mesh/pull/10145) [#10174](https://github.com/Kong/kong-mesh/pull/10174) [#10178](https://github.com/Kong/kong-mesh/pull/10178) [#10254](https://github.com/Kong/kong-mesh/pull/10254) [#10256](https://github.com/Kong/kong-mesh/pull/10256) [#10260](https://github.com/Kong/kong-mesh/pull/10260) [#10277](https://github.com/Kong/kong-mesh/pull/10277) [#10286](https://github.com/Kong/kong-mesh/pull/10286) [#10288](https://github.com/Kong/kong-mesh/pull/10288) [#10297](https://github.com/Kong/kong-mesh/pull/10297) [#10381](https://github.com/Kong/kong-mesh/pull/10381) [#10390](https://github.com/Kong/kong-mesh/pull/10390) [#10391](https://github.com/Kong/kong-mesh/pull/10391) [#10419](https://github.com/Kong/kong-mesh/pull/10419) [#10420](https://github.com/Kong/kong-mesh/pull/10420) [#10496](https://github.com/Kong/kong-mesh/pull/10496) [#10507](https://github.com/Kong/kong-mesh/pull/10507) [#10518](https://github.com/Kong/kong-mesh/pull/10518) [#10523](https://github.com/Kong/kong-mesh/pull/10523) [#10535](https://github.com/Kong/kong-mesh/pull/10535) [#10552](https://github.com/Kong/kong-mesh/pull/10552) [#10559](https://github.com/Kong/kong-mesh/pull/10559) [#10562](https://github.com/Kong/kong-mesh/pull/10562) [#10570](https://github.com/Kong/kong-mesh/pull/10570) [#10576](https://github.com/Kong/kong-mesh/pull/10576) [#10580](https://github.com/Kong/kong-mesh/pull/10580) [#10584](https://github.com/Kong/kong-mesh/pull/10584) [#10586](https://github.com/Kong/kong-mesh/pull/10586) [#10600](https://github.com/Kong/kong-mesh/pull/10600) [#10602](https://github.com/Kong/kong-mesh/pull/10602) [#10615](https://github.com/Kong/kong-mesh/pull/10615) [#10630](https://github.com/Kong/kong-mesh/pull/10630) [#10633](https://github.com/Kong/kong-mesh/pull/10633) [#10745](https://github.com/Kong/kong-mesh/pull/10745) [#10753](https://github.com/Kong/kong-mesh/pull/10753) [#10758](https://github.com/Kong/kong-mesh/pull/10758) [#10768](https://github.com/Kong/kong-mesh/pull/10768) [#10773](https://github.com/Kong/kong-mesh/pull/10773) [#10774](https://github.com/Kong/kong-mesh/pull/10774) [#10863](https://github.com/Kong/kong-mesh/pull/10863) [#10868](https://github.com/Kong/kong-mesh/pull/10868) [#10869](https://github.com/Kong/kong-mesh/pull/10869) [#10876](https://github.com/Kong/kong-mesh/pull/10876) [#10896](https://github.com/Kong/kong-mesh/pull/10896) [#10916](https://github.com/Kong/kong-mesh/pull/10916) [#10942](https://github.com/Kong/kong-mesh/pull/10942) [#10959](https://github.com/Kong/kong-mesh/pull/10959) [#10962](https://github.com/Kong/kong-mesh/pull/10962) [#11004](https://github.com/Kong/kong-mesh/pull/11004) [#11007](https://github.com/Kong/kong-mesh/pull/11007) [#11010](https://github.com/Kong/kong-mesh/pull/11010) [#11038](https://github.com/Kong/kong-mesh/pull/11038) [#11039](https://github.com/Kong/kong-mesh/pull/11039) [#11047](https://github.com/Kong/kong-mesh/pull/11047) [#11058](https://github.com/Kong/kong-mesh/pull/11058) [#11093](https://github.com/Kong/kong-mesh/pull/11093) [#11160](https://github.com/Kong/kong-mesh/pull/11160) [#11167](https://github.com/Kong/kong-mesh/pull/11167) [#11173](https://github.com/Kong/kong-mesh/pull/11173) [#11175](https://github.com/Kong/kong-mesh/pull/11175) [#11177](https://github.com/Kong/kong-mesh/pull/11177) [#11180](https://github.com/Kong/kong-mesh/pull/11180) [#11185](https://github.com/Kong/kong-mesh/pull/11185) [#11188](https://github.com/Kong/kong-mesh/pull/11188) @bartsmykla,@kong-mesh,@lobkovilya +* chore(deps): bump opentelemetry-go-contrib monorepo from 0.71.0 to 0.72.0 [#11031](https://github.com/Kong/kong-mesh/pull/11031) @renovate +* chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 [#10092](https://github.com/Kong/kong-mesh/pull/10092) @renovate +* chore(deps): bump registry.access.redhat.com/ubi9-minimal from 9.8-1780378819 to 9.8-1791808450 [#9968](https://github.com/Kong/kong-mesh/pull/9968) [#10404](https://github.com/Kong/kong-mesh/pull/10404) [#10471](https://github.com/Kong/kong-mesh/pull/10471) [#10829](https://github.com/Kong/kong-mesh/pull/10829) [#10932](https://github.com/Kong/kong-mesh/pull/10932) [#11026](https://github.com/Kong/kong-mesh/pull/11026) [#11139](https://github.com/Kong/kong-mesh/pull/11139) @renovate +* chore(deps): security update [#10668](https://github.com/Kong/kong-mesh/pull/10668) [#10926](https://github.com/Kong/kong-mesh/pull/10926) @kong-mesh +* chore(deps): use latest Kong/kong-mesh-gui [#9881](https://github.com/Kong/kong-mesh/pull/9881) [#10006](https://github.com/Kong/kong-mesh/pull/10006) [#10107](https://github.com/Kong/kong-mesh/pull/10107) [#10250](https://github.com/Kong/kong-mesh/pull/10250) [#10285](https://github.com/Kong/kong-mesh/pull/10285) [#10439](https://github.com/Kong/kong-mesh/pull/10439) [#10534](https://github.com/Kong/kong-mesh/pull/10534) [#10551](https://github.com/Kong/kong-mesh/pull/10551) [#10579](https://github.com/Kong/kong-mesh/pull/10579) [#10637](https://github.com/Kong/kong-mesh/pull/10637) [#10771](https://github.com/Kong/kong-mesh/pull/10771) [#10784](https://github.com/Kong/kong-mesh/pull/10784) [#10797](https://github.com/Kong/kong-mesh/pull/10797) [#10874](https://github.com/Kong/kong-mesh/pull/10874) [#10887](https://github.com/Kong/kong-mesh/pull/10887) [#10918](https://github.com/Kong/kong-mesh/pull/10918) [#10958](https://github.com/Kong/kong-mesh/pull/10958) [#10994](https://github.com/Kong/kong-mesh/pull/10994) [#11104](https://github.com/Kong/kong-mesh/pull/11104) [#11186](https://github.com/Kong/kong-mesh/pull/11186) @kong-mesh + +### Includes [kumahq/kuma@3.0.0](https://github.com/kumahq/kuma/releases/tag/3.0.0) changelog + +* chore(helm): the control plane and hook containers now drop all Linux capabilities and disallow privilege escalation [#18124](https://github.com/kumahq/kuma/pull/18124) @bartsmykla +* control plane now computes the kuma.io/display-name label for all resources [#17162](https://github.com/kumahq/kuma/pull/17162) @lobkovilya +* feat(api-server)!: remove legacy overview paths [#18367](https://github.com/kumahq/kuma/pull/18367) @Automaat +* feat(api-server)!: remove legacy policies endpoint [#18375](https://github.com/kumahq/kuma/pull/18375) @Automaat +* feat(api-server)!: remove ServiceInsight endpoints [#18376](https://github.com/kumahq/kuma/pull/18376) @Automaat +* feat(api-server): add `isInsight` and `adminOnly` to `_resources` entries [#18544](https://github.com/kumahq/kuma/pull/18544) @Automaat +* feat(api-server): add clusters to layout listeners [#18353](https://github.com/kumahq/kuma/pull/18353) @Automaat +* feat(api-server): add create-only resource endpoints [#18990](https://github.com/kumahq/kuma/pull/18990) @lobkovilya +* feat(api-server): add KRI overview endpoint [#18351](https://github.com/kumahq/kuma/pull/18351) @Automaat +* feat(api-server): add mesh _overview endpoints [#18349](https://github.com/kumahq/kuma/pull/18349) @Automaat +* feat(api-server): add pluggable per-route metadata provider [#17365](https://github.com/kumahq/kuma/pull/17365) @bartsmykla +* feat(api-server): filter overviews by status [#18352](https://github.com/kumahq/kuma/pull/18352) @Automaat +* feat(api-server): remove cross-mesh resource listing [#18999](https://github.com/kumahq/kuma/pull/18999) @Automaat +* feat(api-server): remove legacy per-policy inspect endpoints [#18405](https://github.com/kumahq/kuma/pull/18405) @Automaat +* feat(ca): increase default cert lifetime to 5 days [#17878](https://github.com/kumahq/kuma/pull/17878) @lukidzi +* feat(config)!: remove experimental auto reachable services [#17200](https://github.com/kumahq/kuma/pull/17200) @Automaat +* feat(db): add tolerateNewerDBVersions flag [#17019](https://github.com/kumahq/kuma/pull/17019) @slonka +* feat(defaults)!: stop auto-creating default TrafficPermission/TrafficRoute [#17316](https://github.com/kumahq/kuma/pull/17316) @Automaat +* feat(deps)!: migrate module path to /v3 [#16997](https://github.com/kumahq/kuma/pull/16997) @Automaat +* feat(dns)!: remove CoreDNS from data plane [#17230](https://github.com/kumahq/kuma/pull/17230) @lukidzi +* feat(dp)!: select reachableBackends by labels only [#18832](https://github.com/kumahq/kuma/pull/18832) @lukidzi +* feat(gateway)!: drop legacy connection policies + GatewayRoute [#17446](https://github.com/kumahq/kuma/pull/17446) @Automaat +* feat(gatewayapi): accept MeshService as parent and backend ref [#18013](https://github.com/kumahq/kuma/pull/18013) @Automaat +* feat(gatewayapi): honor parentRef port names [#18051](https://github.com/kumahq/kuma/pull/18051) @Automaat +* feat(gatewayapi): route mesh gRPC traffic with GRPCRoute [#18280](https://github.com/kumahq/kuma/pull/18280) @Automaat +* feat(helm): configurable zone proxy probes [#17228](https://github.com/kumahq/kuma/pull/17228) @lukidzi +* feat(intercp): add version to catalog instance [#17164](https://github.com/kumahq/kuma/pull/17164) @slonka +* feat(kds): add zone-version header to KDS client [#17670](https://github.com/kumahq/kuma/pull/17670) @lobkovilya +* feat(kds): authenticate zones with zone token [#18803](https://github.com/kumahq/kuma/pull/18803) @lukidzi +* feat(kds): name the resource type and size of the largest response when a KDS stream fails with ResourceExhausted [#18727](https://github.com/kumahq/kuma/pull/18727) @lukidzi +* feat(kds): stop syncing zone token secrets [#18855](https://github.com/kumahq/kuma/pull/18855) @lukidzi +* feat(kubernetes): reject global mode in bootstrap on k8s [#17479](https://github.com/kumahq/kuma/pull/17479) @Automaat +* feat(kuma-cp)!: remove inbound tags from Dataplane [#17867](https://github.com/kumahq/kuma/pull/17867) @Automaat +* feat(kuma-cp): default DPP refresh interval to 10s [#18384](https://github.com/kumahq/kuma/pull/18384) @lukidzi +* feat(kuma-cp): default inboundTagsDisabled to true [#17596](https://github.com/kumahq/kuma/pull/17596) @Automaat +* feat(kuma-cp): reject fields not in the schema on resource write [#18858](https://github.com/kumahq/kuma/pull/18858) @bartsmykla +* feat(kuma-cp): reload TLS certs without restart [#17882](https://github.com/kumahq/kuma/pull/17882) @lukidzi +* feat(kuma-dp): default unifiedResourceNaming to true [#17483](https://github.com/kumahq/kuma/pull/17483) @Automaat +* feat(kuma-dp): log resolved DNS queries, and add a per-component log level for kuma-dp [#18554](https://github.com/kumahq/kuma/pull/18554) @Automaat +* feat(labels): compute `kuma.io/origin` on global and zone control planes [#17176](https://github.com/kumahq/kuma/pull/17176) @lobkovilya +* feat(labels): drop the legacy proxy label scrub from Compute [#18753](https://github.com/kumahq/kuma/pull/18753) @lobkovilya +* feat(labels): enforce `kuma.io/origin` and `kuma.io/zone` on read [#18579](https://github.com/kumahq/kuma/pull/18579) @lobkovilya +* feat(labels): reject a control-plane-owned label whose value differs from the computed one [#18760](https://github.com/kumahq/kuma/pull/18760) @lobkovilya +* feat(labels): reject unknown reserved keys and validate user-settable label values on every write [#18759](https://github.com/kumahq/kuma/pull/18759) @lobkovilya +* feat(mads): restrict to universal deployment mode [#17868](https://github.com/kumahq/kuma/pull/17868) @Automaat +* feat(mesh)!: remove kuma.io/service tag [#18392](https://github.com/kumahq/kuma/pull/18392) @Automaat +* feat(mesh)!: remove legacy policy resource definitions [#17484](https://github.com/kumahq/kuma/pull/17484) @Automaat +* feat(mesh): default nil meshServices to Exclusive [#17102](https://github.com/kumahq/kuma/pull/17102) @Automaat +* feat(mesh): remove meshServices.mode API from Mesh [#17476](https://github.com/kumahq/kuma/pull/17476) @Automaat +* feat(meshhttproute): support backend request header modifiers [#18278](https://github.com/kumahq/kuma/pull/18278) @Automaat +* feat(meshidentity): make the SPIFFE ID immutable [#18669](https://github.com/kumahq/kuma/pull/18669) @Automaat +* feat(meshidentity): validate user-supplied CAs [#17930](https://github.com/kumahq/kuma/pull/17930) @lukidzi +* feat(meshpassthrough)!: default to None [#18842](https://github.com/kumahq/kuma/pull/18842) @lukidzi +* feat(meshtls): remove deprecated from[] [#17598](https://github.com/kumahq/kuma/pull/17598) @lukidzi +* feat(motb): deprecate inline OTel endpoint [#16023](https://github.com/kumahq/kuma/pull/16023) @bartsmykla +* feat(policy)!: drop MeshAccessLog OTel Endpoint for BackendRef [#17564](https://github.com/kumahq/kuma/pull/17564) @Automaat +* feat(policy)!: remove deprecated from[] from MeshCircuitBreaker [#17570](https://github.com/kumahq/kuma/pull/17570) @Automaat +* feat(policy): MLBS on zone proxy egress [#17718](https://github.com/kumahq/kuma/pull/17718) @lukidzi +* feat(readiness): gate on identity cert [#18558](https://github.com/kumahq/kuma/pull/18558) @Automaat +* feat(resources)!: enforce RFC 1035 names [#18026](https://github.com/kumahq/kuma/pull/18026) @lukidzi +* feat(store)!: always enable resource store cache [#18729](https://github.com/kumahq/kuma/pull/18729) @Automaat +* feat(tproxy): remove eBPF transparent proxy feature [#17225](https://github.com/kumahq/kuma/pull/17225) @lukidzi +* feat(validation): restrict crossZone to MeshMultizoneService [#18210](https://github.com/kumahq/kuma/pull/18210) @Automaat +* feat(xds)!: default reachableBackends to empty [#18831](https://github.com/kumahq/kuma/pull/18831) @lukidzi +* feat(xds)!: drop legacy CircuitBreaker from xDS generation [#17345](https://github.com/kumahq/kuma/pull/17345) @Automaat +* feat(xds)!: drop legacy HealthCheck from xDS generation [#17324](https://github.com/kumahq/kuma/pull/17324) @Automaat +* feat(xds)!: drop legacy Timeout consumption from xDS generation [#17398](https://github.com/kumahq/kuma/pull/17398) @Automaat +* feat(xds)!: drop RateLimit from xDS generation [#17323](https://github.com/kumahq/kuma/pull/17323) @Automaat +* feat(xds)!: drop TrafficPermission from xDS generation [#17428](https://github.com/kumahq/kuma/pull/17428) @Automaat +* feat(xds)!: drop TrafficRoute from xDS generation [#17423](https://github.com/kumahq/kuma/pull/17423) @Automaat +* feat(xds)!: drop TrafficTrace from xDS generation [#17384](https://github.com/kumahq/kuma/pull/17384) @Automaat +* feat(xds)!: drop VirtualOutbound from xDS generation [#17415](https://github.com/kumahq/kuma/pull/17415) @Automaat +* feat(xds): add mesh context build duration metric [#18685](https://github.com/kumahq/kuma/pull/18685) @Automaat +* feat(xds): make delta xDS the default and remove SOTW [#17040](https://github.com/kumahq/kuma/pull/17040) @Automaat +* feat(xds): unified-name for empty listener tags [#17563](https://github.com/kumahq/kuma/pull/17563) @lukidzi +* feat(xds): warn on stream close after large send [#16784](https://github.com/kumahq/kuma/pull/16784) @Automaat +* fix API server configuration error aggregation [#18421](https://github.com/kumahq/kuma/pull/18421) @Automaat +* fix applying resources whose name is longer than 63 characters on Universal [#18336](https://github.com/kumahq/kuma/pull/18336) @lobkovilya +* fix malformed API label filters [#18420](https://github.com/kumahq/kuma/pull/18420) @Automaat +* fix(api): align HTTP API with its error schema [#19155](https://github.com/kumahq/kuma/pull/19155) @kumahq +* fix(api-server)!: match layout to generated xDS [#18837](https://github.com/kumahq/kuma/pull/18837) @lukidzi +* fix(api-server): align catalog writability [#18449](https://github.com/kumahq/kuma/pull/18449) @Automaat +* fix(api-server): always render `zone` in a zone overview [#18663](https://github.com/kumahq/kuma/pull/18663) @Automaat +* fix(api-server): check kuma.io/origin on federated zones for every resource type [#18698](https://github.com/kumahq/kuma/pull/18698) @lobkovilya +* fix(api-server): inline REST for non-proto specs [#18545](https://github.com/kumahq/kuma/pull/18545) @Automaat +* fix(api-server): make kuma.io/origin immutable and reject writes to foreign-origin resources [#18412](https://github.com/kumahq/kuma/pull/18412) @lobkovilya +* fix(api-server): make startup transactional [#18423](https://github.com/kumahq/kuma/pull/18423) @Automaat +* fix(api-server): reject kuma.io/zone on Global and validate kuma.io/mesh on every mode [#18419](https://github.com/kumahq/kuma/pull/18419) @lobkovilya +* fix(api-server): rules panic and role validation [#16978](https://github.com/kumahq/kuma/pull/16978) @Automaat +* fix(api-server): send Content-Type on GUI fallback responses [#18399](https://github.com/kumahq/kuma/pull/18399) @Automaat +* fix(api-server): validate name path parameters [#19156](https://github.com/kumahq/kuma/pull/19156) @kumahq +* fix(auth): require workload-bound token for workload-derived identity [#17474](https://github.com/kumahq/kuma/pull/17474) @bartsmykla +* fix(charts): drain zone egress before shutdown [#18568](https://github.com/kumahq/kuma/pull/18568) @lukidzi +* fix(charts): drain zone ingress before shutdown [#18950](https://github.com/kumahq/kuma/pull/18950) @lukidzi +* fix(config): enforce RFC1123 compliance for zone names [#18011](https://github.com/kumahq/kuma/pull/18011) @Automaat +* fix(dashboards): use labels emitted by kuma-dp [#18574](https://github.com/kumahq/kuma/pull/18574) @lukidzi +* fix(dataplane): reject unknown enum values [#19111](https://github.com/kumahq/kuma/pull/19111) @kumahq +* fix(gatewayapi): break HTTPRoute conflicts by creationTimestamp [#18272](https://github.com/kumahq/kuma/pull/18272) @Automaat +* fix(gatewayapi): deny traffic when a backendRef is not permitted [#18267](https://github.com/kumahq/kuma/pull/18267) @Automaat +* fix(gatewayapi): fail closed on missing backendRef port [#18141](https://github.com/kumahq/kuma/pull/18141) @Automaat +* fix(gatewayapi): fail closed when a backendRef does not resolve [#18009](https://github.com/kumahq/kuma/pull/18009) @Automaat +* fix(gatewayapi): give a generated producer route the producer role [#18203](https://github.com/kumahq/kuma/pull/18203) @Automaat +* fix(gatewayapi): harden generated meshhttproute names [#18274](https://github.com/kumahq/kuma/pull/18274) @Automaat +* fix(gatewayapi): reject headless service route parents [#18150](https://github.com/kumahq/kuma/pull/18150) @Automaat +* fix(gatewayapi): reject route filters the mesh cannot apply [#18297](https://github.com/kumahq/kuma/pull/18297) @Automaat +* fix(gatewayapi): require ReferenceGrant for cross-namespace backendRefs [#18075](https://github.com/kumahq/kuma/pull/18075) @Automaat +* fix(helm): allow universal global control plane [#18212](https://github.com/kumahq/kuma/pull/18212) @slonka +* fix(helm): deny loopback admin and restore parentEnv in universal mode [#18452](https://github.com/kumahq/kuma/pull/18452) @bartsmykla +* fix(helm): drop legacy Gateway API route CRUD from control-plane workloads RBAC [#19045](https://github.com/kumahq/kuma/pull/19045) @kumahq +* fix(helm): honor dataPlane.image.pullPolicy in the injected sidecar and init containers [#19025](https://github.com/kumahq/kuma/pull/19025) @Automaat +* fix(helm): label system namespace on upgrade [#19047](https://github.com/kumahq/kuma/pull/19047) @slonka +* fix(helm): match Zone in the defaulting webhook [#18601](https://github.com/kumahq/kuma/pull/18601) @Automaat +* fix(helm): restore global zone sync service [#18256](https://github.com/kumahq/kuma/pull/18256) @slonka +* fix(helm): skip installing CRDs by default when installing in universal [#16078](https://github.com/kumahq/kuma/pull/16078) @lahabana +* fix(helm): stop zone proxy roll on upgrade [#18882](https://github.com/kumahq/kuma/pull/18882) @lukidzi +* fix(insights): don't mark data plane proxies as degraded because of ignored inbounds [#18734](https://github.com/kumahq/kuma/pull/18734) @Automaat +* fix(inspect-api): skip DNS validation for HostnameGenerator hostnames [#17016](https://github.com/kumahq/kuma/pull/17016) @lobkovilya +* fix(intercp): distinguish unreachable leader from leader change [#17068](https://github.com/kumahq/kuma/pull/17068) @Automaat +* fix(k8s): always probe the sidecar readiness port [#18346](https://github.com/kumahq/kuma/pull/18346) @Automaat +* fix(k8s): copy node labels to Dataplane labels [#17480](https://github.com/kumahq/kuma/pull/17480) @lukidzi +* fix(k8s): dedup inbounds only when tags disabled [#17197](https://github.com/kumahq/kuma/pull/17197) @lukidzi +* fix(k8s): default sidecar concurrency to 2 [#18696](https://github.com/kumahq/kuma/pull/18696) @lukidzi +* fix(k8s): drop Mesh owner from MeshZoneAddress [#18749](https://github.com/kumahq/kuma/pull/18749) @lukidzi +* fix(k8s): drop reserved pod labels before computing Dataplane labels [#18411](https://github.com/kumahq/kuma/pull/18411) [#18648](https://github.com/kumahq/kuma/pull/18648) @lobkovilya +* fix(k8s): enforce control-plane-owned labels on read [#18271](https://github.com/kumahq/kuma/pull/18271) @lobkovilya +* fix(k8s): parse kuma.io/gateway as a boolean [#18354](https://github.com/kumahq/kuma/pull/18354) @Automaat +* fix(k8s): read system-namespace-only resources from the system namespace only [#19051](https://github.com/kumahq/kuma/pull/19051) @lobkovilya +* fix(k8s): reconcile pods that match a Service only once ignoredServiceSelectorLabels are stripped [#18441](https://github.com/kumahq/kuma/pull/18441) @Automaat +* fix(k8s): reject mesh not matching ownerReference [#18060](https://github.com/kumahq/kuma/pull/18060) @Automaat +* fix(k8s): reject user-set service-account label [#18273](https://github.com/kumahq/kuma/pull/18273) @lukidzi +* fix(k8s): stop dropping traffic on selector move [#18561](https://github.com/kumahq/kuma/pull/18561) @lukidzi +* fix(kds): attribute zone-to-global synced resources by the connecting zone's client-id [#17456](https://github.com/kumahq/kuma/pull/17456) @bartsmykla +* fix(kds): keep 2.14 zones serving MeshServices behind a 3.0 global [#18870](https://github.com/kumahq/kuma/pull/18870) @bartsmykla +* fix(kds): keep zone KDS multiplex alive when a diagnostic rpc stream fails [#19009](https://github.com/kumahq/kuma/pull/19009) @kumahq +* fix(kds): omit MeshTrust status from sync [#18598](https://github.com/kumahq/kuma/pull/18598) @Automaat +* fix(kds): only accept subscribed resource types [#19062](https://github.com/kumahq/kuma/pull/19062) @slonka +* fix(kds): replace rather than merge when reading a spec from the JSON wire form [#18672](https://github.com/kumahq/kuma/pull/18672) @Automaat +* fix(kds): restore event-based watchdog intervals [#18621](https://github.com/kumahq/kuma/pull/18621) @Automaat +* fix(kds): retry sync updates on write conflicts [#17738](https://github.com/kumahq/kuma/pull/17738) @lukidzi +* fix(kds): survive oversized Envoy admin responses [#18127](https://github.com/kumahq/kuma/pull/18127) @lukidzi +* fix(kuma): unwrap DeletedFinalStateUnknown in k8s event listener [#17066](https://github.com/kumahq/kuma/pull/17066) @Automaat +* fix(kuma-cp): advertise a zone ingress node that serves traffic [#18078](https://github.com/kumahq/kuma/pull/18078) @lukidzi +* fix(kuma-cp): leave headroom below GOMEMLIMIT [#18853](https://github.com/kumahq/kuma/pull/18853) @lukidzi +* fix(kuma-dp): avoid double scrape on otel export (backport of #18871) [#18906](https://github.com/kumahq/kuma/pull/18906) @kumahq +* fix(kuma-dp): restrict readiness reporter to /ready [#17317](https://github.com/kumahq/kuma/pull/17317) @bartsmykla +* fix(kumactl): strip kuma.io/zone from federation exports [#18730](https://github.com/kumahq/kuma/pull/18730) @bartsmykla +* fix(kumactl): use current policy inspect API [#18425](https://github.com/kumahq/kuma/pull/18425) @Automaat +* fix(kumactl): warn when the server's major version is higher than kumactl's, including preview servers [#19042](https://github.com/kumahq/kuma/pull/19042) @Automaat +* fix(labels): make Compute authoritative for zone, env, namespace and service-account [#18410](https://github.com/kumahq/kuma/pull/18410) @lobkovilya +* fix(mesh): gateway tag not required tagless [#17610](https://github.com/kumahq/kuma/pull/17610) @Automaat +* fix(meshaccesslog): match rule-scoped route ids [#17548](https://github.com/kumahq/kuma/pull/17548) @Automaat +* fix(meshhttproute): 503 for valid all-zero refs [#19053](https://github.com/kumahq/kuma/pull/19053) @slonka +* fix(meshhttproute): resolve mirror backendRef [#17676](https://github.com/kumahq/kuma/pull/17676) @lukidzi +* fix(meshhttproute): return 404 when no route rule matches [#18268](https://github.com/kumahq/kuma/pull/18268) @Automaat +* fix(meshhttproute): return 500 for unresolvable backendref shares [#18146](https://github.com/kumahq/kuma/pull/18146) @Automaat +* fix(meshhttproute): return 503 for zero-weight backends [#18340](https://github.com/kumahq/kuma/pull/18340) @Automaat +* fix(meshhttproute): sort pathless match as root [#19018](https://github.com/kumahq/kuma/pull/19018) @lukidzi +* fix(meshidentity): reconcile labels on generated MeshTrusts [#18989](https://github.com/kumahq/kuma/pull/18989) @lobkovilya +* fix(meshidentity): reconcile the MeshTrust trust domain when it changes [#18607](https://github.com/kumahq/kuma/pull/18607) @Automaat +* fix(meshmetric): honor includeUnused sidecar flag [#18477](https://github.com/kumahq/kuma/pull/18477) @Automaat +* fix(meshmetric): require client certs for ActiveMTLSBackend [#19026](https://github.com/kumahq/kuma/pull/19026) @bartsmykla +* fix(meshpassthrough): correct validator typo [#18879](https://github.com/kumahq/kuma/pull/18879) @lukidzi +* fix(meshpassthrough): drop duplicate chain matches [#18226](https://github.com/kumahq/kuma/pull/18226) @lukidzi +* fix(meshpassthrough): keep mysql port excludes [#19024](https://github.com/kumahq/kuma/pull/19024) @slonka +* fix(meshpassthrough): resolve domain matches in the sidecar so they pin the destination [#18658](https://github.com/kumahq/kuma/pull/18658) @Automaat +* fix(meshproxypatch): honor circuit breaker patches [#18207](https://github.com/kumahq/kuma/pull/18207) @lukidzi +* fix(meshproxypatch): match unified listener names [#17545](https://github.com/kumahq/kuma/pull/17545) @Automaat +* fix(meshservice): identities fallback tagless [#17657](https://github.com/kumahq/kuma/pull/17657) @Automaat +* fix(meshservice): reconcile generated selector [#18876](https://github.com/kumahq/kuma/pull/18876) @lukidzi +* fix(meshservice): stop telling clients to originate mTLS before the destination can terminate it [#18475](https://github.com/kumahq/kuma/pull/18475) @Automaat +* fix(meshtimeout): keep zone egress rule timeouts [#18979](https://github.com/kumahq/kuma/pull/18979) @lukidzi +* fix(meshtimeout): rules/to are mutually exclusive [#17589](https://github.com/kumahq/kuma/pull/17589) @Automaat +* fix(meshtls): allow TLS 1.3 on outbound mTLS [#18865](https://github.com/kumahq/kuma/pull/18865) @lukidzi +* fix(meshtls): apply the TLS version and ciphers to the upstream side of proxies that have no inbounds, such as delegated gateways [#18444](https://github.com/kumahq/kuma/pull/18444) @Automaat +* fix(meshtls): honor inbound ports and tls bounds [#17847](https://github.com/kumahq/kuma/pull/17847) @lukidzi +* fix(meshtls): sort inbound SAN matchers for stable config [#17144](https://github.com/kumahq/kuma/pull/17144) @lukidzi +* fix(meshtrafficpermission): reject empty match entries [#19020](https://github.com/kumahq/kuma/pull/19020) @bartsmykla +* fix(mtls): derive identity without tags [#17606](https://github.com/kumahq/kuma/pull/17606) @Automaat +* fix(mtls): drop legacy identity secret when MeshIdentity is assigned [#16947](https://github.com/kumahq/kuma/pull/16947) @lukidzi +* fix(mtp): unified naming for zone egress [#17560](https://github.com/kumahq/kuma/pull/17560) @Automaat +* fix(oas): always serve dataplane outbound address [#18668](https://github.com/kumahq/kuma/pull/18668) @Automaat +* fix(oas): render proto enums as string enums [#18350](https://github.com/kumahq/kuma/pull/18350) @Automaat +* fix(oas): require pagination fields on list endpoints [#18666](https://github.com/kumahq/kuma/pull/18666) @Automaat +* fix(observability): use NoBackendRefsConfigured reason when no MeshOpenTelemetryBackend references are configured [#19010](https://github.com/kumahq/kuma/pull/19010) @kumahq +* fix(policy): scope producer role to own namespace [#18848](https://github.com/kumahq/kuma/pull/18848) @slonka +* fix(resyncer): change log level from error to info [#18269](https://github.com/kumahq/kuma/pull/18269) @lobkovilya +* fix(ServiceInsight): keep delegated gateways when meshServices.mode is Exclusive [#17431](https://github.com/kumahq/kuma/pull/17431) @lobkovilya +* fix(store): keep labels on the resource after a postgres update [#18929](https://github.com/kumahq/kuma/pull/18929) @lobkovilya +* fix(tokens): correct admin token extraction hint [#18828](https://github.com/kumahq/kuma/pull/18828) @slonka +* fix(tokens): reject a non-string kid header and recover from dp-server handler panics [#17465](https://github.com/kumahq/kuma/pull/17465) @bartsmykla +* fix(version): accept the previous major's last minor as compatible [#19135](https://github.com/kumahq/kuma/pull/19135) @kumahq +* fix(xds): avoid panic when fetching resources fails in base mesh context [#17675](https://github.com/kumahq/kuma/pull/17675) @lobkovilya +* fix(xds): build cross-zone SNI from port name [#17739](https://github.com/kumahq/kuma/pull/17739) @lukidzi +* fix(xds): de-gate mTLS-only paths for MeshIdentity [#17931](https://github.com/kumahq/kuma/pull/17931) @lukidzi +* fix(xds): do not mutate the cached Dataplane [#18751](https://github.com/kumahq/kuma/pull/18751) @lukidzi +* fix(xds): drop MES with unloadable TLS material [#18873](https://github.com/kumahq/kuma/pull/18873) @lukidzi +* fix(xds): drop resourceVersion from Dataplane hash [#17127](https://github.com/kumahq/kuma/pull/17127) @Automaat +* fix(xds): empty reachable labels select all [#18860](https://github.com/kumahq/kuma/pull/18860) @lukidzi +* fix(xds): fix inbound cluster name lookup [#17504](https://github.com/kumahq/kuma/pull/17504) @Automaat +* fix(xds): fix unified naming detection for zone proxies [#17511](https://github.com/kumahq/kuma/pull/17511) @Automaat +* fix(xds): ignore workload status in mesh hash [#17064](https://github.com/kumahq/kuma/pull/17064) @Automaat +* fix(xds): keep every MES matched by reachable refs [#18833](https://github.com/kumahq/kuma/pull/18833) @lukidzi +* fix(xds): pick up recreated same-name policies [#18731](https://github.com/kumahq/kuma/pull/18731) @lukidzi +* fix(xds): probe fallback route uses unified cluster name [#17498](https://github.com/kumahq/kuma/pull/17498) @Automaat +* fix(xds): reject unsupported SOTW streams [#18343](https://github.com/kumahq/kuma/pull/18343) @Automaat +* fix(xds): resync dataplanes when identity is ready [#17764](https://github.com/kumahq/kuma/pull/17764) @lukidzi +* fix(xds): skip zone egress without identity [#18747](https://github.com/kumahq/kuma/pull/18747) @lukidzi +* fix(xds): speed up Envoy stats tag extraction [#18910](https://github.com/kumahq/kuma/pull/18910) @bartsmykla +* fix(xds): throttle dataplane cert issuance on CA failure [#17448](https://github.com/kumahq/kuma/pull/17448) @slonka +* fix(xds): unified naming for zone-proxy admin cluster [#17543](https://github.com/kumahq/kuma/pull/17543) @Automaat +* fix(xds): use resolved dataplane addr in mesh ctx [#17836](https://github.com/kumahq/kuma/pull/17836) @lukidzi +* fix(xds): validate labels of the Dataplane passed to kuma-dp run [#18898](https://github.com/kumahq/kuma/pull/18898) @lobkovilya +* fix(xds): wait for destination TLS before mTLS [#17848](https://github.com/kumahq/kuma/pull/17848) @lukidzi +* fix: preserve explicit inbound service-tag identity for mixed-label Universal dataplanes after inboundTagsDisabled removal [#17728](https://github.com/kumahq/kuma/pull/17728) @Automaat +* honor the API server maximum TLS version [#18422](https://github.com/kumahq/kuma/pull/18422) @Automaat +* KDS no longer tears down the stream when the store rejects a single synced resource - the resource is NACKed and the rest of the batch is applied. [#18077](https://github.com/kumahq/kuma/pull/18077) @lukidzi +* perf(api-server): cache inspection endpoint reads [#18844](https://github.com/kumahq/kuma/pull/18844) @slonka +* perf(api-server): cache the dataplane _rules inspection endpoint (backport of #17760) [#18843](https://github.com/kumahq/kuma/pull/18843) @kumahq +* perf(k8s): reuse manager informers for events [#18852](https://github.com/kumahq/kuma/pull/18852) @lukidzi +* perf(kds): align flush ticks across zones [#18624](https://github.com/kumahq/kuma/pull/18624) @Automaat +* perf(kds): cache the zone lookup in sync filter [#18626](https://github.com/kumahq/kuma/pull/18626) @Automaat +* perf(kds): carry unchanged types over verbatim [#18625](https://github.com/kumahq/kuma/pull/18625) @Automaat +* perf(kds): reuse versions for unchanged types [#18622](https://github.com/kumahq/kuma/pull/18622) @Automaat +* perf(kds): share mapped resources across zones [#18638](https://github.com/kumahq/kuma/pull/18638) @Automaat +* perf(mads): reuse MeshMetric matches per mesh [#18687](https://github.com/kumahq/kuma/pull/18687) @Automaat +* perf(matchers): add LRU cache for MatchedPolicies [#17017](https://github.com/kumahq/kuma/pull/17017) @Automaat +* perf(xds): rebuild mesh context parts on their own [#18684](https://github.com/kumahq/kuma/pull/18684) @Automaat +* perf(xds): replace proto.Equal with content hashes in reconcile [#17008](https://github.com/kumahq/kuma/pull/17008) @Automaat +* perf(xds): reuse unchanged mesh context parts [#18683](https://github.com/kumahq/kuma/pull/18683) @Automaat +* perf(xds): stabilize policy matching hash [#18686](https://github.com/kumahq/kuma/pull/18686) @Automaat +* refactor(api)!: remove the `kuma.io/gateway` label and annotation [#18662](https://github.com/kumahq/kuma/pull/18662) @Automaat +* refactor(api)!: remove the ServiceInsight resource [#18538](https://github.com/kumahq/kuma/pull/18538) @Automaat +* refactor(core): remove Kafka as a supported protocol [#17831](https://github.com/kumahq/kuma/pull/17831) @Automaat +* refactor(dataplane): mark gateways with a label [#18366](https://github.com/kumahq/kuma/pull/18366) @Automaat +* refactor(defaults)!: a new Mesh no longer comes with default policies [#18661](https://github.com/kumahq/kuma/pull/18661) @bartsmykla +* refactor(defaults): remove default policy updates [#18342](https://github.com/kumahq/kuma/pull/18342) @Automaat +* refactor(mesh)!: drop non-Exclusive meshServices.mode branches [#17457](https://github.com/kumahq/kuma/pull/17457) @Automaat +* refactor(targetref)!: narrow backendRef kinds [#18391](https://github.com/kumahq/kuma/pull/18391) @Automaat +* refactor(xds): remove legacy reachableServices [#17615](https://github.com/kumahq/kuma/pull/17615) @lukidzi +* Remove the `BUILTIN` gateway type, the `gatewayBuiltin` insight statistics and the `?gateway=builtin` filter [#18058](https://github.com/kumahq/kuma/pull/18058) @lukidzi +* Remove unused control plane DNS settings and correct the control plane configuration reference. [#19146](https://github.com/kumahq/kuma/pull/19146) @lobkovilya +* Removed a noisy info log emitted on every MADS snapshot generation when both MeshMetrics and Mesh 'metrics' were configured. [#17069](https://github.com/kumahq/kuma/pull/17069) @lobkovilya +* chore(deps): bump Kong/kong-mesh-v3-readiness from 0.1.0 to 0.6.4 [#17021](https://github.com/kumahq/kuma/pull/17021) [#17023](https://github.com/kumahq/kuma/pull/17023) [#17026](https://github.com/kumahq/kuma/pull/17026) [#17950](https://github.com/kumahq/kuma/pull/17950) [#18183](https://github.com/kumahq/kuma/pull/18183) [#18464](https://github.com/kumahq/kuma/pull/18464) [#18717](https://github.com/kumahq/kuma/pull/18717) [#18957](https://github.com/kumahq/kuma/pull/18957) [#19089](https://github.com/kumahq/kuma/pull/19089) @renovate +* chore(deps): bump ci-tools/release-tool from 1.4.6 to 1.5.0 [#19013](https://github.com/kumahq/kuma/pull/19013) @kumahq +* chore(deps): bump cirello.io/pglock from 1.16.1 to 1.18.0 [#17334](https://github.com/kumahq/kuma/pull/17334) [#18961](https://github.com/kumahq/kuma/pull/18961) [#19092](https://github.com/kumahq/kuma/pull/19092) @renovate +* chore(deps): bump coredns from 1.14.2 to 1.14.6 [#17368](https://github.com/kumahq/kuma/pull/17368) @renovate +* chore(deps): bump debian from 13.5 to 13.7 [#17645](https://github.com/kumahq/kuma/pull/17645) [#18815](https://github.com/kumahq/kuma/pull/18815) @renovate +* chore(deps): bump debian:13.5 from 4ae6766 to d07d1b5 [#16950](https://github.com/kumahq/kuma/pull/16950) [#17043](https://github.com/kumahq/kuma/pull/17043) @renovate +* chore(deps): bump debian:13.6 from fac46bf to f324c7f [#17937](https://github.com/kumahq/kuma/pull/17937) [#18237](https://github.com/kumahq/kuma/pull/18237) @renovate +* chore(deps): bump debian:13.7 from 9cc0800 to 913f670 [#19077](https://github.com/kumahq/kuma/pull/19077) @renovate +* chore(deps): bump envoy from 1.38.2 to 1.39.4 [#17022](https://github.com/kumahq/kuma/pull/17022) [#17427](https://github.com/kumahq/kuma/pull/17427) [#18228](https://github.com/kumahq/kuma/pull/18228) [#19070](https://github.com/kumahq/kuma/pull/19070) [#19144](https://github.com/kumahq/kuma/pull/19144) @lukidzi,@renovate +* chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug from 35a3865 to 51c3587 [#17325](https://github.com/kumahq/kuma/pull/17325) [#17485](https://github.com/kumahq/kuma/pull/17485) [#18085](https://github.com/kumahq/kuma/pull/18085) [#18171](https://github.com/kumahq/kuma/pull/18171) @renovate +* chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug-nonroot from 6cec643 to 83b8737 [#17326](https://github.com/kumahq/kuma/pull/17326) [#17486](https://github.com/kumahq/kuma/pull/17486) [#18086](https://github.com/kumahq/kuma/pull/18086) [#18172](https://github.com/kumahq/kuma/pull/18172) @renovate +* chore(deps): bump gcr.io/distroless/static-debian12:debug-nonroot from f414196 to d5563cc [#17327](https://github.com/kumahq/kuma/pull/17327) [#17487](https://github.com/kumahq/kuma/pull/17487) [#18087](https://github.com/kumahq/kuma/pull/18087) [#18173](https://github.com/kumahq/kuma/pull/18173) @renovate +* chore(deps): bump gcr.io/k8s-staging-build-image/distroless-iptables from 0.9.2 to 0.11.0 [#16956](https://github.com/kumahq/kuma/pull/16956) [#17335](https://github.com/kumahq/kuma/pull/17335) [#17637](https://github.com/kumahq/kuma/pull/17637) [#18817](https://github.com/kumahq/kuma/pull/18817) @renovate +* chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from 5a7b674 to 7403610 [#16951](https://github.com/kumahq/kuma/pull/16951) [#17044](https://github.com/kumahq/kuma/pull/17044) [#17104](https://github.com/kumahq/kuma/pull/17104) [#17329](https://github.com/kumahq/kuma/pull/17329) [#17488](https://github.com/kumahq/kuma/pull/17488) [#17629](https://github.com/kumahq/kuma/pull/17629) [#17938](https://github.com/kumahq/kuma/pull/17938) [#18088](https://github.com/kumahq/kuma/pull/18088) [#18174](https://github.com/kumahq/kuma/pull/18174) [#18458](https://github.com/kumahq/kuma/pull/18458) [#19078](https://github.com/kumahq/kuma/pull/19078) @renovate +* chore(deps): bump ghcr.io/spiffe/spire-agent from 1.15.1 to 1.15.2 [#17638](https://github.com/kumahq/kuma/pull/17638) @renovate +* chore(deps): bump ghcr.io/spiffe/spire-server from 1.15.1 to 1.15.2 [#17337](https://github.com/kumahq/kuma/pull/17337) @renovate +* chore(deps): bump ginkgo from 2.29.0 to 2.33.1 [#16961](https://github.com/kumahq/kuma/pull/16961) [#17053](https://github.com/kumahq/kuma/pull/17053) [#18091](https://github.com/kumahq/kuma/pull/18091) [#18705](https://github.com/kumahq/kuma/pull/18705) [#18818](https://github.com/kumahq/kuma/pull/18818) [#19085](https://github.com/kumahq/kuma/pull/19085) @renovate +* chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20251124112456-a79f5cb04181 from a79f5cb to ddf65ac [#17045](https://github.com/kumahq/kuma/pull/17045) @renovate +* chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20260622121138-ddf65ac69581 from ddf65ac to ea51ed6 [#17630](https://github.com/kumahq/kuma/pull/17630) @renovate +* chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20260720125501-ea51ed66dcc4 from ea51ed6 to f0426b3 [#17782](https://github.com/kumahq/kuma/pull/17782) @renovate +* chore(deps): bump github.com/cilium/ebpf from 0.21.0 to 0.22.0 [#17054](https://github.com/kumahq/kuma/pull/17054) @renovate +* chore(deps): bump github.com/containernetworking/cni from 1.3.0 to 1.3.1 [#18461](https://github.com/kumahq/kuma/pull/18461) @renovate +* chore(deps): bump github.com/emicklei/go-restful/v3 from 3.13.0 to 3.14.0 [#19093](https://github.com/kumahq/kuma/pull/19093) @renovate +* chore(deps): bump github.com/envoyproxy/go-control-plane* [#18123](https://github.com/kumahq/kuma/pull/18123) @renovate +* chore(deps): bump github.com/exaring/otelpgx from 0.11.1 to 0.13.0 [#18706](https://github.com/kumahq/kuma/pull/18706) [#19094](https://github.com/kumahq/kuma/pull/19094) @renovate +* chore(deps): bump github.com/go-logr/logr from 1.4.3 to 1.4.4 [#17639](https://github.com/kumahq/kuma/pull/17639) @renovate +* chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.19.1 to 4.20.1 [#18707](https://github.com/kumahq/kuma/pull/18707) @renovate +* chore(deps): bump github.com/gruntwork-io/terratest from 1.0.0 to 1.0.1 [#17049](https://github.com/kumahq/kuma/pull/17049) @renovate +* chore(deps): bump github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0 [#18708](https://github.com/kumahq/kuma/pull/18708) @renovate +* chore(deps): bump github.com/miekg/dns from 1.1.72 to 1.1.73 [#18179](https://github.com/kumahq/kuma/pull/18179) @renovate +* chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.3 [#18109](https://github.com/kumahq/kuma/pull/18109) @bartsmykla +* chore(deps): bump github.com/onsi/gomega from 1.41.0 to 1.44.0 [#16962](https://github.com/kumahq/kuma/pull/16962) [#17050](https://github.com/kumahq/kuma/pull/17050) [#18246](https://github.com/kumahq/kuma/pull/18246) [#18809](https://github.com/kumahq/kuma/pull/18809) [#18891](https://github.com/kumahq/kuma/pull/18891) @renovate +* chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.25.0 [#17646](https://github.com/kumahq/kuma/pull/17646) [#19095](https://github.com/kumahq/kuma/pull/19095) @renovate +* chore(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 [#18462](https://github.com/kumahq/kuma/pull/18462) @renovate +* chore(deps): bump github.com/prometheus/common from 0.68.1 to 0.72.0 [#16986](https://github.com/kumahq/kuma/pull/16986) [#17647](https://github.com/kumahq/kuma/pull/17647) [#18467](https://github.com/kumahq/kuma/pull/18467) [#18962](https://github.com/kumahq/kuma/pull/18962) @renovate +* chore(deps): bump github.com/sethvargo/go-retry from 0.3.0 to 0.5.0 [#17648](https://github.com/kumahq/kuma/pull/17648) [#19097](https://github.com/kumahq/kuma/pull/19097) @renovate +* chore(deps): bump github.com/shopspring/decimal from 1.4.0 to 1.5.0 [#19098](https://github.com/kumahq/kuma/pull/19098) @renovate +* chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.7.0 to 2.9.0 [#16987](https://github.com/kumahq/kuma/pull/16987) [#18810](https://github.com/kumahq/kuma/pull/18810) [#19099](https://github.com/kumahq/kuma/pull/19099) @renovate +* chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 [#18188](https://github.com/kumahq/kuma/pull/18188) @renovate +* chore(deps): bump github.com/testcontainers/testcontainers-go from 0.43.0 to 0.44.0 [#17949](https://github.com/kumahq/kuma/pull/17949) @renovate +* chore(deps): bump go.opentelemetry.io/proto/otlp from 1.10.0 to 1.11.1 [#17649](https://github.com/kumahq/kuma/pull/17649) [#18955](https://github.com/kumahq/kuma/pull/18955) @renovate +* chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.56.0 [#16963](https://github.com/kumahq/kuma/pull/16963) [#17192](https://github.com/kumahq/kuma/pull/17192) [#18347](https://github.com/kumahq/kuma/pull/18347) @renovate +* chore(deps): bump golang.org/x/exp from 055de63 to faecfb2 [#16952](https://github.com/kumahq/kuma/pull/16952) [#17330](https://github.com/kumahq/kuma/pull/17330) [#17489](https://github.com/kumahq/kuma/pull/17489) [#17783](https://github.com/kumahq/kuma/pull/17783) [#18089](https://github.com/kumahq/kuma/pull/18089) [#18175](https://github.com/kumahq/kuma/pull/18175) [#18255](https://github.com/kumahq/kuma/pull/18255) [#18702](https://github.com/kumahq/kuma/pull/18702) [#19079](https://github.com/kumahq/kuma/pull/19079) @renovate +* chore(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 [#18068](https://github.com/kumahq/kuma/pull/18068) @renovate +* chore(deps): bump golang.org/x/net from 0.59.0 to 0.60.0 [#19029](https://github.com/kumahq/kuma/pull/19029) @renovate +* chore(deps): bump golang.org/x/tools from 0.46.0 to 0.52.0 [#17055](https://github.com/kumahq/kuma/pull/17055) [#17342](https://github.com/kumahq/kuma/pull/17342) [#18714](https://github.com/kumahq/kuma/pull/18714) [#18963](https://github.com/kumahq/kuma/pull/18963) [#19104](https://github.com/kumahq/kuma/pull/19104) @renovate +* chore(deps): bump golangci-lint from 2.12.2 to 2.14.0 [#18189](https://github.com/kumahq/kuma/pull/18189) [#18242](https://github.com/kumahq/kuma/pull/18242) [#18892](https://github.com/kumahq/kuma/pull/18892) @renovate +* chore(deps): bump google.golang.org/genproto/googleapis/* from 3dc84a4 to fad4113 [#16953](https://github.com/kumahq/kuma/pull/16953) [#16980](https://github.com/kumahq/kuma/pull/16980) [#17105](https://github.com/kumahq/kuma/pull/17105) [#17631](https://github.com/kumahq/kuma/pull/17631) [#17784](https://github.com/kumahq/kuma/pull/17784) [#17939](https://github.com/kumahq/kuma/pull/17939) [#18176](https://github.com/kumahq/kuma/pull/18176) [#18238](https://github.com/kumahq/kuma/pull/18238) [#18459](https://github.com/kumahq/kuma/pull/18459) [#18703](https://github.com/kumahq/kuma/pull/18703) [#18805](https://github.com/kumahq/kuma/pull/18805) [#18884](https://github.com/kumahq/kuma/pull/18884) [#19080](https://github.com/kumahq/kuma/pull/19080) @renovate +* chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.84.0 [#17110](https://github.com/kumahq/kuma/pull/17110) [#17515](https://github.com/kumahq/kuma/pull/17515) [#17789](https://github.com/kumahq/kuma/pull/17789) [#17999](https://github.com/kumahq/kuma/pull/17999) [#18181](https://github.com/kumahq/kuma/pull/18181) [#18243](https://github.com/kumahq/kuma/pull/18243) [#18819](https://github.com/kumahq/kuma/pull/18819) @renovate +* chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 [#18093](https://github.com/kumahq/kuma/pull/18093) @renovate +* chore(deps): bump helm from 4.2.0 to 4.3.0 [#16957](https://github.com/kumahq/kuma/pull/16957) [#16984](https://github.com/kumahq/kuma/pull/16984) [#17338](https://github.com/kumahq/kuma/pull/17338) [#18094](https://github.com/kumahq/kuma/pull/18094) [#18715](https://github.com/kumahq/kuma/pull/18715) @renovate +* chore(deps): bump jdx/mise-action from 4.3.0 to 5.1.1" [#18977](https://github.com/kumahq/kuma/pull/18977) @lukidzi +* chore(deps): bump k8s.io/kube-openapi from 865597e to be32def [#16981](https://github.com/kumahq/kuma/pull/16981) [#17046](https://github.com/kumahq/kuma/pull/17046) [#17331](https://github.com/kumahq/kuma/pull/17331) [#17632](https://github.com/kumahq/kuma/pull/17632) [#18177](https://github.com/kumahq/kuma/pull/18177) @renovate +* chore(deps): bump k8s.io/utils from ff6756f to cf1189d [#16982](https://github.com/kumahq/kuma/pull/16982) [#17047](https://github.com/kumahq/kuma/pull/17047) [#17332](https://github.com/kumahq/kuma/pull/17332) @renovate +* chore(deps): bump kindest/node from 1.36.1 to 1.37.0 [#18248](https://github.com/kumahq/kuma/pull/18248) @renovate +* chore(deps): bump kubectl from 1.36.1 to 1.37.1 [#16958](https://github.com/kumahq/kuma/pull/16958) [#17642](https://github.com/kumahq/kuma/pull/17642) [#18184](https://github.com/kumahq/kuma/pull/18184) [#18253](https://github.com/kumahq/kuma/pull/18253) [#18889](https://github.com/kumahq/kuma/pull/18889) @renovate +* chore(deps): bump kubernetes monorepo from 0.36.1 to 0.36.2 [#16959](https://github.com/kumahq/kuma/pull/16959) @renovate +* chore(deps): bump kubernetes monorepo from 0.36.2 to 0.36.3 [#17643](https://github.com/kumahq/kuma/pull/17643) @renovate +* chore(deps): bump kubernetes monorepo from 0.36.3 to 0.36.4 [#18185](https://github.com/kumahq/kuma/pull/18185) @renovate +* chore(deps): bump kubernetes monorepo from 0.36.4 to 0.37.0 [#18249](https://github.com/kumahq/kuma/pull/18249) @renovate +* chore(deps): bump kubernetes monorepo from 0.37.0 to 0.37.1 - autoclosed [#18890](https://github.com/kumahq/kuma/pull/18890) @renovate +* chore(deps): bump opentelemetry-go monorepo [#17951](https://github.com/kumahq/kuma/pull/17951) [#18250](https://github.com/kumahq/kuma/pull/18250) [#18964](https://github.com/kumahq/kuma/pull/18964) @renovate +* chore(deps): bump opentelemetry-go-contrib monorepo from 0.69.0 to 0.70.0 [#17952](https://github.com/kumahq/kuma/pull/17952) @renovate +* chore(deps): bump opentelemetry-go-contrib monorepo from 0.70.0 to 0.71.0 [#18251](https://github.com/kumahq/kuma/pull/18251) @renovate +* chore(deps): bump opentelemetry-go-contrib monorepo from 0.71.0 to 0.72.0 [#18965](https://github.com/kumahq/kuma/pull/18965) @renovate +* chore(deps): bump postgres:latest from 8ff36f3 to 74935e7 [#16955](https://github.com/kumahq/kuma/pull/16955) [#17048](https://github.com/kumahq/kuma/pull/17048) [#17333](https://github.com/kumahq/kuma/pull/17333) [#17633](https://github.com/kumahq/kuma/pull/17633) [#17941](https://github.com/kumahq/kuma/pull/17941) [#18090](https://github.com/kumahq/kuma/pull/18090) [#18239](https://github.com/kumahq/kuma/pull/18239) [#18806](https://github.com/kumahq/kuma/pull/18806) [#18885](https://github.com/kumahq/kuma/pull/18885) [#19081](https://github.com/kumahq/kuma/pull/19081) @renovate +* chore(deps): bump projectcalico/tigera-operator from 3.32.0 to 3.33.0 [#17051](https://github.com/kumahq/kuma/pull/17051) [#18245](https://github.com/kumahq/kuma/pull/18245) [#18966](https://github.com/kumahq/kuma/pull/18966) @renovate +* chore(deps): bump protobuf monorepo [#16968](https://github.com/kumahq/kuma/pull/16968) @renovate +* chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.2 [#18468](https://github.com/kumahq/kuma/pull/18468) [#18813](https://github.com/kumahq/kuma/pull/18813) [#18959](https://github.com/kumahq/kuma/pull/18959) @renovate +* chore(deps): bump sigs.k8s.io/controller-tools from 0.21.0 to 0.22.0 [#18469](https://github.com/kumahq/kuma/pull/18469) @renovate +* chore(deps): bump sigs.k8s.io/gateway-api from 1.5.1 to 1.6.0 [#17111](https://github.com/kumahq/kuma/pull/17111) @renovate +* chore(deps): bump spire from 1.15.2 to 1.15.3 [#18186](https://github.com/kumahq/kuma/pull/18186) @renovate +* chore(deps): bump testcontainers-go monorepo [#16989](https://github.com/kumahq/kuma/pull/16989) @renovate +* chore(deps): security update [#17620](https://github.com/kumahq/kuma/pull/17620) [#18066](https://github.com/kumahq/kuma/pull/18066) [#18136](https://github.com/kumahq/kuma/pull/18136) @kumahq +* chore(deps): use latest kumahq/kuma-gui [#16971](https://github.com/kumahq/kuma/pull/16971) [#16974](https://github.com/kumahq/kuma/pull/16974) [#16975](https://github.com/kumahq/kuma/pull/16975) [#17024](https://github.com/kumahq/kuma/pull/17024) [#17039](https://github.com/kumahq/kuma/pull/17039) [#17041](https://github.com/kumahq/kuma/pull/17041) [#17071](https://github.com/kumahq/kuma/pull/17071) [#17082](https://github.com/kumahq/kuma/pull/17082) [#17083](https://github.com/kumahq/kuma/pull/17083) [#17165](https://github.com/kumahq/kuma/pull/17165) [#17198](https://github.com/kumahq/kuma/pull/17198) [#17354](https://github.com/kumahq/kuma/pull/17354) [#17382](https://github.com/kumahq/kuma/pull/17382) [#17425](https://github.com/kumahq/kuma/pull/17425) [#17493](https://github.com/kumahq/kuma/pull/17493) [#17549](https://github.com/kumahq/kuma/pull/17549) [#17717](https://github.com/kumahq/kuma/pull/17717) [#17750](https://github.com/kumahq/kuma/pull/17750) [#17817](https://github.com/kumahq/kuma/pull/17817) [#17896](https://github.com/kumahq/kuma/pull/17896) [#17908](https://github.com/kumahq/kuma/pull/17908) [#17975](https://github.com/kumahq/kuma/pull/17975) [#18012](https://github.com/kumahq/kuma/pull/18012) [#18102](https://github.com/kumahq/kuma/pull/18102) [#18116](https://github.com/kumahq/kuma/pull/18116) [#18125](https://github.com/kumahq/kuma/pull/18125) [#18142](https://github.com/kumahq/kuma/pull/18142) [#18149](https://github.com/kumahq/kuma/pull/18149) [#18152](https://github.com/kumahq/kuma/pull/18152) [#18197](https://github.com/kumahq/kuma/pull/18197) [#18204](https://github.com/kumahq/kuma/pull/18204) [#18211](https://github.com/kumahq/kuma/pull/18211) [#18277](https://github.com/kumahq/kuma/pull/18277) [#18292](https://github.com/kumahq/kuma/pull/18292) [#18335](https://github.com/kumahq/kuma/pull/18335) [#18362](https://github.com/kumahq/kuma/pull/18362) [#18404](https://github.com/kumahq/kuma/pull/18404) [#18573](https://github.com/kumahq/kuma/pull/18573) [#18599](https://github.com/kumahq/kuma/pull/18599) [#18660](https://github.com/kumahq/kuma/pull/18660) [#18694](https://github.com/kumahq/kuma/pull/18694) [#18724](https://github.com/kumahq/kuma/pull/18724) [#18726](https://github.com/kumahq/kuma/pull/18726) [#18761](https://github.com/kumahq/kuma/pull/18761) [#18835](https://github.com/kumahq/kuma/pull/18835) [#18836](https://github.com/kumahq/kuma/pull/18836) [#18845](https://github.com/kumahq/kuma/pull/18845) [#18847](https://github.com/kumahq/kuma/pull/18847) [#18849](https://github.com/kumahq/kuma/pull/18849) [#18856](https://github.com/kumahq/kuma/pull/18856) [#18869](https://github.com/kumahq/kuma/pull/18869) [#18874](https://github.com/kumahq/kuma/pull/18874) [#18897](https://github.com/kumahq/kuma/pull/18897) [#18903](https://github.com/kumahq/kuma/pull/18903) [#18909](https://github.com/kumahq/kuma/pull/18909) [#18927](https://github.com/kumahq/kuma/pull/18927) [#19004](https://github.com/kumahq/kuma/pull/19004) [#19048](https://github.com/kumahq/kuma/pull/19048) [#19138](https://github.com/kumahq/kuma/pull/19138) [#19162](https://github.com/kumahq/kuma/pull/19162) @kumahq + + ## 2.14.6 > Released on 2026/10/14