What's Changed

• chore(ci)!: update CLI build pipeline by @olix0r in #14360
• build(deps): bump hashbrown from 0.15.2 to 0.15.5 by @dependabot[bot] in #14379
• proxy: v2.314.0 by @l5d-bot in #14388
• build(deps): bump hyper from 1.6.0 to 1.7.0 by @dependabot[bot] in #14390
• build(deps): bump cc from 1.2.32 to 1.2.33 by @dependabot[bot] in #14391
• chore(deps): bump extension-init from 0.1.6 to 0.1.7 by @cratelyn in #14392
• build(deps): bump sigs.k8s.io/kustomize/kyaml from 0.19.0 to 0.20.1 by @dependabot[bot] in #14375
• build(deps): bump syn from 2.0.105 to 2.0.106 by @dependabot[bot] in #14393
• feature(values): provide way to set custom securityContext for the pr… by @zaharidichev in #14347
• proxy: v2.315.0 by @l5d-bot in #14401
• fix(cli): install openssl in dockerfile by @cratelyn in #14403
• build(deps): bump serde_json from 1.0.142 to 1.0.143 by @dependabot[bot] in #14398
• fix(ci): cli tests need cli by @cratelyn in #14404
• fix(ci): double cli-build workflow timeout by @cratelyn in #14405

Full Changelog: edge-25.8.3...edge-25.8.4

What's Changed

• build(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 by @dependabot[bot] in #14335
• build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.7 by @dependabot[bot] in #14337
• build(deps): bump cc from 1.2.31 to 1.2.32 by @dependabot[bot] in #14343
• build(deps): bump rustversion from 1.0.21 to 1.0.22 by @dependabot[bot] in #14340
• build(deps): bump proc-macro2 from 1.0.95 to 1.0.96 by @dependabot[bot] in #14342
• build(deps): bump slab from 0.4.10 to 0.4.11 by @dependabot[bot] in #14341
• build(deps): bump google-github-actions/setup-gcloud from 2.1.5 to 2.2.0 in /.github/actions/helm-publish by @dependabot[bot] in #14344
• build(deps): bump golang.org/x/tools from 0.35.0 to 0.36.0 by @dependabot[bot] in #14336
• chore(inject): remove PatchProducer abstraction by @zaharidichev in #14346
• chore(identity): add !windows tag in run_proxy_unix.go by @zaharidichev in #14345
• chore(ci): disable fail-fast on test matrixes by @olix0r in #14349
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #14353
• build(deps): bump libc from 0.2.174 to 0.2.175 by @dependabot[bot] in #14355
• build(deps): bump glob from 0.3.2 to 0.3.3 by @dependabot[bot] in #14352
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14356
• build(deps): bump anyhow from 1.0.98 to 1.0.99 by @dependabot[bot] in #14357
• chore(ci): reduce integration test timeouts by @olix0r in #14358
• proxy: v2.313.0 by @l5d-bot in #14362
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14361
• build(deps): bump tj-actions/changed-files from 8cdfb7636d150253dee416a80f11c67f5ba7e9be to 239aef84a5502c79a1cea96e495d17588c66c659 by @dependabot[bot] in #14363
• chore(bin): remove install-pr script by @olix0r in #14364
• chore(ci): use docker/login-action by @olix0r in #14359
• chore(deps): Update tonic deps to 0.13 by @sfleen in #14365
• build(controller)!: eliminate policy-controller image by @olix0r in #14348
• build(deps): bump syn from 2.0.104 to 2.0.105 by @dependabot[bot] in #14366
• build(deps): bump indexmap from 2.2.6 to 2.10.0 by @dependabot[bot] in #14367
• build(deps): bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #14373
• build(deps): bump rand_core from 0.9.0 to 0.9.3 by @dependabot[bot] in #14368
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #14369
• build(deps): bump tj-actions/changed-files from 239aef84a5502c79a1cea96e495d17588c66c659 to 2036da178f85576f1940fedb74bb93a36cd89ab7 by @dependabot[bot] in #14372
• build(deps): bump github.com/linkerd/linkerd2-proxy-api from 0.16.0 to 0.17.0 by @dependabot[bot] in #14371
• build(deps): bump helm.sh/helm/v3 from 3.18.4 to 3.18.5 by @dependabot[bot] in #14370
• fix(ci): use correct GHCR creds by @zaharidichev in #14374

Full Changelog: edge-25.8.2...edge-25.8.3

What's Changed

• build(deps): bump tokio from 1.47.0 to 1.47.1 by @dependabot[bot] in #14316
• build(deps): bump event-listener from 5.4.0 to 5.4.1 by @dependabot[bot] in #14318
• build(deps): bump tokio-util from 0.7.15 to 0.7.16 by @dependabot[bot] in #14319
• build(deps): bump cc from 1.2.30 to 1.2.31 by @dependabot[bot] in #14317
• build(deps): bump signal-hook-registry from 1.4.5 to 1.4.6 by @dependabot[bot] in #14320
• build(deps): bump tj-actions/changed-files from 94d97fe3f88298bf8b2f2db6fa2ab150f3c1ab77 to c2ca2493190021783138cb8aac49bcee14b4bb89 by @dependabot[bot] in #14321
• build(deps): bump google-github-actions/auth from 2.1.11 to 2.1.12 by @dependabot[bot] in #14322
• chore(policy-controller): Use the aws-lc-rs TLS backend by @sfleen in #14300
• build(deps): bump tj-actions/changed-files from c2ca2493190021783138cb8aac49bcee14b4bb89 to 8cdfb7636d150253dee416a80f11c67f5ba7e9be by @dependabot[bot] in #14323
• chore(policy): Remove OpenSSL from the policy controller by @sfleen in #14292
• chore(extension-init): Bump extension-init to v0.1.5 by @sfleen in #14324
• fix: Allow aws-lc-fips-sys licenses in deny.toml by @sfleen in #14328
• proxy: v2.312.0 by @l5d-bot in #14327
• chore(extension-init): Bump extension-init to v0.1.6 by @sfleen in #14329
• chore(helm)!: change iptables default mode to nft by @alpeb in #14326
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #14325
• build(deps): bump tokio-metrics from 0.4.3 to 0.4.4 by @dependabot[bot] in #14332
• build(deps): bump h2 from 0.4.11 to 0.4.12 by @dependabot[bot] in #14331
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14330
• fix(policy): Fix env vars for building for arm64 by @sfleen in #14334

Full Changelog: edge-25.8.1...edge-25.8.2

What's Changed

• build(deps): bump backon from 1.5.1 to 1.5.2 by @dependabot[bot] in #14301
• build(deps): bump rustls from 0.23.30 to 0.23.31 by @dependabot[bot] in #14296
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14295
• build(deps): bump tj-actions/changed-files from db8d0bfea5a44e51abd5dc1454386c668ae901f9 to 18b05b98fcd9dc0bd3870d7a6571535999ba0c3f by @dependabot[bot] in #14302
• feat!(ci): Remove arm/v7 support by @sfleen in #14308
• build(deps): bump tj-actions/changed-files from 18b05b98fcd9dc0bd3870d7a6571535999ba0c3f to 94d97fe3f88298bf8b2f2db6fa2ab150f3c1ab77 by @dependabot[bot] in #14306
• build(deps): bump github.com/prometheus/client_golang from 1.22.0 to 1.23.0 by @dependabot[bot] in #14305
• build(deps): bump serde_json from 1.0.141 to 1.0.142 by @dependabot[bot] in #14304
• fix(proxy-identity): use execve call on Linux to start the proxy by @zaharidichev in #14307
• fix(helm): Fix cli version string in extensions by @adleong in #14309
• build(deps): bump linkerd-cni from 1.6.3 to 1.6.4 by @alpeb in #14310
• build(deps): bump network-validator from 0.1.3 to 0.1.4 by @alpeb in #14311

Full Changelog: edge-25.7.6...edge-25.8.1

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release supports percentages, as well as integers, when setting the maxUnavailable field in the podDisruptionBudget in Helm values (thanks, Wim de Groot!), cleans up the descriptions for some proxy metrics (thanks, @joedrf!), produces auditable binaries for the policy controller and proxy, and prefers AES algorithms over ChaCha20 for mTLS. It also correctly performs reproducible builds, fixing issue #13873.

What's Changed

• fix(values): make Controller values untyped by @wim-de-groot in #14205
• build(deps): bump tokio from 1.46.1 to 1.47.0 by @dependabot[bot] in #14285
• build(deps): bump rustls from 0.23.29 to 0.23.30 by @dependabot[bot] in #14283
• build(deps): bump rustc-demangle from 0.1.25 to 0.1.26 by @dependabot[bot] in #14282
• build(deps): bump dyn-clone from 1.0.19 to 1.0.20 by @dependabot[bot] in #14284
• build(deps): bump linkerd/dev to v47 by @olix0r in #14275
• build(deps): bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0 by @dependabot[bot] in #14273
• build(deps): bump tj-actions/changed-files from a0370f61698fcac830a08949da9fdf96ea0f3ab7 to db8d0bfea5a44e51abd5dc1454386c668ae901f9 by @dependabot[bot] in #14287
• build(policy-controller): produce auditable binaries by @olix0r in #14290
• chore(proxy): update linkerd-await to v0.3.1 by @olix0r in #14291
• fix(policy): Include aws-lc-rs as optional policy controller crypto… by @sfleen in #14264
• chore(inject): make PatchProducer and ValueOverrider more generic by @zaharidichev in #14254
• build(deps): bump aws-lc-rs from 1.13.1 to 1.13.3 by @dependabot[bot] in #14294
• Revert "fix(policy): Include aws-lc-rs as optional policy controller crypto backend (#14264) by @sfleen in #14299
• proxy: v2.311.0 by @l5d-bot in #14297
• refactor(helm): Replace VFS with embed for Helm chart rendering by @adleong in #14272

Full Changelog: edge-25.7.5...edge-25.7.6

Overall status: NOT RECOMMENDED, use edge-25.7.6 instead

Cautions

N/A

Changes

This release contains internal improvements, but if you're looking for new capabilities over edge-25.7.4, go straight to edge-25.7.6!

What's Changed

• chore(ci): enable overriding the runner in workflows by @olix0r in #14256
• build(deps): bump google.golang.org/grpc from 1.73.0 to 1.74.0 by @dependabot[bot] in #14252
• build(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.7 by @dependabot[bot] in #14253
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #14251
• build(deps-dev): bump webpack from 5.99.9 to 5.100.2 in /web/app by @dependabot[bot] in #14258
• build(deps): bump rand from 0.9.1 to 0.9.2 by @dependabot[bot] in #14259
• build(deps): bump cc from 1.2.29 to 1.2.30 by @dependabot[bot] in #14260
• build(deps): bump serde_json from 1.0.140 to 1.0.141 by @dependabot[bot] in #14261
• build(deps): bump google-github-actions/auth from 2.1.10 to 2.1.11 by @dependabot[bot] in #14262
• build(deps): bump google-github-actions/setup-gcloud from 2.1.4 to 2.1.5 in /.github/actions/helm-publish by @dependabot[bot] in #14263
• proxy: v2.310.0 by @l5d-bot in #14270
• build(deps): bump google.golang.org/grpc from 1.74.0 to 1.74.2 by @dependabot[bot] in #14267
• build(deps): bump io-uring from 0.7.8 to 0.7.9 by @dependabot[bot] in #14269
• build(deps): bump tj-actions/changed-files from 055970845dd036d7345da7399b7e89f2e10f2b04 to a0370f61698fcac830a08949da9fdf96ea0f3ab7 by @dependabot[bot] in #14271
• build(deps): bump hyper-util from 0.1.15 to 0.1.16 by @dependabot[bot] in #14268

Full Changelog: edge-25.7.4...edge-25.7.5

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release contains a fix to reduce the proxy's memory usage when handling many HTTP/1 connections.

What's Changed

• test(destination): Replace sleeps with RetryFor in ClusterStoreTest by @adleong in #14250
• proxy: v2.309.0 by @l5d-bot in #14255

Full Changelog: edge-25.7.3...edge-25.7.4

Overall status: NOT RECOMMENDED, use edge-25.7.4 instead

Cautions

N/A

Changes

This release reintroduces idle timeouts for HTTP/1 connections, and supports the AES_256_GCM cipher for mTLS. It also fixes an issue (#14228) where the Helm chart could fail to render when upgrading from a previous version.

What's Changed

• build(deps): bump rustls from 0.23.28 to 0.23.29 by @dependabot[bot] in #14230
• build(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 by @dependabot[bot] in #14229
• chore(build): remove choco by @alpeb in #14234
• chore: remove empty lines from manifests by @alpeb in #14233
• refactor(helm): Replace VFS with embed for Helm chart rendering by @adleong in #14206
• build(deps): bump query-string from 9.2.1 to 9.2.2 in /web/app by @dependabot[bot] in #14236
• build(deps): bump core-js from 3.43.0 to 3.44.0 in /web/app by @dependabot[bot] in #14238
• build(deps-dev): bump babel-jest from 30.0.2 to 30.0.4 in /web/app by @dependabot[bot] in #14239
• build(deps-dev): bump @babel/preset-env from 7.27.2 to 7.28.0 in /web/app by @dependabot[bot] in #14240
• build(deps): bump tj-actions/changed-files from 5f66af5912c4f9c360c03a612f98606fb0f83790 to 055970845dd036d7345da7399b7e89f2e10f2b04 by @dependabot[bot] in #14243
• build(deps): bump delegate from 0.13.3 to 0.13.4 by @dependabot[bot] in #14245
• chore(deps): update rust kube dependencies by @olix0r in #14235
• build(deps): bump golang.org/x/tools from 0.34.0 to 0.35.0 by @dependabot[bot] in #14242
• fix(helm): Fix helm rendering error when upgrading by @adleong in #14244
• test(policy): update postman tests to expect 200 response code by @adleong in #14248
• proxy: v2.308.0 by @l5d-bot in #14247
• revert(helm): Replace VFS with embed for Helm chart rendering (#14206) by @adleong in #14246

Full Changelog: edge-25.7.2...edge-25.7.3

Overall status: NOT RECOMMENDED, use edge-25.7.4 instead

Cautions

N/A

Changes

This release fixes an issue (#14176) where a Server resource with invalid selectors could prevent other Servers from being used.

What's Changed

• build(deps): bump h2 from 0.4.10 to 0.4.11 by @dependabot[bot] in #14196
• build(deps): bump openssl-src from 300.5.0+3.5.0 to 300.5.1+3.5.1 by @dependabot[bot] in #14198
• chore(docs): specify tagging instructions by @cratelyn in #14202
• build(deps): bump tokio from 1.45.1 to 1.46.0 by @dependabot[bot] in #14203
• build(deps): bump tj-actions/changed-files from 666c9d29007687c52e3c7aa2aac6c0ffcadeadc3 to e8772ff27de71367c2771ef3e8b5b2075b3f8282 by @dependabot[bot] in #14197
• build(deps): bump cc from 1.2.27 to 1.2.29 by @dependabot[bot] in #14215
• build(deps-dev): bump jest-environment-jsdom from 30.0.2 to 30.0.4 in /web/app by @dependabot[bot] in #14212
• build(deps): bump tokio from 1.46.0 to 1.46.1 by @dependabot[bot] in #14213
• build(deps-dev): bump @babel/eslint-parser from 7.27.5 to 7.28.0 in /web/app by @dependabot[bot] in #14211
• build(deps): bump tokio-metrics from 0.4.2 to 0.4.3 by @dependabot[bot] in #14207
• build(deps-dev): bump jest from 30.0.3 to 30.0.4 in /web/app by @dependabot[bot] in #14210
• build(deps): bump tj-actions/changed-files from e8772ff27de71367c2771ef3e8b5b2075b3f8282 to cf79a64fed8a943fb1073260883d08fe0dfb4e56 by @dependabot[bot] in #14216
• build(deps-dev): bump @babel/core from 7.27.7 to 7.28.0 in /web/app by @dependabot[bot] in #14209
• build(deps): bump hyper-util from 0.1.14 to 0.1.15 by @dependabot[bot] in #14219
• proxy: v2.307.0 by @l5d-bot in #14223
• build(deps): bump the clap group with 3 updates by @dependabot[bot] in #14224
• build(deps): bump tj-actions/changed-files from cf79a64fed8a943fb1073260883d08fe0dfb4e56 to 5f66af5912c4f9c360c03a612f98606fb0f83790 by @dependabot[bot] in #14225
• chore(build): bump linkerd/dev to v46 by @olix0r in #14226
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #13964
• build(deps): bump helm.sh/helm/v3 from 3.17.3 to 3.18.4 by @dependabot[bot] in #14222
• build(deps): bump cni-plugin to v1.6.3, proxy-init to v2.4.3, validator to v0.1.3 by @alpeb in #14221
• fix(destination): skip servers with invalid selectors by @adleong in #14195
• feature(inject): introduce PatchProducer abstraction by @zaharidichev in #14175

Full Changelog: edge-25.7.1...edge-25.7.2

Overall status: NOT RECOMMENDED, use edge-25.7.4 instead

Cautions

This release will no longer permit connections to a Service IP using a port that is not listed in the Service's spec.ports, in order to fix #13922 and to make Linkerd's behavior align with current Kubernetes behavior.

Changes

This release will refuse connections made to a Service port that is not listed in the Service's spec.ports, as described above. It also removes duplicate metrics keys from the proxy, and removes preserveUnknownFields from the linkerd-crds Helm chart's ServiceProfile template (thanks, Carlos Martell!).

What's Changed

• build(deps-dev): bump @babel/core from 7.27.4 to 7.27.7 in /web/app by @dependabot in #14191
• build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 in /web/app by @dependabot in #14190
• build(deps): bump bumpalo from 3.18.1 to 3.19.0 by @dependabot in #14189
• build(deps): bump rustc-demangle from 0.1.24 to 0.1.25 by @dependabot in #14187
• fix(helm): Remove preserveUnknownFields from service profile template in linkerd-crds chart by @cmartell-at-m42 in #14179
• fix(policy-controller)!: Disallow requests to undefined service ports by @adleong in #14149
• proxy: v2.305.0 by @l5d-bot in #14199
• proxy: v2.306.0 by @l5d-bot in #14200
• chore(docs): fix proxy update instructions by @cratelyn in #14201

New Contributors

• @cmartell-at-m42 made their first contribution in #14179

Full Changelog: edge-25.6.4...edge-25.7.1