What's Changed

• build(deps): bump axum from 0.8.4 to 0.8.6 by @dependabot[bot] in #14563
• build(deps): bump aws-lc-sys from 0.32.0 to 0.32.2 by @dependabot[bot] in #14568
• build(deps): bump dev to v48 by @olix0r in #14560
• chore(proxy): Add annotations to downward API by @sfleen in #14580
• chore(injector): promote native sidecars to beta by @alpeb in #14587
• Revert "chore(version)!: remove 'hotpatch' versioning (#14510)" by @olix0r in #14586
• build(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #14591
• build(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 by @dependabot[bot] in #14588
• build(deps): bump tj-actions/changed-files from 212f9a7760ad2b8eb511185b841f3725a62c2ae0 to d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449 by @dependabot[bot] in #14583
• proxy: v2.323.0 by @l5d-bot in #14590
• build(deps): bump softprops/action-gh-release from 2.3.3 to 2.4.0 by @dependabot[bot] in #14584
• chore(ci): update k8s and gateway-api versions by @olix0r in #14585
• build(deps): bump cc from 1.2.38 to 1.2.40 by @dependabot[bot] in #14575
• build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.1 by @dependabot[bot] in #14589
• build(deps): bump windows-implement from 0.60.0 to 0.60.2 by @dependabot[bot] in #14582
• build(deps): bump windows-core from 0.62.0 to 0.62.1 by @dependabot[bot] in #14550
• build(deps): bump the serde group with 3 updates by @dependabot[bot] in #14548
• build(deps): bump peter-evans/repository-dispatch from 3.0.0 to 4.0.0 by @dependabot[bot] in #14565
• build(deps): bump the pest group with 4 updates by @dependabot[bot] in #14574
• feat: Add labels for root parent object by @sfleen in #14578
• build(deps): bump google.golang.org/grpc from 1.75.1 to 1.76.0 by @dependabot[bot] in #14581
• build(deps): update github.com/imdario/mergo to dario.cat/mergo by @Juneezee in #14544
• chore(inject): Replace root owner mechanism by @sfleen in #14593
• build(deps): bump parking_lot from 0.12.4 to 0.12.5 by @dependabot[bot] in #14600
• build(deps): bump golang.org/x/tools from 0.37.0 to 0.38.0 by @dependabot[bot] in #14595
• build(deps): bump windows-interface from 0.59.2 to 0.59.3 by @dependabot[bot] in #14597
• build(deps): bump rustls-webpki from 0.103.6 to 0.103.7 by @dependabot[bot] in #14596
• build(deps): bump zeroize from 1.8.1 to 1.8.2 by @dependabot[bot] in #14598
• feat(inject): Populate proxy tracing values from annotations by @sfleen in #14592

Full Changelog: edge-25.10.1...edge-25.10.2

What's Changed

• build(deps): bump github.com/mattn/go-runewidth from 0.0.16 to 0.0.17 by @dependabot[bot] in #14532
• build(deps): bump windows-interface from 0.59.1 to 0.59.2 by @dependabot[bot] in #14534
• build(deps): bump regex from 1.11.2 to 1.11.3 by @dependabot[bot] in #14535
• build(deps): bump backtrace from 0.3.75 to 0.3.76 by @dependabot[bot] in #14536
• build(deps): bump memchr from 2.7.5 to 2.7.6 by @dependabot[bot] in #14537
• build(deps-dev): bump jest-environment-jsdom from 30.1.1 to 30.2.0 in /web/app by @dependabot[bot] in #14540
• build(deps): bump query-string from 9.2.2 to 9.3.1 in /web/app by @dependabot[bot] in #14541
• build(deps): bump the serde group with 3 updates by @dependabot[bot] in #14533
• build(deps): bump github.com/go-openapi/spec from 0.21.0 to 0.22.0 by @dependabot[bot] in #14545
• build(deps): bump tj-actions/changed-files from 4563c729c555b4141fac99c80f699f571219b836 to 28cf3adc4b6dbff2746d5216da021a10e53b4f58 by @dependabot[bot] in #14546
• proxy: v2.321.0 by @l5d-bot in #14556
• chore(tests): Separate tracing tests from viz by @sfleen in #14547
• build(deps): bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #14554
• chore(charts): Add separate namespace field for trace collector service account by @sfleen in #14539
• feat(tracing)!: Improve control plane tracing configuration by @sfleen in #14557
• feat(jaeger)!: Remove linkerd-jaeger extension by @sfleen in #14558
• build(deps): bump github.com/mattn/go-runewidth from 0.0.17 to 0.0.19 by @dependabot[bot] in #14549
• build(deps): bump quote from 1.0.40 to 1.0.41 by @dependabot[bot] in #14551
• build(deps): bump thiserror from 2.0.16 to 2.0.17 by @dependabot[bot] in #14552
• build(deps): bump anstyle from 1.0.11 to 1.0.13 by @dependabot[bot] in #14553
• build(deps): bump tj-actions/changed-files from 28cf3adc4b6dbff2746d5216da021a10e53b4f58 to 212f9a7760ad2b8eb511185b841f3725a62c2ae0 by @dependabot[bot] in #14555
• proxy: v2.322.0 by @l5d-bot in #14559

Full Changelog: edge-25.9.4...edge-25.10.1

What's Changed

• build(deps): bump tokio-rustls from 0.26.2 to 0.26.3 by @dependabot[bot] in #14514
• chore(release): stop producing .sha256 files by @olix0r in #14511
• chore(version)!: remove 'hotpatch' versioning by @olix0r in #14510
• fix(destination): discovery staleness when targetting the linkerd-admin port in native-sidecar mode by @alpeb in #14468
• build(deps): bump indexmap from 2.11.3 to 2.11.4 by @dependabot[bot] in #14515
• build(deps): bump Swatinem/rust-cache from 2.8.0 to 2.8.1 by @dependabot[bot] in #14516
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14517
• build(deps): bump the serde group with 3 updates by @dependabot[bot] in #14518
• build(deps): bump rustix from 0.38.38 to 0.38.44 by @dependabot[bot] in #14519
• build(deps): bump cc from 1.2.37 to 1.2.38 by @dependabot[bot] in #14521
• build(deps): bump tj-actions/changed-files from 2371aa7cd265d2e8a0213dc9e2a70dfcfb8fa114 to 4563c729c555b4141fac99c80f699f571219b836 by @dependabot[bot] in #14522
• build(deps): bump @fortawesome/free-regular-svg-icons from 6.7.2 to 7.0.1 in /web/app by @dependabot[bot] in #14486
• build(deps-dev): bump @babel/eslint-parser from 7.28.0 to 7.28.4 in /web/app by @dependabot[bot] in #14487
• build(deps-dev): bump babel-jest from 30.0.4 to 30.1.2 in /web/app by @dependabot[bot] in #14490
• build(deps): bump anyhow from 1.0.99 to 1.0.100 by @dependabot[bot] in #14520
• feat(gatewayAPI): Stop installing the gateway API by default by @adleong in #14523
• proxy: v2.320.0 by @l5d-bot in #14529
• build(deps): bump libloading from 0.8.8 to 0.8.9 by @dependabot[bot] in #14524
• build(deps): bump itertools from 0.12.1 to 0.13.0 by @dependabot[bot] in #14525
• build(deps): bump rustls from 0.23.31 to 0.23.32 by @dependabot[bot] in #14526
• build(deps): bump libc from 0.2.175 to 0.2.176 by @dependabot[bot] in #14528
• build(deps): bump aws-lc-rs from 1.14.0 to 1.14.1 by @dependabot[bot] in #14530
• Revert "build(deps): bump libloading from 0.8.8 to 0.8.9 (#14524)" by @cratelyn in #14531

Full Changelog: edge-25.9.3...edge-25.9.4

What's Changed

• build(deps): bump cc from 1.2.36 to 1.2.37 by @dependabot[bot] in #14491
• build(deps): bump serde_json from 1.0.143 to 1.0.145 by @dependabot[bot] in #14492
• build(deps): bump iana-time-zone from 0.1.63 to 0.1.64 by @dependabot[bot] in #14493
• build(deps): bump pest from 2.8.1 to 2.8.2 by @dependabot[bot] in #14494
• build(deps): bump serde from 1.0.219 to 1.0.223 by @dependabot[bot] in #14495
• build(deps): bump rustls-webpki from 0.103.5 to 0.103.6 by @dependabot[bot] in #14498
• build(deps): bump pest_derive from 2.8.1 to 2.8.2 by @dependabot[bot] in #14499
• build(deps): bump pest_meta from 2.8.1 to 2.8.2 by @dependabot[bot] in #14500
• build(deps): bump pest_generator from 2.8.1 to 2.8.2 by @dependabot[bot] in #14501
• build(deps): bump indexmap from 2.11.1 to 2.11.3 by @dependabot[bot] in #14502
• chore(deps): introduce a serde dependabot group by @cratelyn in #14497
• chore(deps): introduce a pest dependabot group by @cratelyn in #14504
• build(deps): bump hyper-util from 0.1.16 to 0.1.17 by @dependabot[bot] in #14506
• build(deps): bump windows-core from 0.61.2 to 0.62.0 by @dependabot[bot] in #14507
• build(deps): bump the serde group with 3 updates by @dependabot[bot] in #14505
• build(deps): bump json-patch from 4.0.0 to 4.1.0 by @dependabot[bot] in #14508
• proxy: v2.319.0 by @l5d-bot in #14509
• build(deps): bump tj-actions/changed-files from e874f3cddd0f54ae776e6995ae6dae4cf40fd3d3 to 2371aa7cd265d2e8a0213dc9e2a70dfcfb8fa114 by @dependabot[bot] in #14503
• chore(ci): replace bitnami/kubectl with chainguard/kubectl by @olix0r in #14512

Full Changelog: edge-25.9.2...edge-25.9.3

What's Changed

• build(deps): bump zerocopy from 0.8.26 to 0.8.27 by @dependabot[bot] in #14460
• build(deps): bump cc from 1.2.35 to 1.2.36 by @dependabot[bot] in #14461
• build(deps): bump find-msvc-tools from 0.1.0 to 0.1.1 by @dependabot[bot] in #14462
• build(deps): bump tokio-metrics from 0.4.4 to 0.4.5 by @dependabot[bot] in #14464
• build(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by @dependabot[bot] in #14465
• build(deps): bump github.com/prometheus/client_golang from 1.23.0 to 1.23.2 by @dependabot[bot] in #14459
• build(deps): bump security-framework-sys from 2.14.0 to 2.15.0 by @dependabot[bot] in #14463
• build(deps): bump @fortawesome/free-solid-svg-icons from 6.7.2 to 7.0.1 in /web/app by @dependabot[bot] in #14456
• build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #14453
• build(deps-dev): bump jest from 30.0.4 to 30.1.3 in /web/app by @dependabot[bot] in #14454
• build(deps-dev): bump @babel/runtime from 7.28.3 to 7.28.4 in /web/app by @dependabot[bot] in #14455
• build(deps): bump tj-actions/changed-files from 3b04099b21072562f07469c10deb182b24236ca9 to 8c14441336bb3d84fd6b7fa83b6d7201c740baf5 by @dependabot[bot] in #14466
• fix(jaeger): Fix _pod_ip attribute by @sfleen in #14467
• build(deps-dev): bump @babel/core from 7.28.3 to 7.28.4 in /web/app by @dependabot[bot] in #14457
• proxy: v2.318.0 by @l5d-bot in #14477
• build(deps): bump schannel from 0.1.27 to 0.1.28 by @dependabot[bot] in #14476
• build(deps): bump aws-lc-rs from 1.13.3 to 1.14.0 by @dependabot[bot] in #14475
• build(deps): bump errno from 0.3.13 to 0.3.14 by @dependabot[bot] in #14474
• build(deps): bump golang.org/x/net from 0.43.0 to 0.44.0 by @dependabot[bot] in #14472
• build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by @dependabot[bot] in #14473
• build(deps): bump indexmap from 2.11.0 to 2.11.1 by @dependabot[bot] in #14469
• build(deps): bump chrono from 0.4.41 to 0.4.42 by @dependabot[bot] in #14470
• fix(destination): Replace With with GetMetricWith by @adleong in #14428
• build(deps): bump rustls-webpki from 0.103.4 to 0.103.5 by @dependabot[bot] in #14485
• build(deps): bump helm.sh/helm/v3 from 3.18.6 to 3.19.0 by @dependabot[bot] in #14484
• build(deps): bump tj-actions/changed-files from 8c14441336bb3d84fd6b7fa83b6d7201c740baf5 to e874f3cddd0f54ae776e6995ae6dae4cf40fd3d3 by @dependabot[bot] in #14482
• build(deps): bump unicode-ident from 1.0.18 to 1.0.19 by @dependabot[bot] in #14481
• build(deps): bump golang.org/x/tools from 0.36.0 to 0.37.0 by @dependabot[bot] in #14480
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #14478
• build(deps): bump google.golang.org/grpc from 1.75.0 to 1.75.1 by @dependabot[bot] in #14479

Full Changelog: edge-25.9.1...edge-25.9.2

What's Changed

• build(deps): bump tracing-subscriber from 0.3.19 to 0.3.20 by @dependabot[bot] in #14427
• build(deps): bump indexmap from 2.10.0 to 2.11.0 by @dependabot[bot] in #14419
• build(deps): bump form_urlencoded from 1.2.1 to 1.2.2 by @dependabot[bot] in #14420
• build(deps): bump io-uring from 0.7.9 to 0.7.10 by @dependabot[bot] in #14422
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14421
• build(deps): bump thiserror from 2.0.12 to 2.0.16 by @dependabot[bot] in #14423
• build(deps): bump the kube group with 8 updates by @dependabot[bot] in #14424
• build(deps): bump google-github-actions/auth from 2.1.12 to 3.0.0 by @dependabot[bot] in #14425
• build(deps): bump google-github-actions/setup-gcloud from 3.0.0 to 3.0.1 in /.github/actions/helm-publish by @dependabot[bot] in #14426
• build(deps-dev): bump @babel/runtime from 7.27.6 to 7.28.3 in /web/app by @dependabot[bot] in #14429
• build(deps): bump core-js from 3.44.0 to 3.45.1 in /web/app by @dependabot[bot] in #14430
• build(deps): bump @fortawesome/react-fontawesome from 0.2.2 to 0.2.6 in /web/app by @dependabot[bot] in #14431
• build(deps-dev): bump jest-environment-jsdom from 30.0.4 to 30.1.1 in /web/app by @dependabot[bot] in #14432
• build(deps): bump proc-macro2 from 1.0.96 to 1.0.101 by @dependabot[bot] in #14435
• build(deps): bump cc from 1.2.34 to 1.2.35 by @dependabot[bot] in #14437
• build(deps): bump prettyplease from 0.2.36 to 0.2.37 by @dependabot[bot] in #14438
• build(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @dependabot[bot] in #14436
• proxy: v2.317.0 by @l5d-bot in #14439
• build(deps): bump bitflags from 2.9.3 to 2.9.4 by @dependabot[bot] in #14440
• build(deps): bump the clap group with 3 updates by @dependabot[bot] in #14441
• build(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10 by @dependabot[bot] in #14442
• build(deps): bump regex-syntax from 0.8.5 to 0.8.6 by @dependabot[bot] in #14443
• Add Sophotech to adopters list by @archy-rock3t-cloud in #14448
• build(deps): bump regex-automata from 0.4.8 to 0.4.10 by @dependabot[bot] in #14444
• build(deps): bump log from 0.4.27 to 0.4.28 by @dependabot[bot] in #14449
• build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in #14450
• build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by @dependabot[bot] in #14446

New Contributors

• @archy-rock3t-cloud made their first contribution in #14448

Full Changelog: edge-25.8.5...edge-25.9.1

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release adds timeout and gateway error metrics to linkerd multicluster check, to better validate multicluster functionality.

What's Changed

• fix(ci): remove windows_static_cli_tests by @cratelyn in #14406
• build(deps): bump ppv-lite86 from 0.2.20 to 0.2.21 by @dependabot[bot] in #14376
• build(deps): bump cfg-if from 1.0.1 to 1.0.3 by @dependabot[bot] in #14408
• build(deps): bump bitflags from 2.9.1 to 2.9.3 by @dependabot[bot] in #14409
• build(deps): bump async-trait from 0.1.88 to 0.1.89 by @dependabot[bot] in #14377
• build(deps-dev): bump @babel/core from 7.28.0 to 7.28.3 in /web/app by @dependabot[bot] in #14381
• build(deps-dev): bump html-webpack-plugin from 5.6.3 to 5.6.4 in /web/app by @dependabot[bot] in #14384
• build(deps): bump helm.sh/helm/v3 from 3.18.5 to 3.18.6 by @dependabot[bot] in #14394
• build(deps): bump azure/setup-helm from 4.3.0 to 4.3.1 by @dependabot[bot] in #14396
• build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @dependabot[bot] in #14400
• build(deps-dev): bump @babel/preset-env from 7.28.0 to 7.28.3 in /web/app by @dependabot[bot] in #14383
• build(deps): bump google.golang.org/grpc from 1.74.2 to 1.75.0 by @dependabot[bot] in #14395
• build(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.8 by @dependabot[bot] in #14399
• build(deps): bump ahash from 0.8.11 to 0.8.12 by @dependabot[bot] in #14378
• fix(multicluster): Do not ignore timeout and gateway metrics errors during multicluster check by @zaharidichev in #14418
• proxy: v2.316.0 by @l5d-bot in #14417
• build(deps): bump cc from 1.2.33 to 1.2.34 by @dependabot[bot] in #14414
• build(deps): bump regex-lite from 0.1.6 to 0.1.7 by @dependabot[bot] in #14415
• build(deps): bump percent-encoding from 2.3.1 to 2.3.2 by @dependabot[bot] in #14416
• build(deps): bump regex from 1.11.1 to 1.11.2 by @dependabot[bot] in #14413
• build(deps): bump tj-actions/changed-files from 2036da178f85576f1940fedb74bb93a36cd89ab7 to 3b04099b21072562f07469c10deb182b24236ca9 by @dependabot[bot] in #14411
• build(deps): bump google-github-actions/setup-gcloud from 2.2.0 to 3.0.0 in /.github/actions/helm-publish by @dependabot[bot] in #14410
• build(deps-dev): bump webpack from 5.100.2 to 5.101.3 in /web/app by @dependabot[bot] in #14407

Full Changelog: edge-25.8.4...edge-25.8.5

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release supports setting proxy.securityContext and networkValidator.securityContext to provide a custom security context for the linkerd-proxy container, and the network-validator container, respectively. It also switches the proxy to prefer post-quantum key exchange algorithm X25519MLKEM768.

What's Changed

• chore(ci)!: update CLI build pipeline by @olix0r in #14360
• build(deps): bump hashbrown from 0.15.2 to 0.15.5 by @dependabot[bot] in #14379
• proxy: v2.314.0 by @l5d-bot in #14388
• build(deps): bump hyper from 1.6.0 to 1.7.0 by @dependabot[bot] in #14390
• build(deps): bump cc from 1.2.32 to 1.2.33 by @dependabot[bot] in #14391
• chore(deps): bump extension-init from 0.1.6 to 0.1.7 by @cratelyn in #14392
• build(deps): bump sigs.k8s.io/kustomize/kyaml from 0.19.0 to 0.20.1 by @dependabot[bot] in #14375
• build(deps): bump syn from 2.0.105 to 2.0.106 by @dependabot[bot] in #14393
• feature(values): provide way to set custom securityContext for the pr… by @zaharidichev in #14347
• proxy: v2.315.0 by @l5d-bot in #14401
• fix(cli): install openssl in dockerfile by @cratelyn in #14403
• build(deps): bump serde_json from 1.0.142 to 1.0.143 by @dependabot[bot] in #14398
• fix(ci): cli tests need cli by @cratelyn in #14404
• fix(ci): double cli-build workflow timeout by @cratelyn in #14405

Full Changelog: edge-25.8.3...edge-25.8.4

Overall status: RECOMMENDED

Cautions

This release eliminates the separate policy-controller image, instead including the policy controller in the main controller image. This means that the policyController.image Helm value is now ignored.

Changes

This release eliminates the separate policy-controller image to reduce image-pull traffic somewhat. It also adds a new rustls_info metric to make visible which cryptographic provider and algorithms are in use.

What's Changed

• build(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 by @dependabot[bot] in #14335
• build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.7 by @dependabot[bot] in #14337
• build(deps): bump cc from 1.2.31 to 1.2.32 by @dependabot[bot] in #14343
• build(deps): bump rustversion from 1.0.21 to 1.0.22 by @dependabot[bot] in #14340
• build(deps): bump proc-macro2 from 1.0.95 to 1.0.96 by @dependabot[bot] in #14342
• build(deps): bump slab from 0.4.10 to 0.4.11 by @dependabot[bot] in #14341
• build(deps): bump google-github-actions/setup-gcloud from 2.1.5 to 2.2.0 in /.github/actions/helm-publish by @dependabot[bot] in #14344
• build(deps): bump golang.org/x/tools from 0.35.0 to 0.36.0 by @dependabot[bot] in #14336
• chore(inject): remove PatchProducer abstraction by @zaharidichev in #14346
• chore(identity): add !windows tag in run_proxy_unix.go by @zaharidichev in #14345
• chore(ci): disable fail-fast on test matrixes by @olix0r in #14349
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #14353
• build(deps): bump libc from 0.2.174 to 0.2.175 by @dependabot[bot] in #14355
• build(deps): bump glob from 0.3.2 to 0.3.3 by @dependabot[bot] in #14352
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14356
• build(deps): bump anyhow from 1.0.98 to 1.0.99 by @dependabot[bot] in #14357
• chore(ci): reduce integration test timeouts by @olix0r in #14358
• proxy: v2.313.0 by @l5d-bot in #14362
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14361
• build(deps): bump tj-actions/changed-files from 8cdfb7636d150253dee416a80f11c67f5ba7e9be to 239aef84a5502c79a1cea96e495d17588c66c659 by @dependabot[bot] in #14363
• chore(bin): remove install-pr script by @olix0r in #14364
• chore(ci): use docker/login-action by @olix0r in #14359
• chore(deps): Update tonic deps to 0.13 by @sfleen in #14365
• build(controller)!: eliminate policy-controller image by @olix0r in #14348
• build(deps): bump syn from 2.0.104 to 2.0.105 by @dependabot[bot] in #14366
• build(deps): bump indexmap from 2.2.6 to 2.10.0 by @dependabot[bot] in #14367
• build(deps): bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #14373
• build(deps): bump rand_core from 0.9.0 to 0.9.3 by @dependabot[bot] in #14368
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #14369
• build(deps): bump tj-actions/changed-files from 239aef84a5502c79a1cea96e495d17588c66c659 to 2036da178f85576f1940fedb74bb93a36cd89ab7 by @dependabot[bot] in #14372
• build(deps): bump github.com/linkerd/linkerd2-proxy-api from 0.16.0 to 0.17.0 by @dependabot[bot] in #14371
• build(deps): bump helm.sh/helm/v3 from 3.18.4 to 3.18.5 by @dependabot[bot] in #14370
• fix(ci): use correct GHCR creds by @zaharidichev in #14374

Full Changelog: edge-25.8.2...edge-25.8.3

Overall status: RECOMMENDED

Cautions

This release switches the default command for programming the routing table from iptables-legacy to iptables-nft.

Changes

This release switches the default command for programming the routing table from iptables-legacy to iptables-nft. (If you need to continue to use iptables-legacy, set proxyInit.iptablesMode: legacy in the linkerd2-control-plane chart if you're using the init container, or iptablesMode: legacy in the linkerd2-cni chart if you're using the CNI plugin.)

What's Changed

• build(deps): bump tokio from 1.47.0 to 1.47.1 by @dependabot[bot] in #14316
• build(deps): bump event-listener from 5.4.0 to 5.4.1 by @dependabot[bot] in #14318
• build(deps): bump tokio-util from 0.7.15 to 0.7.16 by @dependabot[bot] in #14319
• build(deps): bump cc from 1.2.30 to 1.2.31 by @dependabot[bot] in #14317
• build(deps): bump signal-hook-registry from 1.4.5 to 1.4.6 by @dependabot[bot] in #14320
• build(deps): bump tj-actions/changed-files from 94d97fe3f88298bf8b2f2db6fa2ab150f3c1ab77 to c2ca2493190021783138cb8aac49bcee14b4bb89 by @dependabot[bot] in #14321
• build(deps): bump google-github-actions/auth from 2.1.11 to 2.1.12 by @dependabot[bot] in #14322
• chore(policy-controller): Use the aws-lc-rs TLS backend by @sfleen in #14300
• build(deps): bump tj-actions/changed-files from c2ca2493190021783138cb8aac49bcee14b4bb89 to 8cdfb7636d150253dee416a80f11c67f5ba7e9be by @dependabot[bot] in #14323
• chore(policy): Remove OpenSSL from the policy controller by @sfleen in #14292
• chore(extension-init): Bump extension-init to v0.1.5 by @sfleen in #14324
• fix: Allow aws-lc-fips-sys licenses in deny.toml by @sfleen in #14328
• proxy: v2.312.0 by @l5d-bot in #14327
• chore(extension-init): Bump extension-init to v0.1.6 by @sfleen in #14329
• chore(helm)!: change iptables default mode to nft by @alpeb in #14326
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #14325
• build(deps): bump tokio-metrics from 0.4.3 to 0.4.4 by @dependabot[bot] in #14332
• build(deps): bump h2 from 0.4.11 to 0.4.12 by @dependabot[bot] in #14331
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14330
• fix(policy): Fix env vars for building for arm64 by @sfleen in #14334

Full Changelog: edge-25.8.1...edge-25.8.2