edge-25.10.2

Overall status: NOT RECOMMENDED, use edge-25.10.7 instead

Cautions

This release drops support for the (long-deprecated) OpenCensus trace protocol. Additionally, it adds the linkerd.io/proxy-root-parent and linkerd.io/proxy-root-parent-kind labels to injected pods, but this change was reverted in edge-25.10.3 due to unforeseen issues.

Changes

This release adds support for setting OpenTelemetry tracing values via resource.opentelemetry.io/<label> annotations on pods, making it simpler to customize tracing for specific workloads. Additionally, it moves native sidecar support to beta, adding the config.beta.linkerd.io/proxy-enable-native-sidecar annotation and deprecating the alpha annotation (although that will continue to function).

What's Changed

• build(deps): bump axum from 0.8.4 to 0.8.6 by @dependabot[bot] in #14563
• build(deps): bump aws-lc-sys from 0.32.0 to 0.32.2 by @dependabot[bot] in #14568
• build(deps): bump dev to v48 by @olix0r in #14560
• chore(proxy): Add annotations to downward API by @sfleen in #14580
• chore(injector): promote native sidecars to beta by @alpeb in #14587
• Revert "chore(version)!: remove 'hotpatch' versioning (#14510)" by @olix0r in #14586
• build(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #14591
• build(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 by @dependabot[bot] in #14588
• build(deps): bump tj-actions/changed-files from 212f9a7760ad2b8eb511185b841f3725a62c2ae0 to d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449 by @dependabot[bot] in #14583
• proxy: v2.323.0 by @l5d-bot in #14590
• build(deps): bump softprops/action-gh-release from 2.3.3 to 2.4.0 by @dependabot[bot] in #14584
• chore(ci): update k8s and gateway-api versions by @olix0r in #14585
• build(deps): bump cc from 1.2.38 to 1.2.40 by @dependabot[bot] in #14575
• build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.1 by @dependabot[bot] in #14589
• build(deps): bump windows-implement from 0.60.0 to 0.60.2 by @dependabot[bot] in #14582
• build(deps): bump windows-core from 0.62.0 to 0.62.1 by @dependabot[bot] in #14550
• build(deps): bump the serde group with 3 updates by @dependabot[bot] in #14548
• build(deps): bump peter-evans/repository-dispatch from 3.0.0 to 4.0.0 by @dependabot[bot] in #14565
• build(deps): bump the pest group with 4 updates by @dependabot[bot] in #14574
• feat: Add labels for root parent object by @sfleen in #14578
• build(deps): bump google.golang.org/grpc from 1.75.1 to 1.76.0 by @dependabot[bot] in #14581
• build(deps): update github.com/imdario/mergo to dario.cat/mergo by @Juneezee in #14544
• chore(inject): Replace root owner mechanism by @sfleen in #14593
• build(deps): bump parking_lot from 0.12.4 to 0.12.5 by @dependabot[bot] in #14600
• build(deps): bump golang.org/x/tools from 0.37.0 to 0.38.0 by @dependabot[bot] in #14595
• build(deps): bump windows-interface from 0.59.2 to 0.59.3 by @dependabot[bot] in #14597
• build(deps): bump rustls-webpki from 0.103.6 to 0.103.7 by @dependabot[bot] in #14596
• build(deps): bump zeroize from 1.8.1 to 1.8.2 by @dependabot[bot] in #14598
• feat(inject): Populate proxy tracing values from annotations by @sfleen in #14592

Full Changelog: edge-25.10.1...edge-25.10.2

edge-25.10.1

Overall status: RECOMMENDED

Cautions

This release drops support for the Linkerd Jaeger extension: instead, it supports directly configuring OpenTelemetry tracing by setting controller.tracing.enable and controller.tracing.collector.endpoint when installing Linkerd.

Changes

This release guarantees that OpenTelemetry spans are flushed regularly, and not just when streams become idle. It also adds the inbound_http_request_frame_size_bytes and inbound_grpc_request_frame_size_bytes histograms to metrics, to allow better visibility into request body sizes.

What's Changed

• build(deps): bump github.com/mattn/go-runewidth from 0.0.16 to 0.0.17 by @dependabot[bot] in #14532
• build(deps): bump windows-interface from 0.59.1 to 0.59.2 by @dependabot[bot] in #14534
• build(deps): bump regex from 1.11.2 to 1.11.3 by @dependabot[bot] in #14535
• build(deps): bump backtrace from 0.3.75 to 0.3.76 by @dependabot[bot] in #14536
• build(deps): bump memchr from 2.7.5 to 2.7.6 by @dependabot[bot] in #14537
• build(deps-dev): bump jest-environment-jsdom from 30.1.1 to 30.2.0 in /web/app by @dependabot[bot] in #14540
• build(deps): bump query-string from 9.2.2 to 9.3.1 in /web/app by @dependabot[bot] in #14541
• build(deps): bump the serde group with 3 updates by @dependabot[bot] in #14533
• build(deps): bump github.com/go-openapi/spec from 0.21.0 to 0.22.0 by @dependabot[bot] in #14545
• build(deps): bump tj-actions/changed-files from 4563c729c555b4141fac99c80f699f571219b836 to 28cf3adc4b6dbff2746d5216da021a10e53b4f58 by @dependabot[bot] in #14546
• proxy: v2.321.0 by @l5d-bot in #14556
• chore(tests): Separate tracing tests from viz by @sfleen in #14547
• build(deps): bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #14554
• chore(charts): Add separate namespace field for trace collector service account by @sfleen in #14539
• feat(tracing)!: Improve control plane tracing configuration by @sfleen in #14557
• feat(jaeger)!: Remove linkerd-jaeger extension by @sfleen in #14558
• build(deps): bump github.com/mattn/go-runewidth from 0.0.17 to 0.0.19 by @dependabot[bot] in #14549
• build(deps): bump quote from 1.0.40 to 1.0.41 by @dependabot[bot] in #14551
• build(deps): bump thiserror from 2.0.16 to 2.0.17 by @dependabot[bot] in #14552
• build(deps): bump anstyle from 1.0.11 to 1.0.13 by @dependabot[bot] in #14553
• build(deps): bump tj-actions/changed-files from 28cf3adc4b6dbff2746d5216da021a10e53b4f58 to 212f9a7760ad2b8eb511185b841f3725a62c2ae0 by @dependabot[bot] in #14555
• proxy: v2.322.0 by @l5d-bot in #14559

Full Changelog: edge-25.9.4...edge-25.10.1

edge-25.9.4

Overall status: RECOMMENDED

Cautions

Starting in this release, the linkerd-crds Helm chart will no longer install the Gateway API CRDs by default. To force the chart to install the Gateway API CRDs, set installGatewayAPI=true when installing the chart.

If you previously used the linkerd-crds chart to install the Gateway API CRDs, and you're running Linkerd 2.18/edge-25.4.4 or higher, upgrading with Helm will not uninstall the Gateway API CRDs. If you're upgrading from an earlier version, you will need to install the Gateway API CRDs manually.

Changes

This release fixes an issue where native sidecar proxies could have stale endpoint data, resulting in problems routing traffic. Additionally, it correctly supports ReplacePrefixMatch in HTTPRoute RequestRedirect filters.

What's Changed

• build(deps): bump tokio-rustls from 0.26.2 to 0.26.3 by @dependabot[bot] in #14514
• chore(release): stop producing .sha256 files by @olix0r in #14511
• chore(version)!: remove 'hotpatch' versioning by @olix0r in #14510
• fix(destination): discovery staleness when targetting the linkerd-admin port in native-sidecar mode by @alpeb in #14468
• build(deps): bump indexmap from 2.11.3 to 2.11.4 by @dependabot[bot] in #14515
• build(deps): bump Swatinem/rust-cache from 2.8.0 to 2.8.1 by @dependabot[bot] in #14516
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14517
• build(deps): bump the serde group with 3 updates by @dependabot[bot] in #14518
• build(deps): bump rustix from 0.38.38 to 0.38.44 by @dependabot[bot] in #14519
• build(deps): bump cc from 1.2.37 to 1.2.38 by @dependabot[bot] in #14521
• build(deps): bump tj-actions/changed-files from 2371aa7cd265d2e8a0213dc9e2a70dfcfb8fa114 to 4563c729c555b4141fac99c80f699f571219b836 by @dependabot[bot] in #14522
• build(deps): bump @fortawesome/free-regular-svg-icons from 6.7.2 to 7.0.1 in /web/app by @dependabot[bot] in #14486
• build(deps-dev): bump @babel/eslint-parser from 7.28.0 to 7.28.4 in /web/app by @dependabot[bot] in #14487
• build(deps-dev): bump babel-jest from 30.0.4 to 30.1.2 in /web/app by @dependabot[bot] in #14490
• build(deps): bump anyhow from 1.0.99 to 1.0.100 by @dependabot[bot] in #14520
• feat(gatewayAPI): Stop installing the gateway API by default by @adleong in #14523
• proxy: v2.320.0 by @l5d-bot in #14529
• build(deps): bump libloading from 0.8.8 to 0.8.9 by @dependabot[bot] in #14524
• build(deps): bump itertools from 0.12.1 to 0.13.0 by @dependabot[bot] in #14525
• build(deps): bump rustls from 0.23.31 to 0.23.32 by @dependabot[bot] in #14526
• build(deps): bump libc from 0.2.175 to 0.2.176 by @dependabot[bot] in #14528
• build(deps): bump aws-lc-rs from 1.14.0 to 1.14.1 by @dependabot[bot] in #14530
• Revert "build(deps): bump libloading from 0.8.8 to 0.8.9 (#14524)" by @cratelyn in #14531

Full Changelog: edge-25.9.3...edge-25.9.4

edge-25.9.3

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release adds several new metrics: inbound_requests gives a count of the total number of inbound requests received by a proxy, inbound_http_response_frame_size_bytes gives a histogram of inbound HTTP frame sizes, and inbound_grpc_response_frame_size_bytes gives a histogram of inbound gRPC frame sizes.

What's Changed

• build(deps): bump cc from 1.2.36 to 1.2.37 by @dependabot[bot] in #14491
• build(deps): bump serde_json from 1.0.143 to 1.0.145 by @dependabot[bot] in #14492
• build(deps): bump iana-time-zone from 0.1.63 to 0.1.64 by @dependabot[bot] in #14493
• build(deps): bump pest from 2.8.1 to 2.8.2 by @dependabot[bot] in #14494
• build(deps): bump serde from 1.0.219 to 1.0.223 by @dependabot[bot] in #14495
• build(deps): bump rustls-webpki from 0.103.5 to 0.103.6 by @dependabot[bot] in #14498
• build(deps): bump pest_derive from 2.8.1 to 2.8.2 by @dependabot[bot] in #14499
• build(deps): bump pest_meta from 2.8.1 to 2.8.2 by @dependabot[bot] in #14500
• build(deps): bump pest_generator from 2.8.1 to 2.8.2 by @dependabot[bot] in #14501
• build(deps): bump indexmap from 2.11.1 to 2.11.3 by @dependabot[bot] in #14502
• chore(deps): introduce a serde dependabot group by @cratelyn in #14497
• chore(deps): introduce a pest dependabot group by @cratelyn in #14504
• build(deps): bump hyper-util from 0.1.16 to 0.1.17 by @dependabot[bot] in #14506
• build(deps): bump windows-core from 0.61.2 to 0.62.0 by @dependabot[bot] in #14507
• build(deps): bump the serde group with 3 updates by @dependabot[bot] in #14505
• build(deps): bump json-patch from 4.0.0 to 4.1.0 by @dependabot[bot] in #14508
• proxy: v2.319.0 by @l5d-bot in #14509
• build(deps): bump tj-actions/changed-files from e874f3cddd0f54ae776e6995ae6dae4cf40fd3d3 to 2371aa7cd265d2e8a0213dc9e2a70dfcfb8fa114 by @dependabot[bot] in #14503
• chore(ci): replace bitnami/kubectl with chainguard/kubectl by @olix0r in #14512

Full Changelog: edge-25.9.2...edge-25.9.3

edge-25.9.2

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release correctly supports the k8s.pod.ip attribute in OpenTelemetry traces, rather than always reporting the literal value _pod_ip.

What's Changed

• build(deps): bump zerocopy from 0.8.26 to 0.8.27 by @dependabot[bot] in #14460
• build(deps): bump cc from 1.2.35 to 1.2.36 by @dependabot[bot] in #14461
• build(deps): bump find-msvc-tools from 0.1.0 to 0.1.1 by @dependabot[bot] in #14462
• build(deps): bump tokio-metrics from 0.4.4 to 0.4.5 by @dependabot[bot] in #14464
• build(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by @dependabot[bot] in #14465
• build(deps): bump github.com/prometheus/client_golang from 1.23.0 to 1.23.2 by @dependabot[bot] in #14459
• build(deps): bump security-framework-sys from 2.14.0 to 2.15.0 by @dependabot[bot] in #14463
• build(deps): bump @fortawesome/free-solid-svg-icons from 6.7.2 to 7.0.1 in /web/app by @dependabot[bot] in #14456
• build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #14453
• build(deps-dev): bump jest from 30.0.4 to 30.1.3 in /web/app by @dependabot[bot] in #14454
• build(deps-dev): bump @babel/runtime from 7.28.3 to 7.28.4 in /web/app by @dependabot[bot] in #14455
• build(deps): bump tj-actions/changed-files from 3b04099b21072562f07469c10deb182b24236ca9 to 8c14441336bb3d84fd6b7fa83b6d7201c740baf5 by @dependabot[bot] in #14466
• fix(jaeger): Fix _pod_ip attribute by @sfleen in #14467
• build(deps-dev): bump @babel/core from 7.28.3 to 7.28.4 in /web/app by @dependabot[bot] in #14457
• proxy: v2.318.0 by @l5d-bot in #14477
• build(deps): bump schannel from 0.1.27 to 0.1.28 by @dependabot[bot] in #14476
• build(deps): bump aws-lc-rs from 1.13.3 to 1.14.0 by @dependabot[bot] in #14475
• build(deps): bump errno from 0.3.13 to 0.3.14 by @dependabot[bot] in #14474
• build(deps): bump golang.org/x/net from 0.43.0 to 0.44.0 by @dependabot[bot] in #14472
• build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by @dependabot[bot] in #14473
• build(deps): bump indexmap from 2.11.0 to 2.11.1 by @dependabot[bot] in #14469
• build(deps): bump chrono from 0.4.41 to 0.4.42 by @dependabot[bot] in #14470
• fix(destination): Replace With with GetMetricWith by @adleong in #14428
• build(deps): bump rustls-webpki from 0.103.4 to 0.103.5 by @dependabot[bot] in #14485
• build(deps): bump helm.sh/helm/v3 from 3.18.6 to 3.19.0 by @dependabot[bot] in #14484
• build(deps): bump tj-actions/changed-files from 8c14441336bb3d84fd6b7fa83b6d7201c740baf5 to e874f3cddd0f54ae776e6995ae6dae4cf40fd3d3 by @dependabot[bot] in #14482
• build(deps): bump unicode-ident from 1.0.18 to 1.0.19 by @dependabot[bot] in #14481
• build(deps): bump golang.org/x/tools from 0.36.0 to 0.37.0 by @dependabot[bot] in #14480
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #14478
• build(deps): bump google.golang.org/grpc from 1.75.0 to 1.75.1 by @dependabot[bot] in #14479

Full Changelog: edge-25.9.1...edge-25.9.2

edge-25.9.1

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release bumps dependencies but has no functional changes from edge-25.8.5.

What's Changed

• build(deps): bump tracing-subscriber from 0.3.19 to 0.3.20 by @dependabot[bot] in #14427
• build(deps): bump indexmap from 2.10.0 to 2.11.0 by @dependabot[bot] in #14419
• build(deps): bump form_urlencoded from 1.2.1 to 1.2.2 by @dependabot[bot] in #14420
• build(deps): bump io-uring from 0.7.9 to 0.7.10 by @dependabot[bot] in #14422
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14421
• build(deps): bump thiserror from 2.0.12 to 2.0.16 by @dependabot[bot] in #14423
• build(deps): bump the kube group with 8 updates by @dependabot[bot] in #14424
• build(deps): bump google-github-actions/auth from 2.1.12 to 3.0.0 by @dependabot[bot] in #14425
• build(deps): bump google-github-actions/setup-gcloud from 3.0.0 to 3.0.1 in /.github/actions/helm-publish by @dependabot[bot] in #14426
• build(deps-dev): bump @babel/runtime from 7.27.6 to 7.28.3 in /web/app by @dependabot[bot] in #14429
• build(deps): bump core-js from 3.44.0 to 3.45.1 in /web/app by @dependabot[bot] in #14430
• build(deps): bump @fortawesome/react-fontawesome from 0.2.2 to 0.2.6 in /web/app by @dependabot[bot] in #14431
• build(deps-dev): bump jest-environment-jsdom from 30.0.4 to 30.1.1 in /web/app by @dependabot[bot] in #14432
• build(deps): bump proc-macro2 from 1.0.96 to 1.0.101 by @dependabot[bot] in #14435
• build(deps): bump cc from 1.2.34 to 1.2.35 by @dependabot[bot] in #14437
• build(deps): bump prettyplease from 0.2.36 to 0.2.37 by @dependabot[bot] in #14438
• build(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @dependabot[bot] in #14436
• proxy: v2.317.0 by @l5d-bot in #14439
• build(deps): bump bitflags from 2.9.3 to 2.9.4 by @dependabot[bot] in #14440
• build(deps): bump the clap group with 3 updates by @dependabot[bot] in #14441
• build(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10 by @dependabot[bot] in #14442
• build(deps): bump regex-syntax from 0.8.5 to 0.8.6 by @dependabot[bot] in #14443
• Add Sophotech to adopters list by @archy-rock3t-cloud in #14448
• build(deps): bump regex-automata from 0.4.8 to 0.4.10 by @dependabot[bot] in #14444
• build(deps): bump log from 0.4.27 to 0.4.28 by @dependabot[bot] in #14449
• build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in #14450
• build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by @dependabot[bot] in #14446

New Contributors

• @archy-rock3t-cloud made their first contribution in #14448

Full Changelog: edge-25.8.5...edge-25.9.1

edge-25.8.5

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release adds timeout and gateway error metrics to linkerd multicluster check, to better validate multicluster functionality.

What's Changed

• fix(ci): remove windows_static_cli_tests by @cratelyn in #14406
• build(deps): bump ppv-lite86 from 0.2.20 to 0.2.21 by @dependabot[bot] in #14376
• build(deps): bump cfg-if from 1.0.1 to 1.0.3 by @dependabot[bot] in #14408
• build(deps): bump bitflags from 2.9.1 to 2.9.3 by @dependabot[bot] in #14409
• build(deps): bump async-trait from 0.1.88 to 0.1.89 by @dependabot[bot] in #14377
• build(deps-dev): bump @babel/core from 7.28.0 to 7.28.3 in /web/app by @dependabot[bot] in #14381
• build(deps-dev): bump html-webpack-plugin from 5.6.3 to 5.6.4 in /web/app by @dependabot[bot] in #14384
• build(deps): bump helm.sh/helm/v3 from 3.18.5 to 3.18.6 by @dependabot[bot] in #14394
• build(deps): bump azure/setup-helm from 4.3.0 to 4.3.1 by @dependabot[bot] in #14396
• build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @dependabot[bot] in #14400
• build(deps-dev): bump @babel/preset-env from 7.28.0 to 7.28.3 in /web/app by @dependabot[bot] in #14383
• build(deps): bump google.golang.org/grpc from 1.74.2 to 1.75.0 by @dependabot[bot] in #14395
• build(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.8 by @dependabot[bot] in #14399
• build(deps): bump ahash from 0.8.11 to 0.8.12 by @dependabot[bot] in #14378
• fix(multicluster): Do not ignore timeout and gateway metrics errors during multicluster check by @zaharidichev in #14418
• proxy: v2.316.0 by @l5d-bot in #14417
• build(deps): bump cc from 1.2.33 to 1.2.34 by @dependabot[bot] in #14414
• build(deps): bump regex-lite from 0.1.6 to 0.1.7 by @dependabot[bot] in #14415
• build(deps): bump percent-encoding from 2.3.1 to 2.3.2 by @dependabot[bot] in #14416
• build(deps): bump regex from 1.11.1 to 1.11.2 by @dependabot[bot] in #14413
• build(deps): bump tj-actions/changed-files from 2036da178f85576f1940fedb74bb93a36cd89ab7 to 3b04099b21072562f07469c10deb182b24236ca9 by @dependabot[bot] in #14411
• build(deps): bump google-github-actions/setup-gcloud from 2.2.0 to 3.0.0 in /.github/actions/helm-publish by @dependabot[bot] in #14410
• build(deps-dev): bump webpack from 5.100.2 to 5.101.3 in /web/app by @dependabot[bot] in #14407

Full Changelog: edge-25.8.4...edge-25.8.5

edge-25.8.4

Overall status: RECOMMENDED

Cautions

N/A

Changes

This release supports setting proxy.securityContext and networkValidator.securityContext to provide a custom security context for the linkerd-proxy container, and the network-validator container, respectively. It also switches the proxy to prefer post-quantum key exchange algorithm X25519MLKEM768.

What's Changed

• chore(ci)!: update CLI build pipeline by @olix0r in #14360
• build(deps): bump hashbrown from 0.15.2 to 0.15.5 by @dependabot[bot] in #14379
• proxy: v2.314.0 by @l5d-bot in #14388
• build(deps): bump hyper from 1.6.0 to 1.7.0 by @dependabot[bot] in #14390
• build(deps): bump cc from 1.2.32 to 1.2.33 by @dependabot[bot] in #14391
• chore(deps): bump extension-init from 0.1.6 to 0.1.7 by @cratelyn in #14392
• build(deps): bump sigs.k8s.io/kustomize/kyaml from 0.19.0 to 0.20.1 by @dependabot[bot] in #14375
• build(deps): bump syn from 2.0.105 to 2.0.106 by @dependabot[bot] in #14393
• feature(values): provide way to set custom securityContext for the pr… by @zaharidichev in #14347
• proxy: v2.315.0 by @l5d-bot in #14401
• fix(cli): install openssl in dockerfile by @cratelyn in #14403
• build(deps): bump serde_json from 1.0.142 to 1.0.143 by @dependabot[bot] in #14398
• fix(ci): cli tests need cli by @cratelyn in #14404
• fix(ci): double cli-build workflow timeout by @cratelyn in #14405

Full Changelog: edge-25.8.3...edge-25.8.4

edge-25.8.3

Overall status: RECOMMENDED

Cautions

This release eliminates the separate policy-controller image, instead including the policy controller in the main controller image. This means that the policyController.image Helm value is now ignored.

Changes

This release eliminates the separate policy-controller image to reduce image-pull traffic somewhat. It also adds a new rustls_info metric to make visible which cryptographic provider and algorithms are in use.

What's Changed

• build(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 by @dependabot[bot] in #14335
• build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.7 by @dependabot[bot] in #14337
• build(deps): bump cc from 1.2.31 to 1.2.32 by @dependabot[bot] in #14343
• build(deps): bump rustversion from 1.0.21 to 1.0.22 by @dependabot[bot] in #14340
• build(deps): bump proc-macro2 from 1.0.95 to 1.0.96 by @dependabot[bot] in #14342
• build(deps): bump slab from 0.4.10 to 0.4.11 by @dependabot[bot] in #14341
• build(deps): bump google-github-actions/setup-gcloud from 2.1.5 to 2.2.0 in /.github/actions/helm-publish by @dependabot[bot] in #14344
• build(deps): bump golang.org/x/tools from 0.35.0 to 0.36.0 by @dependabot[bot] in #14336
• chore(inject): remove PatchProducer abstraction by @zaharidichev in #14346
• chore(identity): add !windows tag in run_proxy_unix.go by @zaharidichev in #14345
• chore(ci): disable fail-fast on test matrixes by @olix0r in #14349
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #14353
• build(deps): bump libc from 0.2.174 to 0.2.175 by @dependabot[bot] in #14355
• build(deps): bump glob from 0.3.2 to 0.3.3 by @dependabot[bot] in #14352
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14356
• build(deps): bump anyhow from 1.0.98 to 1.0.99 by @dependabot[bot] in #14357
• chore(ci): reduce integration test timeouts by @olix0r in #14358
• proxy: v2.313.0 by @l5d-bot in #14362
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14361
• build(deps): bump tj-actions/changed-files from 8cdfb7636d150253dee416a80f11c67f5ba7e9be to 239aef84a5502c79a1cea96e495d17588c66c659 by @dependabot[bot] in #14363
• chore(bin): remove install-pr script by @olix0r in #14364
• chore(ci): use docker/login-action by @olix0r in #14359
• chore(deps): Update tonic deps to 0.13 by @sfleen in #14365
• build(controller)!: eliminate policy-controller image by @olix0r in #14348
• build(deps): bump syn from 2.0.104 to 2.0.105 by @dependabot[bot] in #14366
• build(deps): bump indexmap from 2.2.6 to 2.10.0 by @dependabot[bot] in #14367
• build(deps): bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #14373
• build(deps): bump rand_core from 0.9.0 to 0.9.3 by @dependabot[bot] in #14368
• build(deps): bump the kube group with 7 updates by @dependabot[bot] in #14369
• build(deps): bump tj-actions/changed-files from 239aef84a5502c79a1cea96e495d17588c66c659 to 2036da178f85576f1940fedb74bb93a36cd89ab7 by @dependabot[bot] in #14372
• build(deps): bump github.com/linkerd/linkerd2-proxy-api from 0.16.0 to 0.17.0 by @dependabot[bot] in #14371
• build(deps): bump helm.sh/helm/v3 from 3.18.4 to 3.18.5 by @dependabot[bot] in #14370
• fix(ci): use correct GHCR creds by @zaharidichev in #14374

Full Changelog: edge-25.8.2...edge-25.8.3

edge-25.8.2

Overall status: RECOMMENDED

Cautions

This release switches the default command for programming the routing table from iptables-legacy to iptables-nft.

Changes

This release switches the default command for programming the routing table from iptables-legacy to iptables-nft. (If you need to continue to use iptables-legacy, set proxyInit.iptablesMode: legacy in the linkerd2-control-plane chart if you're using the init container, or iptablesMode: legacy in the linkerd2-cni chart if you're using the CNI plugin.)

What's Changed

• build(deps): bump tokio from 1.47.0 to 1.47.1 by @dependabot[bot] in #14316
• build(deps): bump event-listener from 5.4.0 to 5.4.1 by @dependabot[bot] in #14318
• build(deps): bump tokio-util from 0.7.15 to 0.7.16 by @dependabot[bot] in #14319
• build(deps): bump cc from 1.2.30 to 1.2.31 by @dependabot[bot] in #14317
• build(deps): bump signal-hook-registry from 1.4.5 to 1.4.6 by @dependabot[bot] in #14320
• build(deps): bump tj-actions/changed-files from 94d97fe3f88298bf8b2f2db6fa2ab150f3c1ab77 to c2ca2493190021783138cb8aac49bcee14b4bb89 by @dependabot[bot] in #14321
• build(deps): bump google-github-actions/auth from 2.1.11 to 2.1.12 by @dependabot[bot] in #14322
• chore(policy-controller): Use the aws-lc-rs TLS backend by @sfleen in #14300
• build(deps): bump tj-actions/changed-files from c2ca2493190021783138cb8aac49bcee14b4bb89 to 8cdfb7636d150253dee416a80f11c67f5ba7e9be by @dependabot[bot] in #14323
• chore(policy): Remove OpenSSL from the policy controller by @sfleen in #14292
• chore(extension-init): Bump extension-init to v0.1.5 by @sfleen in #14324
• fix: Allow aws-lc-fips-sys licenses in deny.toml by @sfleen in #14328
• proxy: v2.312.0 by @l5d-bot in #14327
• chore(extension-init): Bump extension-init to v0.1.6 by @sfleen in #14329
• chore(helm)!: change iptables default mode to nft by @alpeb in #14326
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #14325
• build(deps): bump tokio-metrics from 0.4.3 to 0.4.4 by @dependabot[bot] in #14332
• build(deps): bump h2 from 0.4.11 to 0.4.12 by @dependabot[bot] in #14331
• build(deps): bump the clap group with 2 updates by @dependabot[bot] in #14330
• fix(policy): Fix env vars for building for arm64 by @sfleen in #14334

Full Changelog: edge-25.8.1...edge-25.8.2