envoyproxy/gateway v1.10.0-rc.1

on GitHub

What's Changed

• chore: replace sets.NewString with sets.New[string] by @mmmommm in #9704
• feat(chart): Add TLS certificate expiration to the Envoy Global dashboard by @FlorisFeddema in #9615
• docs: add note about Tempo appProtocol in proxy-trace.md by @rtomadpg in #5963
• docs: improve custom certificate installation guide by @dlanov in #9650
• feat(charts): add unhealthyPodEvictionPolicy field in envoy-gateway PodDisruptionBudget by @QuantumEnigmaa in #9449
• fix: generate manifests by @kkk777-7 in #9715
• docs: add kdvz to list of adopters by @VonNao in #9556
• chore: ignore nvd.nist.gov by @zirain in #9724
• fix(provider): make BackendTLSPolicy watch optional by @electricjesus in #9517
• feat: add healthCheckFailureDelay to shutdown config by @consideRatio in #9363
• chore: fix wasm stats test by @zirain in #9657
• build(deps): bump the helm group across 1 directory with 4 updates by @dependabot[bot] in #9728
• build(deps): bump npm-check-updates from 23.0.0 to 23.0.2 in /site by @dependabot[bot] in #9727
• build(deps): bump the gomod group across 2 directories with 16 updates by @dependabot[bot] in #9729
• test(configloader): fix flaky reload tests by @mmmommm in #9418
• gatewayapi: decide ClusterSettings merge eligibility per listener, not per rule by @muwaqar-cflt in #9695
• fix: reconcile ListenerSet when referenced TLS Secret changes by @zanarellidev in #9634
• gatewayapi: fix ListenerSet scope in MergeBackends cluster-settings index by @muwaqar-cflt in #9692
• fix: pin consistent-hash clients across weighted backendRefs by @guanchzhou in #9629
• docs: add GRPC Timeouts task (BackendTrafficPolicy) by @guanchzhou in #9631
• chore: add e2e for SDS Ref by @zirain in #8983
• fix: Add overlap status for duplicate HTTPRoutes by @jukie in #8373
• e2e: fix flaky ExtProc test by @zirain in #9739
• fix: allow single character labels in cookieDomain by @jacobw in #9736
• chore: bump golang to 1.26.6 by @kkk777-7 in #9749
• [release/v1.9] v1.9.0 release docs and announcement by @kkk777-7 in #9751
• add benchmark report of v1.9 by @kkk777-7 in #9758
• update docs links to 1.9.0 by @kkk777-7 in #9759
• update upgrade test by @kkk777-7 in #9760
• fix release note by @kkk777-7 in #9763
• [docs] Add OpenAI as an adopter by @arkodg in #9765
• chore: fix ALS log test by @zirain in #9748
• chore: increase loki max_structured_metadata_size by @zirain in #9746
• chore: dump and upload failure state to github for debugging by @zirain in #9761
• chore: update conformance test failure by @zirain in #9772
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.1-0.20260409050421-3f47accd6e14 to 1.39.0 in /examples/simple-extension-server by @dependabot[bot] in #9792
• feat: whitelist for allowed env and paths for lua by @rudrakhp in #9220
• api: add maxRequestHeaderLimit to ClientTrafficPolicy by @hsubramanianaks in #9623
• chore: use new images of registry.k8s.io/gateway-api/conformance by @zirain in #9799
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9782
• build(deps): bump the actions group across 1 directory with 6 updates by @dependabot[bot] in #9793
• build(deps): bump sigs.k8s.io/gateway-api-inference-extension from 1.5.0 to 1.6.0 in /examples/extension-server by @dependabot[bot] in #9789
• build(deps): bump cel.dev/expr from 0.25.2 to 0.25.3 by @dependabot[bot] in #9786
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.1-0.20260627225610-70ff85c381ff to 1.39.0 in /examples/sds-test-server by @dependabot[bot] in #9791
• chore: nominate new reviewers by @arkodg in #9804
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.1-0.20260304210048-a81710db7097 to 1.39.0 in /examples/grpc-ext-proc by @dependabot[bot] in #9790
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.1-0.20260304210048-a81710db7097 to 1.39.0 in /examples/envoy-ext-auth by @dependabot[bot] in #9787
• chore: add go.fix make target by @mmmommm in #9707
• Revert 9532 by @kkk777-7 in #9747
• build(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 in /test by @dependabot[bot] in #9815
• enable nophase, noreferences and statussubresource kube-api-linter rules by @sivchari in #9700
• fix: rate limiting cannot scale or enforce correctly by @zirain in #9814
• fix BTPTracing flaky by @sivchari in #9698
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.1-0.20260729145720-a2d8c7492908 to 1.39.0 in /examples/extension-server by @dependabot[bot] in #9788
• chore: fix main gen-check by @zirain in #9825
• fix: honor access log text format when format.type is unset by @guanchzhou in #9817
• fix: udp consistent hash by @kkk777-7 in #9826
• build(deps): bump the gomod group across 8 directories with 6 updates by @dependabot[bot] in #9785
• security: enable AES-256-GCM OAuth2 cookie encryption by default by @zhaohuabing in #9831
• fix: watch namespace changes for listener by @zirain in #9649
• build(deps): bump linkinator from 8.0.3 to 8.0.4 in /tools by @dependabot[bot] in #9841
• build(deps): bump the helm group across 1 directory with 3 updates by @dependabot[bot] in #9847
• fix: list extension manager resources once per reconcile by @stillya in #9764
• fix(metrics): widen watchable_subscribe_duration_seconds bucket spacing by @pujitha24 in #9812
• build(deps): bump the k8s-io group across 2 directories with 6 updates by @dependabot[bot] in #9848
• build(deps): bump the actions group across 1 directory with 7 updates by @dependabot[bot] in #9849
• fix: skip backendResource watch when CRD is missing instead of crashing controller by @sied95 in #9809
• build(deps): bump the gomod group across 8 directories with 4 updates by @dependabot[bot] in #9846
• chore: remove 1.7 from dependabot by @zirain in #9858
• refactor: move Lua security validation to Go by @rudrakhp in #9810
• feat: make control plane trace more readable by @zirain in #9672
• fix: keep orphaned OIDC PKCE cookies off every request by @zhaohuabing in #9644
• fix(listenerset): preserve routes on hostname conflict winner by @TheisFerre in #9768
• build(deps): bump npm-check-updates from 23.0.2 to 23.1.0 in /site by @dependabot[bot] in #9864
• build(deps): bump distroless/base-nossl from 86554c4 to 5cab74e in /tools/docker/envoy-gateway by @dependabot[bot] in #9840
• chore: bump golang to 1.27.0 by @zirain in #9827
• fix: envoy warn about cpuset-threads by @zirain in #9862
• release notes for v1.8.4 by @zirain in #9879
• fix: GHSA for Aug patch by @zirain in #9873
• Add v1.9.1 release notes by @kkk777-7 in #9871
• chore: fix OSV by @zirain in #9883
• docs: update releasing doc by @zirain in #9889
• fix: target branch in go bench by @kkk777-7 in #9884
• docs: Add 1.9.1 benchmark dashboard by @kkk777-7 in #9892
• docs: update for v1.8.4 by @zirain in #9890
• chore: mute more OSV by @zirain in #9891
• Bump eg upgrade test by @kkk777-7 in #9893
• chore: fix CircuitBreaker flaky by @zirain in #9900
• OIDC: support full OIDC cookie name overrides by @zhaohuabing in #9755
• fix(e2e): ipv6 envoy host match by @kkk777-7 in #9906
• fix(ratelimit): apply priorityClassName to the rate limit pod by @vijaypal89 in #9898
• fix: flaky HTTPRouteMixedProtocols e2e test by @sivchari in #9680
• fix: apply base once for resilience test by @zirain in #9801
• fix(e2e): MetricCompressor flaky by @zirain in #9908
• wasm: hash the permission cache key instead of concatenating inputs by @zhaohuabing in #9881
• fix(e2e): MultiReferenceGrantsSameNamespace flaky by @zirain in #9910
• fix(e2e): add test comment by @kkk777-7 in #9912
• chore: fix conformance test by @zirain in #9802
• fix: flaky HTTPRouteMixedProtocols e2e test by @zirain in #9917
• build(deps): bump the actions group across 1 directory with 7 updates by @dependabot[bot] in #9929
• test(e2e): give each access log test its own Gateway by @zhaohuabing in #9922
• test(e2e): give each MultipleGC test its own internet Gateway by @zhaohuabing in #9921
• docs: fix local rate limit unit in combined example by @amarkdotdev in #9904
• build(deps): bump the k8s-io group across 1 directory with 5 updates by @dependabot[bot] in #9928
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9924
• chore: bump golang to 1.27.1 by @zhaohuabing in #9939
• build(deps): bump linkinator from 8.0.4 to 8.1.0 in /tools by @dependabot[bot] in #9923
• build(deps): bump the gomod group across 8 directories with 17 updates by @dependabot[bot] in #9926
• fix(e2e): add readiness probe for BackendUtilization test by @zirain in #9933
• fix(e2e flakiness) : write status to an object that was deleted and recreated by @zhaohuabing in #9932
• performance: opt-in debounce for the provider reconcile by @zhaohuabing in #9803
• fix(e2e): improve PreserveCase test by @zirain in #9934
• fix(e2e): scrape MetricCompressor stats from the proxy pod by @zhaohuabing in #9942
• fix: preserve response_code_details when responseOverride is applied by @zhaohuabing in #9941
• chore: bump to use Gateway API 1.6.2 by @zirain in #9946
• fix(e2e): let the load balancing traffic checks actually retry by @zhaohuabing in #9943
• chore: fix OSV by @zirain in #9951
• ci: add tests for Kubernetes 1.37 by @beckcl in #9887
• bump: kind version by @kkk777-7 in #9955
• fix(luavalidator): block getfenv/setfenv/newproxy/module in the Lua security sandbox by @kanywst in #9743
• api: add HTTP/3 advertised port to ClientTrafficPolicy by @iamhaseebn in #9855
• feat: add codeVerifierTTL to the OIDC SecurityPolicy by @zhaohuabing in #9645
• [tools] make e2e-mac and conformance-mac by @arkodg in #9859
• session persistence: always set cookie Path to / by @zhaohuabing in #9950
• build(deps-dev): bump autoprefixer from 10.5.4 to 10.5.5 in /site by @dependabot[bot] in #9977
• build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 in the actions group across 1 directory by @dependabot[bot] in #9989
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0 in /examples/remote-infra by @dependabot[bot] in #9986
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0 in /examples/extension-server by @dependabot[bot] in #9983
• build(deps-dev): bump postcss-cli from 11.0.1 to 12.0.0 in /site by @dependabot[bot] in #9976
• api: split ClusterSettings into BackendSettings and ClusterSettings by @muwaqar-cflt in #8899
• docs: add Presence to ecosystem by @ocularminds in #9714
• docs: add upgrade note for the v1.9.0 to v1.9.1 SDS timeout revert by @zhaohuabing in #9996
• chore: fix gopls error by @kkk777-7 in #9995
• docs: clarify backend TLS client certificate namespace restrictions by @zhaohuabing in #10003
• fix(e2e): RateLimit flaky by @zirain in #9911
• docs: add United Security Providers as an adopter by @funkluk in #9970
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0 by @dependabot[bot] in #9982
• build(deps): bump sigs.k8s.io/gateway-api from 1.6.1 to 1.6.2 in /examples/extension-server by @dependabot[bot] in #9984
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9985
• fix(infra): set explicit host on envoy PreStop httpGet to fix hostNetwork drain by @pujitha24 in #9861
• docs: fix dead link for csrf by @zirain in #10009
• docs: clarify Envoy Proxy version support in the compatibility matrix by @zhaohuabing in #9915
• fix(provider): watch metadata changes for external GVKs by @zirain in #9968
• chore: improve the MergeEnvoyProxyConfigs test by @zirain in #9944
• feat(telemetry): add prefix support for opentelemetry metrics by @gray-oni in #9720
• fix: marshal xDS typed_config deterministically to avoid equivalent-resource churn by @nguyenptk in #10019
• fix: compare Port in IsParentRefEqual when SectionName is unset by @MengjiaLiang in #10005
• docs: add FAQ page by @zirain in #9969
• FIX: Regex so Envoy metrics will include downstream HTTPS traffic by @agelwarg in #9752
• build(deps): bump the gomod group across 1 directory with 7 updates by @dependabot[bot] in #9978
• docs: document ClientTrafficPolicy maxRequestHeaderLimit by @hsubramanianaks in #9745
• api: add CEL validation for service IP fields by @mmmommm in #9818
• docs: add 24metrics to adopters by @migueltanada in #9613
• build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #10041
• build(deps-dev): bump autoprefixer from 10.5.5 to 10.6.0 in /site by @dependabot[bot] in #10032
• build(deps): bump distroless/base-nossl from 5cab74e to 8c563c1 in /tools/docker/envoy-gateway by @dependabot[bot] in #10031
• build(deps): bump sigs.k8s.io/gateway-api-inference-extension from 1.6.0 to 1.6.1 in /examples/extension-server by @dependabot[bot] in #10039
• build(deps): bump the gomod group across 2 directories with 3 updates by @dependabot[bot] in #10037
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #10036
• fix: apply maxDynamicDescriptors at route level by @andreeapid in #9974
• chore: bump google.golang.org/grpc by @zirain in #10047
• fix: accept equal-preference cipher groups in TLS settings by @zhaohuabing in #10050
• feat: request buffer limit by @zhaohuabing in #8893
• api: add claimPath to SecurityPolicy JWT ClaimToHeader by @gianniskt in #9972
• fix(gatewayapi): conflict HTTPS and TLS listeners sharing a hostname when gateways are merged by @zhaohuabing in #10013
• build(deps-dev): bump autoprefixer from 10.6.0 to 10.6.1 in /site by @dependabot[bot] in #10076
• build(deps): bump sigs.k8s.io/controller-runtime from 0.25.0 to 0.25.1 in /examples/extension-server by @dependabot[bot] in #10082
• build(deps): bump the actions group across 1 directory with 8 updates by @dependabot[bot] in #10086
• build(deps): bump sigs.k8s.io/gateway-api-inference-extension from 1.6.1 to 1.6.2 in /examples/extension-server by @dependabot[bot] in #10083
• build(deps): bump sigs.k8s.io/controller-runtime from 0.25.0 to 0.25.1 by @dependabot[bot] in #10080
• build(deps): bump sigs.k8s.io/controller-runtime from 0.25.0 to 0.25.1 in /examples/remote-infra by @dependabot[bot] in #10085
• build(deps): bump the gomod group across 8 directories with 4 updates by @dependabot[bot] in #10079
• perf: store extension server resources centrally by @zirain in #10071
• chore: pin deps by @zirain in #10095
• chore: align admins with steering committee by @arkodg in #9962
• fix(gatewayapi): allow consistent hash with merge backends by @zhaohuabing in #10052
• chore: bump redis image to 8.6.7 by @zirain in #10094
• fix: scope merged cluster settings by backend protocol by @kkk777-7 in #10016
• test: regenerate the merged consistent-hash cluster golden by @zhaohuabing in #10115
• fix: count UDP proxy sessions in shutdown drain by @zhaohuabing in #10110
• header mutation: added ordered header mutations to ClientTrafficPolicy header filter by @wbpcode in #9555
• [cooper-09] fix(jsonpatch): batch JSONPath matches by @cooper-oai in #10118
• fix(translator): match SNI on every TCP filter chain by @zhaohuabing in #10011
• perf: store upstream CA bundles once per gateway by @zhaohuabing in #10072
• fix(translator): compute GeoIP header removals once per listener by @cooper-oai in #10107
• chore: ignore presence.decionis.com by @zirain in #10125
• fix: security fixes by @zirain in #10130
• release notes for v1.8.5 by @zirain in #10132
• [release-1.9] add release notes for v1.9.2 by @kkk777-7 in #10129
• docs: add EnvoyPatchPolicy examples for cluster resources by @thiagomedina in #9711
• docs: Add 1.9.2 benchmark dashboard by @kkk777-7 in #10138
• bump eg upgrade test by @kkk777-7 in #10139
• add missing release notes by @kkk777-7 in #10143
• build(deps): bump busybox from dc2d74b to fd7dc98 in /tools/docker/envoy-gateway by @dependabot[bot] in #10149
• build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #10156
• feat: support local Wasm via EnvoyProxy wasmModules allowlist by @daanvinken in #9530
• fix: jwt provider cel and security policy validator by @kkk777-7 in #9953
• api: support regex CORS origins in SecurityPolicy by @kahirokunn in #9966
• fix(api): validate responseOverride status code range in BackendTrafficPolicy by @pujitha24 in #9753
• chore: fix OSV npm vulnerabilities by @kkk777-7 in #10169
• fix(infrastructure): mount writable /tmp on the shutdown-manager by @cleman95 in #10120
• fix(message): release discarded coalesced updates by @cooper-oai in #10144
• docs: add Envoy CVE-2026-35189 upgrade guidance to v1.9.2 and v1.8.5 release notes by @kkk777-7 in #10178
• api: backend priority filter by @kkk777-7 in #10027
• fix(config): validate EnvoyProxySpec in EnvoyGateway by @zirain in #9961
• update 1.8.5 perf and docs by @zirain in #10140
• fix(host): support versions pinned by digest in extractSemver by @nacx in #10187
• docs: scale EnvoyProxy with an external autoscaler by @guanchzhou in #9628
• feat: support forwarding the client cert issuer in the XFCC header by @zhaohuabing in #10165
• fix(translator): use own route config name for TLS listeners sharing port with HTTP by @stillya in #10171
• chore: ignore github.com/tsaarni/certyaml on release branch by @zirain in #10209
• build(deps): bump the gomod group across 2 directories with 17 updates by @dependabot[bot] in #10219
• docs: bump recommended Envoy image to v1.39.3/v1.38.6 in release notes by @zhaohuabing in #10222
• build(deps): bump sigs.k8s.io/controller-runtime from 0.25.1 to 0.25.2 in /examples/extension-server by @dependabot[bot] in #10200
• feat(backendtrafficpolicy): support targeting Service, ServiceImport, or Backend directly (merged clusters only) by @muwaqar-cflt in #9816
• fix: handle EndpointSlices labelled with both a Service and a ServiceImport by @schew2381 in #10192
• build(deps): bump sigs.k8s.io/controller-runtime from 0.25.1 to 0.25.2 by @dependabot[bot] in #10199
• build(deps): bump the k8s-io group across 2 directories with 6 updates by @dependabot[bot] in #10216
• fix(translator): stop seeding api_key_auth from the first keyed route by @johnl-amd in #10190
• api: require endpoints for Backend when type is Endpoints by @kkk777-7 in #10243
• fix(e2e): retry failed DNS lookups for BackendTLS public-host routes by @abdulaziz-dev-lab in #10241
• api: add ClientTrafficPolicy option to emit Retry-After header on rate-limit 429 responses by @devilleweppenaar in #9770
• chore: bump golang to 1.27.2 by @zhaohuabing in #10227
• docs: move Gateway API Support out of tasks by @wangyusheng1985 in #10236
• docs: fix broken targetSelectors and Gateway API links by @SatvikMishra08 in #10238
• docs: document withUnderscoresAction default in FAQ by @wangyusheng1985 in #10237
• fix: preserve an explicit zero maxEjectionPercent by @zirain in #10233
• api: support custom compression settings in BackendTrafficPolicy by @miltalex in #9422
• feat(extension): add a timeout for extension service calls by @qqiu-rbx in #10166
• chore: bump golang.org/x/net to v0.60.0 by @hsubramanianaks in #10254
• chore: renew certs by @zirain in #10258
• feat(oidc): support post_logout_redirect_uri in logout by @zhaohuabing in #9608
• fix: route status condition order by @kkk777-7 in #10183
• fix(provider): index HTTPRouteFilters referenced only from backendRef filters by @kkk777-7 in #10246
• docs: clarify maxEjectionPercent zero wording by @zirain in #10249
• build(deps): bump npm-check-updates from 23.1.0 to 23.1.1 in /site by @dependabot[bot] in #10279
• site: replace Envoy AI Gateway with Agent Router by @nacx in #10272
• build(deps): bump sigs.k8s.io/gateway-api from 1.6.2 to 1.6.3 in /examples/extension-server by @dependabot[bot] in #10277
• build(deps): bump the actions group across 1 directory with 8 updates by @dependabot[bot] in #10280
• fix: record a BackendTrafficPolicy on a TCP or UDP route once by @zhaohuabing in #10289
• docs: add a reference architecture diagram to concepts by @berlewis in #10207
• fix(xds): carry Lua scripts on the routes with a shared VM per script by @zhaohuabing in #10056
• test: bump Gateway API conformance test to v1.6.3 by @zirain in #10286
• fix(oidc): let a route's postLogoutRedirect override the parent's by @zhaohuabing in #10285
• feat: support HTTP/3 to upstream backends by @zhaohuabing in #10068
• feat: include version in trace by @zirain in #10316
• fix(gatewayapi): validate Gateway listener name boundaries by @KKamJi98 in #10066
• chore: reduce linkinator concurrency by @zirain in #10284
• fix(backendtrafficpolicy): isolate cluster-scoped settings from route-scoped field errors by @muwaqar-cflt in #10234
• fix(status): match route parent status by parentRef and controllerName by @freemanovec in #10327
• fix(conformance): generate the experimental report after the suite has finished by @abdulaziz-dev-lab in #10303
• perf: BackendTLSPolicy lookup by @zirain in #10320
• perf: improve referencegrant lookup by @zirain in #10319
• feat(api): add EnableCircuitBreakerRemainingStats to ProxyMetrics by @omkar619-dev in #9805
• feat: support SecurityPolicy client-IP authorization for UDPRoute by @zhaohuabing in #9833
• chore: refactor Reconcile by @zirain in #10029
• chore: bump Go to 1.27.3 by @zhaohuabing in #10340
• feat: add a KubernetesService type to Backend by @zhaohuabing in #10051
• build(deps): bump the actions group across 1 directory with 7 updates by @dependabot[bot] in #10357
• feat(translator): record extension server hook call counts and duration by @guydc in #10330
• build(deps): bump the helm group across 1 directory with 3 updates by @dependabot[bot] in #10355
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.39.0 to 1.40.0 in /examples/simple-extension-server by @dependabot[bot] in #10352
• build(deps): bump the gomod group across 2 directories with 6 updates by @dependabot[bot] in #10351
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.39.1-0.20260927022543-fc8912c55e30 to 1.40.0 in /examples/extension-server by @dependabot[bot] in #10347
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.39.0 to 1.40.0 in /examples/envoy-ext-auth by @dependabot[bot] in #10345
• build(deps): bump distroless/base-nossl from 8c563c1 to 83df586 in /tools/docker/envoy-gateway by @dependabot[bot] in #10343
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.39.1-0.20260927022543-fc8912c55e30 to 1.40.0 by @dependabot[bot] in #10344
• feat: expose reuseConnection on active health checks by @vishals-3 in #9741
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.39.0 to 1.40.0 in /examples/sds-test-server by @dependabot[bot] in #10350
• build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.39.0 to 1.40.0 in /examples/grpc-ext-proc by @dependabot[bot] in #10349
• feat(translator): support host header rewrite on mirrored requests by @Nexusrex18 in #10185
• chore: fix OSV scan by @zirain in #10361
• api: require absolute path for local dynamic modules by @wangyusheng1985 in #10231
• fix: report merged route policy status on the parentRef ancestor by @kkk777-7 in #10315
• build: bump distroless/base-nossl to fix the Trivy ca-certificates finding by @zhaohuabing in #10368
• api: split HTTP1 settings by @guydc in #10172
• feat(translator): support SessionPersistence on GRPCRoute by @MengjiaLiang in #10179
• release-note: add breaking-change release note for local dynamic module path validation by @zhaohuabing in #10365
• fix: support ExtensionServerPolicy targeting GatewayClass by @zirain in #10062
• fix: make namespace watch cache ByObject entries deterministic by @manish-9245 in #10302
• feat(api): add PreferDualStack to EnvoyProxy ipFamily by @oivindoh in #10044
• fix(helm): grant controller namespace Secret/EndpointSlice read with watch.namespaces by @kkk777-7 in #10377
• perf: Extension filter and custom backend lookup by @zirain in #10321
• chore: fix nit by @zirain in #10381
• chore(docs): add warning on FQDN endpoint when targeting service by @guydc in #10378
• chore: fix OSV by @zirain in #10382
• Added release note for v1.9.3 by @kkk777-7 in #10384
• update: release notes for v1.9.3 by @kkk777-7 in #10388
• docs: add Prepare.sh as an adopter by @aykhans in #10391
• fix(backendtrafficpolicy): report NotMerged for backend-targeted policy whose target never merges by @muwaqar-cflt in #10252
• fix: deterministic parentRef order by @zirain in #10393
• feat(translator): implement backendPriority HTTPRouteFilter by @kkk777-7 in #10248
• feat: add connection duration jitter to ClientTrafficPolicy by @zhaohuabing in #10300
• feat(helm): support init and extra containers by @wweiwei-li in #10324
• feat: expose failTrafficOnPanic on zone-aware load balancing by @vishals-3 in #10058
• feat(clienttrafficpolicy): support forward_proto_config to infer x-forwarded-proto from PROXY protocol by @Aias00 in #9469
• docs: add release notes for v1.8.6 by @zirain in #10396
• feat(BackendTrafficPolicy): Implement request header matching with response override by @HusseinKabbout in #9998
• perf(message): preserve shared destinations in IR copies by @cooper-oai in #10145
• api: add packAsBytes to SecurityPolicy extAuth bodyToExtAuth by @jamesglennan in #10213
• feat: support vm sharing for wasm plugins by @aosti in #10049
• feat: support compressor settings for Prometheus metrics compression by @miltalex in #10247
• feat: propagate gateway-name label to infra resources in default mode by @mmmommm in #9478
• chore: treat 408 as a warning in the docs link check by @zhaohuabing in #10399
• fix: derive the protocol of active health checks from the backend by @zhaohuabing in #9806
• feat: add hostname field to active gRPC health checks by @gcleroux in #10093
• docs: update for v1.8.6 by @zirain in #10401
• feat: Support gRPC-JSON transcoder by @nfarhadian in #9905
• docs: Add 1.9.3 benchmark dashboard by @kkk777-7 in #10403
• chore: bump eg upgrade test by @kkk777-7 in #10404
• feat(translator): vhost extension resoruces by @guydc in #10373
• test(provider): wait for the Gateway in the cache before creating its Service by @nobbs in #10406
• test(e2e): apply the health check event log BTP before its route by @nobbs in #10415
• docs: recommend Envoy v1.39.6/v1.38.9 in the v1.9.3 and v1.8.6 release notes by @zhaohuabing in #10422
• feat: chunk large OIDC token cookies by default by @nobbs in #10402
• feat: Support ListenerSet as a targetRef kind for Extension Server policies by @zirain in #10374
• docs: fix Lua validation field name in v1.9.2 release notes by @nacx in #10424
• feat: add extension backend bindings by @michalskalski in #10244
• ci: label PRs that touch the API automatically by @zhaohuabing in #10419
• e2e: stop the dynamic resolver h2c e2e test from depending on httpbin.org by @zhaohuabing in #10427
• api: reject zero health check durations via CEL by @zirain in #10443
• feat: sign release image with cosign keyless signing by @MateSousa in #10426
• feat(ratelimit): support ClusterSetting for ratelimit service by @zirain in #10400
• build(deps): bump markdownlint-cli from 0.49.1 to 0.50.0 in /tools by @dependabot[bot] in #10430
• build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #10438
• build(deps): bump the gomod group across 2 directories with 9 updates by @dependabot[bot] in #10435
• build(deps): bump the helm group across 1 directory with 4 updates by @dependabot[bot] in #10432
• fix: reject SAN and hash matchers with client validation mode VerifyIfGiven by @zhaohuabing in #10420
• build(deps): bump distroless/base-nossl from 6d92083 to 6a2a334 in /tools/docker/envoy-gateway by @dependabot[bot] in #10429
• api: warning the comming removal by @zirain in #10251
• fix: missing digest in proxy version by @panos-- in #10445
• chore: mute OSV scanner by @zirain in #10453
• perf(ratelimit): apply serviceSettings schema defaults once at config load by @zirain in #10451
• Resolve listener TLS certificates through an extension server by @wweiwei-li in #10142
• api: reject unsupported operators in stat names by @zirain in #10444
• v1.10.0-rc.1 release by @zhaohuabing in #10455
• bump envoy, ratelimit and dynamic modules for v1.10.0-rc.1 by @zhaohuabing in #10457

New Contributors

• @FlorisFeddema made their first contribution in #9615
• @rtomadpg made their first contribution in #5963
• @dlanov made their first contribution in #9650
• @VonNao made their first contribution in #9556
• @electricjesus made their first contribution in #9517
• @consideRatio made their first contribution in #9363
• @zanarellidev made their first contribution in #9634
• @jacobw made their first contribution in #9736
• @hsubramanianaks made their first contribution in #9623
• @stillya made their first contribution in #9764
• @pujitha24 made their first contribution in #9812
• @sied95 made their first contribution in #9809
• @TheisFerre made their first contribution in #9768
• @vijaypal89 made their first contribution in #9898
• @kanywst made their first contribution in #9743
• @iamhaseebn made their first contribution in #9855
• @ocularminds made their first contribution in #9714
• @funkluk made their first contribution in #9970
• @gray-oni made their first contribution in #9720
• @agelwarg made their first contribution in #9752
• @migueltanada made their first contribution in #9613
• @andreeapid made their first contribution in #9974
• @wbpcode made their first contribution in #9555
• @cooper-oai made their first contribution in #10118
• @thiagomedina made their first contribution in #9711
• @kahirokunn made their first contribution in #9966
• @schew2381 made their first contribution in #10192
• @johnl-amd made their first contribution in #10190
• @abdulaziz-dev-lab made their first contribution in #10241
• @devilleweppenaar made their first contribution in #9770
• @wangyusheng1985 made their first contribution in #10236
• @SatvikMishra08 made their first contribution in #10238
• @qqiu-rbx made their first contribution in #10166
• @berlewis made their first contribution in #10207
• @KKamJi98 made their first contribution in #10066
• @freemanovec made their first contribution in #10327
• @omkar619-dev made their first contribution in #9805
• @vishals-3 made their first contribution in #9741
• @manish-9245 made their first contribution in #10302
• @oivindoh made their first contribution in #10044
• @aykhans made their first contribution in #10391
• @jamesglennan made their first contribution in #10213
• @aosti made their first contribution in #10049
• @nfarhadian made their first contribution in #9905
• @MateSousa made their first contribution in #10426
• @panos-- made their first contribution in #10445

Full Changelog: v1.9.3...v1.10.0-rc.1