Release Announcement
Check out the v1.3.1 release announcement to learn more about the release.
Breaking changes
- Use the envoy JSON formatter for the default access log instead of text formatter.
Security updates
- Fixed CVE-2025-25294: log injection vulnerability in Envoy Gateway when using default access log.
New features
- Add defaulter for gateway-api resources loading from file to be able to set default values.
Bug fixes
- Added support for Secret and ConfigMap parsing in Standalone mode.
- Fix translating backendSettings for extAuth.
- Fix allowing weights to be zero on endpoints for backendRefs in TCPRoute and UDPRoute.
- Fix validation of all xDS resources.
- Fix support for empty values in fields with default values in Standalone.
Other changes
- Bump golang to 1.23.6.
- Bump k8s-io to 1.32.1.
- Bump ratelimit to ae4cee11.
- Bump golang.org/x/oauth2 to v0.27.0.
- Bump golang.org/x/crypto to v0.35.0.
What's Changed
Full Changelog: v1.3.0...v1.3.1