What's Changed
- [release-4.13] chore: bump Go version to 1.25.12 in trivy workflow by @k8s-infra-cherrypick-robot in #1188
- [release-4.13] fix: CVE-2026-24051 by @andyzhangx in #1193
- [release-4.13] fix: GHSA-hrxh-6v49-42gf by @andyzhangx in #1203
- [release-4.13] chore: bump csi-resizer to v2.2.1 (cherry-pick #1225) by @andyzhangx in #1226
- [release-4.13] fix: update Go version from 1.26.4 to 1.26.5 to fix CVEs by @andyzhangx in #1229
- [release-4.13] chore: bump Go to 1.26.6 by @k8s-infra-cherrypick-robot in #1232
- fix: propagate volumeSnapshotClass annotations in latest chart (release-4.13) by @andyzhangx in #1236
- [release-4.13] fix: validate paths during snapshot creation (#1241) by @andyzhangx in #1247
- [release-4.13] cleanup: demote empty GRPC response log to V(6) by @k8s-infra-cherrypick-robot in #1253
- [release-4.13] feat: add uid/gid StorageClass parameters for volume directory ownership by @andyzhangx in #1258
- [release-4.13] fix: CVE-2026-56854 by @andyzhangx in #1263
- cherry-pick #1255 to release-4.13: add configurable snapshot tarball size limits by @andyzhangx in #1264
- [release-4.13] fix: CVE-2026-84304 by @andyzhangx in #1268
- [release-4.13] fix: CVE-2026-56855 by @andyzhangx in #1270
- [release-4.13] fix: best-effort cleanup for timed out nfs mounts by @k8s-infra-cherrypick-robot in #1275
- [release-4.13] fix: CVE-2026-81870 by @andyzhangx in #1277
- [release-4.13] fix: reject block volumes in NodePublishVolume by @k8s-infra-cherrypick-robot in #1282
- doc: cut v4.13.5 release by @andyzhangx in #1286
Full Changelog: v4.13.4...v4.13.5