2.0.2 (July 8, 2026) SECURITY: Upgrade alpine base image version to 3.24 to address [CVE-2026-41989], [ALPINE-CVE-2026-2100]. [GH-23711] dependency: Upgrade Serf and Memberlist to use the latest versions. [GH-23704] xds: Return errors when injecting the L4 intention (RBAC) filter or the mTLS transport socket onto an inbound public listener, so the listener is not served without intention enforceme…
sub module release go mod update for troubleshoot
sub module release go mod update for envoyextensions
sub module release go mod update
dummy-sub-module
2.0.1 (June 18, 2026) SECURITY: Upgrade go version to 1.26.4 to address GO-2026-5039, GO-2026-5038,GO-2026-5037 [GH-23637] connect: Upgrade envoy version to 1.37.4, 1.36.8, 1.35.12; Add new version of Envoy 1.38.2 and remove 1.34.14 [GH-23664] IMPROVEMENTS: dockerfile: layer reduction by merging RUN commands and minor changes following best practices. [GH-23650] product-telemetry: product usage re…
2.0.0 (May 22, 2026) SECURITY: connect: Upgrade envoy version to 1.37.2 and newer versions [GH-23469] go: Upgrade go version to 1.26 [GH-23493] agent: Increased default HTTP server timeouts to prevent breaking long-polling blocking queries. read_timeout and write_timeout are now set to 15 minutes (up from 30 seconds), while read_header_timeout (10s) and idle_timeout (120s) still provide protection…
submodule update
updating api module version
Backport of build(deps): bump github.com/hashicorp/vault/sdk from v0.…
2.0.0-rc2 (May 15, 2026) SECURITY: agent: Increased default HTTP server timeouts to prevent breaking long-polling blocking queries. read_timeout and write_timeout are now set to 15 minutes (up from 30 seconds), while read_header_timeout (10s) and idle_timeout (120s) still provide protection against Slowloris attacks. All timeouts remain configurable via the http_config block. [GH-23267] api-gatewa…
2.0.0-rc1 (April 29, 2026) SECURITY: connect: Upgrade envoy version to 1.37.2 and newer versions [GH-23469] go: Upgrade go version to 1.26 [GH-23493] FEATURES: (Enterprise Only) update to go-licensing/v4 and go-census/v3 inorder to adapt to new licenses of PAO. Global Rate Limiter: (Enterprise Only) a new "rate-limit" config entry kind that enables dynamic, cluster-wide RPC rate limiting stored in…
1.22.7 (April 21, 2026) SECURITY: security: update google.golang.org/grpc to fix CVE-2026-33186 [GH-23379] security: upgrade go.opentelemetry.io/otel to 1.42.0 to remediate CVE-2026-24051 (Path Hijacking / Untrusted Search Paths on macOS). [GH-23387] test-sds-server: bump github.com/hashicorp/consul to v1.22.5 in integration test module to align with the CVE-2026-2808 fixed release line. [GH-23437…
updating submodule version
fix follow-redirects sec vuln (#23494) (#23496)