v1.5.7

  less than a minute  

Date: January 12, 2026

Breaking changes

Security updates

  • Bump envoy to v1.35.8.
  • Fixed CVE-2026-22771: arbitrary code execution through EnvoyExtensionPolicy Lua scripts.

New features

Bug fixes

  • Fixed an issue where observedGeneration is missing from the EnvoyPatchPolicy status.
  • Fixed ExternalTrafficPolicy not being applied to Envoy Service when ServiceType is NodePort.
  • Fixed an issue where BackendTrafficPolicy does not validate maximum value of requestBuffer limit.
  • Fixed an issue where port forward not working on OpenTelemetry collector pods.
  • Fixed a potential goroutine leak when config reloads.

Performance improvements

Deprecations

Other changes


Last modified January 13, 2026: chore: remove lint.whitenoise and enable markdown lint MD009 (#7887) (8eabdb2)