2.13.0

LTS

Changelog

• chore(deps): bump go to 1.25.3 #14824 @bartsmykla
• chore(deps): bump ci-tools/release-tool from 1.1.5 to 1.3.1 #14633 #14892 #14998 #15013 #15036 #15105 #15106 @renovate
• chore(deps): bump coredns from v1.12.2 to v1.13.1 #14678 @Automaat
• chore(deps): bump debian from 13.0 to 13.2 #14443 #15144 @renovate
• chore(deps): bump debian:13.1 from 833c135 to 01a723b #14605 #14756 #14858 #14866 @renovate
• chore(deps): bump envoy from v1.35.1 to 1.36.4 #14429 #14445 #14703 #14741 #15209 #15246 @renovate
• chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug from 7557eb8 to 1321f45 #14438 #14773 #15176 @renovate
• chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug-nonroot from ccb2092 to ef70836 #14439 #14774 #15177 @renovate
• chore(deps): bump gcr.io/distroless/static-debian12:debug-nonroot from a855ba8 to 53ced32 #14440 #14775 #15178 @renovate
• chore(deps): bump gcr.io/k8s-staging-build-image/distroless-iptables from v0.8.1 to 0.8.6 #14504 #14655 #14687 #15134 #15184 @renovate
• chore(deps): bump gcr.io/k8s-staging-build-image/distroless-iptables:v0.8.2 from 89d2f2f to c8ebd0d #14519 @renovate
• chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from 3b55046 to 5413786 #14396 #14520 #14606 #14647 #14714 #14815 #14938 #15019 #15115 @renovate
• chore(deps): bump ginkgo from 2.25.3 to 2.27.2 #14691 #14860 #14939 @renovate
• chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20240527124623-de85860b7d21 from de85860 to a7f0409 #14521 @renovate
• chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20250908134551-a7f0409399c9 from a7f0409 to a79f5cb #15130 @renovate
• chore(deps): bump github.com/cilium/ebpf from 0.19.0 to 0.20.0 #14943 @renovate
• chore(deps): bump github.com/cncf/xds/go from 2ac532f to 8bfbf64 #15088 @renovate
• chore(deps): bump github.com/containernetworking/plugins from v1.7.1 to 1.9.0 #14406 #15224 @renovate
• chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 1.2.1 to 1.3.0 #15193 @renovate
• chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.19.0 to 4.19.1 #15135 @renovate
• chore(deps): bump github.com/gruntwork-io/terratest from v0.50.0 to 0.54.0 #14552 #14944 #15145 #15194 @renovate
• chore(deps): bump github.com/jackc/pgx/v5 from v5.7.5 to v5.7.6 #14430 @renovate
• chore(deps): bump github.com/onsi/ginkgo/v2 from v2.25.2 to v2.25.3 #14399 @renovate
• chore(deps): bump github.com/prometheus/client_golang from v1.23.0 to v1.23.2 #14400 @renovate
• chore(deps): bump github.com/prometheus/common from v0.65.0 to 0.67.4 #14407 #14651 #14942 #15136 #15185 @renovate
• chore(deps): bump github.com/prometheus/otlptranslator from v0.0.2 to v1.0.0 #14482 @renovate
• chore(deps): bump github.com/spf13/cobra from v1.9.1 to 1.10.2 #14408 #15186 @renovate
• chore(deps): bump github.com/spf13/pflag from v1.0.9 to v1.0.10 #14401 @renovate
• chore(deps): bump github.com/testcontainers/testcontainers-go from v0.38.0 to 0.40.0 #14527 #15054 @renovate
• chore(deps): bump go to 1.25.2 #14667 @bartsmykla
• chore(deps): bump go.opentelemetry.io/proto/otlp from v1.7.1 to 1.9.0 #14410 #15027 @renovate
• chore(deps): bump go.uber.org/zap from 1.27.0 to 1.27.1 #15138 @renovate
• chore(deps): bump golang.org/x/crypto from v0.41.0 to 0.45.0 #14444 #15048 @renovate
• chore(deps): bump golang.org/x/exp from df92998 to 8475f28 #14941 #15131 #15247 @renovate
• chore(deps): bump golang.org/x/net from v0.43.0 to 0.46.0 #14460 #14732 #14742 @renovate
• chore(deps): bump golang.org/x/sync from v0.16.0 to 0.18.0 #14411 #14945 @renovate
• chore(deps): bump golang.org/x/sys from v0.35.0 to 0.38.0 #14412 #14692 #15028 @renovate
• chore(deps): bump golang.org/x/text from v0.28.0 to v0.29.0 #14432 @renovate
• chore(deps): bump golang.org/x/tools from v0.36.0 to 0.39.0 #14479 #14758 #15146 @renovate
• chore(deps): bump golangci-lint #14608 #14953 #15025 #15118 #15195 @renovate
• chore(deps): bump google.golang.org/genproto/googleapis/* from 9702482 to ff82c1b #15092 #15132 #15179 @renovate
• chore(deps): bump google.golang.org/grpc from v1.75.0 to 1.77.0 #14474 #14733 #15147 @renovate
• chore(deps): bump google.golang.org/protobuf from v1.36.8 to v1.36.9 #14454 @renovate
• chore(deps): bump helm from 4.0.0 to 4.0.2 #15139 #15248 @renovate
• chore(deps): bump helm.sh/helm/v3 from v3.18.6 to 4.0.0 #14480 #15029 @renovate
• chore(deps): bump k8s.io/apimachinery from 0.34.1 to 0.34.2 #15021 @renovate
• chore(deps): bump k8s.io/kube-openapi from 589584f to 4e65d59 #15133 @renovate
• chore(deps): bump k8s.io/utils from 0af2bda to bc988d5 #14686 @renovate
• chore(deps): bump kubectl from 1.34.1 to 1.34.3 #14952 #15249 @renovate
• chore(deps): bump kubernetes packages fr...

2.12.5

Changelog

• chore(deps): bump ci-tools/release-tool from 1.2.4 to 1.2.5 #15015 @kumahq
• chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.43.0 #14995 @renovate
• chore(deps): security update #15059 @kumahq

2.7.20

Important

This release introduces two related changes to align with Go module versioning conventions:

1. Module path: Kuma now uses github.com/kumahq/kuma/v2 (with /v2 suffix)
2. Release tags: Tags now include the v prefix (e.g., v2.7.20 instead of 2.7.20)

These breaking changes only affect Go projects that directly reference Kuma as a dependency in their code. Regular Kuma users are not affected.

Changelog

• chore(deps): bump go to 1.24.9 #14821 #14825 @bartsmykla
• chore(deps): bump github.com/containerd/containerd from 1.7.27 to 1.7.29 #14930 @renovate
• chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.43.0 #14996 @renovate
• feat(deps)!: migrate module path to github.com/kumahq/kuma/v2 #15032 @bartsmykla
• fix(xds): set keepalive configuration for dpp to cpp connection (backport of #14912) #14924 @kumahq
• perf(rules): optimize SubsetIter to enumerate only correct subsets (backport of #14862) #14868 @kumahq

2.10.9

Important

This release introduces two related changes to align with Go module versioning conventions:

1. Module path: Kuma now uses github.com/kumahq/kuma/v2 (with /v2 suffix)
2. Release tags: Tags now include the v prefix (e.g., v2.10.9 instead of 2.10.9)

These breaking changes only affect Go projects that directly reference Kuma as a dependency in their code. Regular Kuma users are not affected.

Changelog

• chore(deps): bump go to 1.24.9 #14822 @bartsmykla
• chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.43.0 #14993 @renovate
• feat(deps)!: migrate module path to github.com/kumahq/kuma/v2 #15010 @bartsmykla
• fix(MeshCircuitBreaker): properly configure inbounds with servicePort set (backport of #14875) #14879 @kumahq
• fix(meshpassthrough): sort IP address to provide predictable order (backport of #14857) #14864 @kumahq
• fix(xds): set keepalive configuration for dpp to cpp connection (backport of #14912) #14925 @kumahq
• perf(rules): optimize SubsetIter to enumerate only correct subsets (backport of #14862) #14869 @kumahq

2.11.8

Important

This release introduces two related changes to align with Go module versioning conventions:

1. Module path: Kuma now uses github.com/kumahq/kuma/v2 (with /v2 suffix)
2. Release tags: Tags now include the v prefix (e.g., v2.11.8 instead of 2.11.8)

These breaking changes only affect Go projects that directly reference Kuma as a dependency in their code. Regular Kuma users are not affected.

This is a patch release that every user should upgrade to.

Changelog

• chore(deps): bump go to 1.24.9 #14823 @bartsmykla
• chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.43.0 #14994 @renovate
• feat(deps)!: migrate module path to github.com/kumahq/kuma/v2 #14979 @bartsmykla
• feat(mise): move golang dependency to mise (backport of #14884) #14888 @kumahq
• fix(MeshCircuitBreaker): properly configure inbounds with servicePort set (backport of #14875) #14881 @kumahq
• fix(meshpassthrough): sort IP address to provide predictable order (backport of #14857) #14865 @kumahq
• fix(xds): set keepalive configuration for dpp to cpp connection (backport of #14912) #14927 @kumahq
• perf(rules): optimize SubsetIter to enumerate only correct subsets (backport of #14862) #14870 @kumahq

2.12.4

Important

This release introduces two related changes to align with Go module versioning conventions:

1. Module path: Kuma now uses github.com/kumahq/kuma/v2 (with /v2 suffix)
2. Release tags: Tags now include the v prefix (e.g., v2.12.4 instead of 2.12.4)

These breaking changes only affect Go projects that directly reference Kuma as a dependency in their code. Regular Kuma users are not affected.

Changelog

• feat(deps)!: migrate module path to github.com/kumahq/kuma/v2 #14968 @bartsmykla
• feat(mise): move golang dependency to mise (backport of #14884) #14887 @kumahq
• fix(MeshCircuitBreaker): properly configure inbounds with servicePort set (backport of #14875) #14880 @kumahq
• fix(meshpassthrough): sort IP address to provide predictable order (backport of #14857) #14863 @kumahq
• fix(xds): set keepalive configuration for dpp to cpp connection (backport of #14912) #14926 @kumahq
• perf(rules): optimize SubsetIter to enumerate only correct subsets (backport of #14862) #14871 @kumahq

2.12.3

Changelog

• chore(deps): bump ci-tools/release-tool from v1.1.5 to v1.2.1 #14795 @bartsmykla
• fix(kuma-init): update base image to fix CVE-2025-4802 (HIGH severity) #14803 @bartsmykla

2.11.7

Changelog

• chore(deps): bump ci-tools/release-tool from v1.1.5 to v1.2.1 #14794 @bartsmykla
• chore(deps): bump envoy from 1.34.7 to 1.34.10 #14708 #14752 @kumahq
• chore(deps): security update #14783 @bartsmykla
• fix(kuma-init): update base image to fix CVE-2025-4802 (HIGH severity) #14804 @bartsmykla

2.10.8

Changelog

• chore(deps): bump ci-tools/release-tool from v1.1.4 to v1.2.1 #14793 @bartsmykla
• chore(deps): bump envoy from 1.32.12 to 1.33.12 #14706 #14753 @kumahq
• chore(deps): security update #14784 @bartsmykla
• fix(kuma-init): update base image to fix CVE-2025-4802 (HIGH severity) #14805 @bartsmykla

2.7.19

Changelog

• chore(deps): bump ci-tools/release-tool from v0.10.2 to v1.2.1 #14792 @bartsmykla
• chore(deps): bump envoy from 1.32.12 to 1.33.12 #14705 #14749 @kumahq
• chore(deps): security update for release-2.7 #14785 @bartsmykla