fix(deps): update module github.com/envoyproxy/gateway to v1.9.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/envoyproxy/gateway	v1.8.3 → v1.9.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

envoyproxy/gateway (github.com/envoyproxy/gateway)

v1.9.1

Compare Source

Release Announcement

Check out the v1.9.1 release announcement to learn more about the release.

v1.9.0

Compare Source

Release Announcement

Check out the v1.9.0 release announcement to learn more about the release.

What's Changed

• Add Flux installation guide by @​matheuscscp in #​8864
• fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 by @​wucm667 in #​8906
• skip invalid listener first in IR by @​zirain in #​8577
• feat: policy field owner by @​kkk777-7 in #​8538
• docs(tasks): add documentation for Dynamic Modules configuration example by @​sjoukedv in #​8908
• fix: remove cross ns policy attachment status by @​zhaohuabing in #​8901
• build(deps): bump npm-check-updates from 22.0.1 to 22.1.0 in /site by @​dependabot[bot] in #​8918
• build(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.0 in /examples/extension-server by @​dependabot[bot] in #​8924
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​8925
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the actions group across 1 directory by @​dependabot[bot] in #​8920
• feat: add runner event metrics by @​zirain in #​8802
• build(deps): bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.0 by @​dependabot[bot] in #​8923
• fix: respect backend endpoint hostname for health checks by @​arkodg in #​8929
• fix(helm): propagate commonLabels to RBAC resources by @​mvanhorn in #​8818
• fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef by @​apkatsikas in #​8871
• fix: do not downgrade ALPN for only hostnames-overlapping listeners by @​zhaohuabing in #​8934
• build(deps): bump the gomod group across 6 directories with 9 updates by @​dependabot[bot] in #​8931
• feat: enableDeferredCreationStats by default by @​zirain in #​8937
• bump golang to 1.26.3 by @​zirain in #​8943
• chore: mute OSV scanner by @​zirain in #​8945
• chore: use os.Stdout instead of t.Output() by @​zirain in #​8860
• [release/v1.7] update docs and add release notes by @​cnvergence in #​8947
• [release/v1.7] add benchmark report for v1.7.3 by @​cnvergence in #​8954
• fix: restore last transition time in merge status conditions by @​rudrakhp in #​8962
• docs: fix the version in release announcement link by @​cnvergence in #​8966
• [release/v1.8] v1.8.0 release docs and announcement by @​jukie in #​8942
• build(deps): bump the actions group across 1 directory with 4 updates by @​dependabot[bot] in #​8976
• build(deps): bump npm-check-updates from 22.1.0 to 22.2.0 in /site by @​dependabot[bot] in #​8972
• chore: remove unnecessary overlapping hostnames in the http3 test yaml by @​zhaohuabing in #​8963
• build(deps): bump the gomod group across 2 directories with 2 updates by @​dependabot[bot] in #​8973
• build(deps): bump the k8s-io group across 1 directory with 6 updates by @​dependabot[bot] in #​8974
• fix: add unary interceptor and fix fail-open auth in GatewayNamespaceMode by @​cnvergence in #​8986
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​8978
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 by @​dependabot[bot] in #​8975
• bump lastVersionTag to v1.8.0 by @​jukie in #​8992
• feat: add envoyproxy status by @​zirain in #​8475
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 in /examples/extension-server by @​dependabot[bot] in #​8977
• Add gateway-api v1.5.1 mention to v1.8.0 release notes by @​jukie in #​8999
• Update benchmarks dashboard for v1.8.0 by @​jukie in #​9002
• Update non--crash-security--bug.md by @​guydc in #​9000
• update docs links to 1.8.0 by @​zhaohuabing in #​9005
• chore: fix gateway API docs links by @​zhaohuabing in #​9006
• [release/v1.8] fix benchmark report for v1.8.0 by @​jukie in #​9007
• fix(charts): add Gateway API v1.5 ListenerSet metrics to kube-state-metrics by @​samuelmasuy in #​9001
• fix(charts): split combined autoscaling/policy RBAC rule in infra-manager by @​samuelmasuy in #​9013
• fix: applyBackendTLSSetting panic by @​zirain in #​8998
• fix(xds): hot-reload xDS server cert in GatewayNamespaceMode by @​nguyenptk in #​8959
• docs: move v1.8 CRD upgrade note by @​arkodg in #​9017
• docs: add bandwidth docs by @​kkk777-7 in #​8939
• fix(helm): correct typo in HPA maxReplicas required message by @​benjaminch in #​9032
• docs: highlight Gateway API compatibility by @​zhaohuabing in #​9010
• build(deps): bump distroless/base-nossl from f71dcb6 to 20f009e in /tools/docker/envoy-gateway by @​dependabot[bot] in #​9038
• chore: replace Deprecated CEL ParsedExpr Oneof With CelExprParsed by @​zhaohuabing in #​8982
• chore: update release note for v1.9 by @​kkk777-7 in #​9045
• build(deps): bump the gomod group across 5 directories with 6 updates by @​dependabot[bot] in #​9040
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9041
• feat: disabled automountServiceAccountToken by default by @​zirain in #​9051
• feat: allow to custom pod securityContext in gateway-helm by @​zirain in #​9036
• fix: bump osv scanner by @​jukie in #​9070
• chore: add deprecated field check by @​kkk777-7 in #​9072
• docs: fix ClientTrafficPolicy verification steps by @​apkatsikas in #​9076
• fix backend.tls.clientCertificateRef override test by @​guydc in #​9077
• add depkeep to enterprise support by @​pkuzco in #​9046
• lua: deprecate disableLua in favor of enableLua by @​rudrakhp in #​9081
• chore: fix osv scan by @​zhaohuabing in #​9080
• fix: allow IANA cipher names by @​zhaohuabing in #​9073
• chore: address comment by @​zirain in #​9055
• build(deps): bump the actions group across 1 directory with 4 updates by @​dependabot[bot] in #​9090
• build(deps): bump cel.dev/expr from 0.25.1 to 0.25.2 by @​dependabot[bot] in #​9089
• build(deps): bump busybox from 1487d0a to fd8d9aa in /tools/docker/envoy-gateway by @​dependabot[bot] in #​9087
• build(deps): bump github.com/docker/cli from 29.5.1+incompatible to 29.5.2+incompatible in the gomod group across 1 directory by @​dependabot[bot] in #​9088
• build(deps): bump the helm group across 1 directory with 4 updates by @​dependabot[bot] in #​9092
• fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target by @​AlecDiraimondo in #​9068
• chore: hide ForwardIDToken by @​zhaohuabing in #​9085
• chore: fix docs link by @​zirain in #​9101
• build(deps): bump npm-check-updates from 22.2.0 to 22.2.1 in /site by @​dependabot[bot] in #​9091
• fix: encode TLS secrets with canonical PEM formatting by @​cnvergence in #​8744
• chore: update deprecated docker libraries by @​cnvergence in #​9106
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​9109
• docs: copy Lua extensions security warning to v1.8 and v1.7 by @​rudrakhp in #​9113
• fix: MaxStreamDuration should worked for non-route cluster by @​zirain in #​9028
• feat: authorization path match by @​kkk777-7 in #​9008
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9108
• chore: update testdata on main by @​jukie in #​9123
• fix(egctl): skip missing CRDs in x status bulk modes by @​jeremiahsnapp in #​9099
• fix(gatewayapi): reject unsupported BackendRef URLRewrite path rewrites by @​Aditya7880900936 in #​9131
• fix: force HTTP1 for Service/ServiceImport with websocket appProtocol by @​zhaohuabing in #​9138
• feat: add requestBody payload to HTTP active health checker by @​michalskalski in #​9111
• chore: bump golang to 1.26.4 by @​zirain in #​9147
• fix: move validation admission policy outside of crds directory by @​zhaohuabing in #​9024
• fix: alway include the controller namespace in the watched namespaces by @​zhaohuabing in #​9100
• build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 in /test by @​dependabot[bot] in #​9160
• build(deps): bump npm-check-updates from 22.2.1 to 22.2.2 in /site by @​dependabot[bot] in #​9157
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​9158
• build(deps): bump the gomod group across 1 directory with 16 updates by @​dependabot[bot] in #​9159
• build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 in /tools by @​dependabot[bot] in #​9164
• fix rate limit validation on K8s 1.36 by @​beckcl in #​9166
• Add release notes for v1.8.1 by @​jukie in #​9170
• Add release notes for v1.7.4 by @​cnvergence in #​9124
• fix github SA for June release by @​zirain in #​9173
• chore: fix date and nit by @​zirain in #​9177
• build(deps): bump opentelemetry-collector from 0.157.2 to 0.158.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @​dependabot[bot] in #​9156
• Bump VERSION to v1.8.1 by @​jukie in #​9175
• docs: update benckmark for 1.8.1 and 1.7.4 by @​zirain in #​9179
• docs: TLSRoute with TLS termination by @​zhaohuabing in #​9107
• docs: explain how to scrape proxy metrics with an existing Prometheus by @​SAY-5 in #​9052
• fix(validation): allow IPv6 to be specific in loadBalancerSourceRanges by @​rissson in #​9050
• fix(egctl): return config errors when port forwarding fails by @​immanuwell in #​9056
• chore: fix codecov by @​zhaohuabing in #​9188
• fix: allow Backend TLS to disable ALPN with an empty list by @​zhaohuabing in #​9162
• fix(gatewayapi): sort api key auth credentials by @​nobbs in #​9042
• fix(status): separate listener programmed state from HTTPRoute Accepted condition by @​apkatsikas in #​9129
• build(deps): bump npm-check-updates from 22.2.2 to 22.2.3 in /site by @​dependabot[bot] in #​9201
• build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 in the actions group across 1 directory by @​dependabot[bot] in #​9203
• feat(auto_host_sni): allow configuring the sni automatically from the upstream endpoint by @​nacx in #​9137
• fix(egctl): correct user-facing grammar in help text by @​immanuwell in #​9217
• fix: reject ExternalName Service as a route backend by @​zhaohuabing in #​9190
• fix(status): fall back to service externalIPs for Gateway addresses by @​jvlxz in #​9209
• fix: don't duplicate ValidatingAdmissionPolicy in install.yaml by @​jukie in #​9182
• feat(xds): add xdsNACKTotal metric by @​QuantumEnigmaa in #​9205
• feat: source rate limit value from dynamic metadata by @​kanurag94 in #​9216
• fix(listenerset): implement hostname conflict listener precedence by @​zirain in #​9192
• fix: correct the config hot reload validation order by @​MengjiaLiang in #​9214
• build(deps): bump the helm group across 1 directory with 4 updates by @​dependabot[bot] in #​9202
• build(deps): bump the k8s-io group across 1 directory with 6 updates by @​dependabot[bot] in #​9241
• build(deps): bump the gomod group across 2 directories with 6 updates by @​dependabot[bot] in #​9240
• fix: deduplicate CA certificates in ClientTrafficPolicy mTLS by @​yuehaii in #​8909
• feat(policy): support ListenerSet as targetRef for ClientTrafficPolicy by @​apkatsikas in #​9026
• fix(docs): links still pointing to /contributions by @​M4tteoP in #​9255
• fix: renew expired TLS certificates in e2e test fixtures by @​rudrakhp with @​Copilot in #​9256
• feat(api): Add filterContext field to Lua type in EnvoyExtensionPolicy by @​norman-zon in #​8730
• build(deps): bump js-yaml and markdownlint-cli in /tools by @​dependabot[bot] in #​9258
• docs: update release schedule information by @​apkatsikas in #​9257
• docs: update Client Traffic Policy docs with new ListenerSet information by @​apkatsikas in #​9262
• build(deps): bump undici from 7.24.7 to 7.28.0 in /tools by @​dependabot[bot] in #​9261
• build(deps-dev): bump tar from 7.5.13 to 7.5.16 in /site by @​dependabot[bot] in #​9260
• feat: option to disable automatic X-Forwarded-For append/add by @​lextiz in #​8576
• build(deps): bump markdown-it and markdownlint-cli in /tools by @​dependabot[bot] in #​9259
• feat: add FailedRefetchDuration to RemoteJWKS by @​jukie in #​9265
• build(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 in /tools by @​dependabot[bot] in #​9266
• build(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 by @​dependabot[bot] in #​9267
• feat(helm): add CRDs dependency toggle by @​cilindrox in #​8850
• fix: proxy protocol with httpProtocolOptions by @​zhaohuabing in #​9234
• fix: validate API Key auth ExtractFrom by @​zhaohuabing in #​9250
• fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum by @​gianniskt in #​9224
• fix(ratelimit): shared global ratelimit with cost not working by @​zirain in #​9245
• chore: run dependabot on release branch by @​zirain in #​9230
• fix(gatewayapi): http retry without backoff by @​zirain in #​9238
• chore: update dependabot by @​zirain in #​9299
• chore: use pinned docker image by @​zirain in #​9300
• build(deps): bump npm-check-updates from 22.2.3 to 22.2.7 in /site by @​dependabot[bot] in #​9277
• perf: resolve ClientTrafficPolicy targets once by @​jukie in #​9272
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​9282
• build(deps): bump the gomod group across 1 directory with 2 updates by @​dependabot[bot] in #​9283
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9279
• chore: split release notes by @​zhaohuabing in #​9312
• build(deps-dev): bump autoprefixer from 10.5.0 to 10.5.1 in /site by @​dependabot[bot] in #​9321
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in /tools/github-actions/setup-deps in the actions group across 1 directory by @​dependabot[bot] in #​9325
• chore: ignore k8s.io and go-control-plane on release branches by @​zirain in #​9331
• feat: support for deployment.envoyGateway.strategy by @​zirain in #​9318
• build(deps): bump otel/opentelemetry-collector-contrib from 0.154.0 to 0.155.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @​dependabot[bot] in #​9344
• build(deps-dev): bump autoprefixer from 10.5.1 to 10.5.2 in /site by @​dependabot[bot] in #​9343
• ci: add tests for Kubernetes 1.36 by @​beckcl in #​8990
• chore: update pr template to help reduce review effort by @​zhaohuabing in #​9350
• helm: follow-up docs and template wording by @​jukie in #​9317
• Add release notes for v1.8.2 by @​jukie in #​9361
• fix: consolidate destination AppProtocol handling by @​zhaohuabing in #​9337
• fix: panic with empty deploy by @​zirain in #​9365
• fix: use target resource namespace in BTP RoutingType index by @​Aias00 in #​9359
• chore: bump envoy go-control-plane by @​zirain in #​9375
• fix: DaemonSet pod not using the configured custom ServiceAccount name by @​zirain in #​9347
• ratelimit: refactor shared and non-shared ratelimit rules by @​zirain in #​9332
• fix: use int64 format for ratelimit Requests field by @​jukie in #​9377
• docs: describe uint32 vs int32 range issue by @​jukie in #​9379
• feat: CEL-based Authorization policy by @​zhaohuabing in #​8981
• feat: Bump gatewayapi v1.6.0 by @​zirain in #​9232
• build(deps): bump npm-check-updates from 22.2.7 to 22.2.9 in /site by @​dependabot[bot] in #​9387
• deps: ignore gateway-api on release branch by @​zirain in #​9393
• chore: update skipped tests by @​zirain in #​9394
• build(deps): bump opentelemetry-collector from 0.159.0 to 0.159.2 in /charts/gateway-addons-helm in the helm group across 1 directory by @​dependabot[bot] in #​9388
• build(deps): bump the gomod group across 6 directories with 6 updates by @​dependabot[bot] in #​9398
• Update sync-dashboard for v1.8.2 by @​jukie in #​9403
• feat: support listenerset policy attach in security policy by @​kkk777-7 in #​9270
• docs(gateway-helm): clarify envoyProxy image values by @​immanuwell in #​9222
• fix: prevent GatewayNamespace mode from hijacking pre-existing ServiceAccounts and ConfigMaps by @​yuehaii in #​9215
• fix: allow trailing dot in Backend FQDN hostnames by @​NeddM in #​9098
• feat: support statusOnError field in EnvoyExtensionPolicy ExtProc by @​dragon3 in #​9044
• detect ipv6 literal hosts in url2cluster and token endpoint check by @​dxbjavid in #​9165
• feat(api): add ClientTrafficPolicy.clientIPDetection.downstreamRemoteAddress for L4-transparent geoip by @​sboulkour in #​8956
• fix: register ListenerSet and route indexes in offline controller by @​Aias00 in #​9320
• build(deps): bump the gomod group across 1 directory with 2 updates by @​dependabot[bot] in #​9436
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9434
• build(deps): bump the actions group across 1 directory with 6 updates by @​dependabot[bot] in #​9439
• chore: bump golang to 1.26.5 by @​zhaohuabing in #​9437
• Add release notes for 1.7.5 by @​cnvergence in #​9433
• docs: update 1.8 install docs by @​zhaohuabing in #​9451
• [release/v1.7] add benchmark report for v1.7.5 by @​cnvergence in #​9453
• feat(helm): harden control-plane and certgen securityContext by @​jukie in #​9069
• perf: deduplicate JWT authn providers by @​Aias00 in #​9430
• e2e: add stats for WASM by @​zirain in #​9424
• fix: UDP/TCP RouteMultipleRoutesAttachment conformance test by @​zirain in #​9247
• docs: document vulnerability disclosure process by @​arkodg in #​9227
• perf: introduce endpoint slice indexer by @​kkk777-7 in #​9221
• Revert LuaPerRoute source materialization for Lua by @​arkodg in #​9426
• feat: support HTTPFilter for GRPCRoute by @​zhaohuabing in #​9404
• fix: default backend TLS max version to 1.3 by @​vishwas-bm in #​9412
• feat(ctp): add allowExpiredCertificate to tls.clientValidation by @​daanvinken in #​9199
• docs: fix invalid proxy protocol example by @​hegerdes in #​9479
• refactor: use stdlib maps and slices instead of golang.org/x/exp by @​mmmommm in #​9482
• fix(listenerset): implement listener conflict precedence for protocol conflicts by @​zirain in #​9196
• feat: wrap watch.namespaces helm template check in a with block by @​cnvergence in #​9067
• Support off and critical log level by @​wweiwei-li in #​9271
• build(deps): bump the actions group across 1 directory with 9 updates by @​dependabot[bot] in #​9506
• build(deps-dev): bump autoprefixer from 10.5.2 to 10.5.3 in /site by @​dependabot[bot] in #​9495
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9501
• build(deps): bump markdownlint-cli from 0.49.0 to 0.49.1 in /tools by @​dependabot[bot] in #​9496
• build(deps): bump sigs.k8s.io/mcs-api from 0.5.0 to 0.5.2 by @​dependabot[bot] in #​9500
• build(deps): bump the gomod group across 1 directory with 4 updates by @​dependabot[bot] in #​9499
• build(deps): bump distroless/base-nossl from 20f009e to 86554c4 in /tools/docker/envoy-gateway by @​dependabot[bot] in #​9494
• fix: redirect port leaking across multiple listeners by @​Aias00 in #​9349
• fix: add default retry policy for Envoy wasm module fetch by @​jukie in #​9462
• fix/refactor: deep copy status in translator for all resources by @​rudrakhp in #​9458
• conformance: fix GatewayListenerUnsupportedProtocol test by @​zirain in #​9490
• fix(logs): restore ISO 8601 timestamp format by @​wiegandf in #​9493
• fix: unreferenced Secret events trigger reconciliation when HTTPRouteFilter CRD exists by @​Greyeye in #​9488
• bump Gateway API to v1.6.1 by @​zirain in #​9515
• Add release notes for v1.8.3 by @​jukie in #​9518
• feat: support client and overall tracing sampling by @​Ri7ay in #​9402
• refactor: use field owner pattern to merge BTPs by @​rudrakhp in #​9514
• api: add host normalization to ClientTrafficPolicy by @​sboulkour in #​9115
• Fix(ext-proc-examples): Add RequestBody and ResponseBody handling in request processing by @​abe-servescale in #​9183
• feat(translator): Support ignoreFailure to tolerate invalid JWT by @​sinitax in #​9313
• feat(ext_proc): add support for observability mode by @​skos-ninja in #​8536
• fix(xds): use DnsCluster extension for DNS clusters by @​andreademurtas in #​9155
• feat: allow RateLimitRedisSettings.url to be sourced from a Secret by @​guanchzhou in #​9143
• chore: fix gen by @​zirain in #​9533
• Remove 1.8.3 release page by @​jukie in #​9526
• docs: recommend ListenerSet over mergeGateways by @​zhaohuabing in #​9524
• feat(helm): add startupProbe to envoy-gateway deployment by @​cleman95 in #​8820
• fix: reject TLS secret when certificate and private key do not match by @​zhaohuabing in #​9480
• feat: support consistent hash for non-route backends by @​zhaohuabing in #​9231
• build(deps-dev): bump autoprefixer from 10.5.3 to 10.5.4 in /site by @​dependabot[bot] in #​9542
• build(deps): bump codespell from 2.4.2 to 2.4.3 in /tools/src/codespell by @​dependabot[bot] in #​9544
• build(deps): bump loki from 7.0.0 to 7.1.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @​dependabot[bot] in #​9545
• build(deps): bump the actions group across 2 directories with 6 updates by @​dependabot[bot] in #​9549
• feat: use grpc status errors in jwtinterceptor by @​cnvergence in #​9020
• Add release note for fix to ratelimit fallback tag by @​jukie in #​9553
• build(deps): bump linkinator from 7.6.1 to 8.0.0 in /tools by @​dependabot[bot] in #​9543
• Update benchmark dashboard for v1.8.3 by @​jukie in #​9560
• fix: dedupe SAN entries before checking algorithm uniqueness by @​dmavrodiev in #​9472
• build(deps): bump the gomod group across 5 directories with 7 updates by @​dependabot[bot] in #​9546
• Bump metallb and kind by @​jukie in #​9562
• Create 1.8.3 release page and final release steps by @​jukie in #​9561
• docs: point community meeting calendar to LFX platform by @​zhaohuabing in #​9569
• fix: bound policy ancestors on the fly to avoid O(N^2) translation latency by @​zhaohuabing in #​9558
• docs: explain invert field in global rate limit example by @​Aditya7880900936 in #​9572
• ci: wire standalone test suite into GitHub Actions by @​takumi12311123 in #​9127
• deps: bump dependencies flagged by OSV scan by @​zhaohuabing in #​9575
• fix(cors validation) allow all RFC-3986 compliant schemes by @​christopherbii in #​9049
• feat(xds): support SNI based dynamic forward proxy for TLSRoute by @​andreademurtas in #​9184
• fix: handle EC parameters before TLS private keys by @​jvlxz in #​9338
• test: fix mismatched tls.key in tlsroute dynamic resolver testdata by @​zhaohuabing in #​9582
• fix: eliminate port race in setupFakeEnvoyStats test helper by @​muwaqar-cflt in #​9580
• feat: support listenerset reference grant by @​kkk777-7 in #​9481
• fix: allow TLSv1.3 for remote JWKS fetching by @​michaelbeaumont in #​9531
• fix: allow requests:0 for global rate limit block rules by @​mvanhorn in #​9333
• fix: validate SDS URL by @​zirain in #​9030
• fix: confirm NotFound against the API server before dropping status writes by @​zhaohuabing in #​9566
• feat(oidc): forward id token by @​zhaohuabing in #​9367
• api: make RateLimitRedisSettings.url a pointer by @​guanchzhou in #​9538
• fix(docs): replace dead Envoy Slack invite link by @​zhaohuabing in #​9586
• feat(xds): raise xDS gRPC server default receive limit and make it configurable by @​linmosko in #​9564
• fix: eliminate cfg.Logger data race in server()'s reload/shutdown path by @​muwaqar-cflt in #​9581
• fix: make ListenerSet and GRPCRoute watches optional by @​zhaohuabing in #​9583
• build(deps): bump npm-check-updates from 22.2.9 to 23.0.0 in /site by @​dependabot[bot] in #​9595
• build(deps): bump linkinator from 8.0.0 to 8.0.2 in /tools by @​dependabot[bot] in #​9596
• build(deps): bump the actions group across 1 directory with 10 updates by @​dependabot[bot] in #​9602
• feat: envoy extension policy listenerset attach by @​kkk777-7 in #​9425
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9599
• api: add OOB BackendUtilization by @​jukie in #​9400
• build(deps): bump the gomod group across 3 directories with 5 updates by @​dependabot[bot] in #​9598
• fix: don't set Deployment replicas when an HPA is configured by [@​zhaohuabing](https://redir

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 18 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26.5 -> 1.26.7
github.com/envoyproxy/go-control-plane	v0.14.1-0.20260409050421-3f47accd6e14 -> v0.14.1-0.20260729145720-a2d8c7492908
github.com/envoyproxy/go-control-plane/envoy	v1.37.1-0.20260409050421-3f47accd6e14 -> v1.37.1-0.20260729145720-a2d8c7492908
google.golang.org/grpc	v1.83.0 -> v1.83.1
google.golang.org/protobuf	v1.36.12-0.20260120151049-f2248ac996af -> v1.36.12
cel.dev/expr	v0.25.2 -> v0.25.3
github.com/envoyproxy/go-control-plane/ratelimit	v0.1.1-0.20260409050421-3f47accd6e14 -> v0.1.1-0.20260729145720-a2d8c7492908
go.opentelemetry.io/otel	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/metric	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/sdk	v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/trace	v1.44.0 -> v1.45.0
golang.org/x/mod	v0.38.0 -> v0.39.0
golang.org/x/net	v0.57.0 -> v0.58.0
golang.org/x/text	v0.40.0 -> v0.41.0
golang.org/x/tools	v0.48.0 -> v0.49.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260729162451-8efbd57d26e0 -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260729162451-8efbd57d26e0 -> v0.0.0-20260803160001-6ac0973c030d