v1.9.0

What's Changed

• fix: avoid root-owned kubeconfig in LSG pipeline by John Payne (@jpayne3506) in #4857
• fix: [NPM] account for default-drop ACLs in Windows tests by Isaiah Raya (@rayaisaiah) in #4865
• fix: keep JSON store cache unchanged after failed writes by Evan Baker (@rbtr) in #4696
• ci: disable the failure-analysis agent as a temporary mitigation by Behzad Mirkhanzadeh (@behzad-mir) in #4875
• fix: [NPM] compile multi-value namespaceSelector NotIn as a single conjunction by Isaiah Raya (@rayaisaiah) in #4866
• fix: [NPM] canonicalize ipBlock CIDRs and surface translation failures by Isaiah Raya (@rayaisaiah) in #4867
• fix: prevent silent Linux binary build failures in all-binaries-platforms by Behzad Mirkhanzadeh (@behzad-mir) in #4870
• fix: [NPM] scope negation-only namespaceSelector matches to cluster namespaces by Isaiah Raya (@rayaisaiah) in #4868
• ci: run govulncheck nightly by John Payne (@jpayne3506) in #4704
• fix: add missing env vars for binary tag release channel notification by Behzad Mirkhanzadeh (@behzad-mir) in #4765
• ci: fix false-positive issue dedup in go-version-check by Behzad Mirkhanzadeh (@behzad-mir) in #4834
• test: wait for Linux datapath pods to be deleted by Ethan Ermovick (@Arleee1) in #4863
• fix(ci): harden CNI load test recovery by Behzad Mirkhanzadeh (@behzad-mir) in #4764
• ci: pass images to e2e stages by Mugesh (@mugeshsp) in #4885
• fix: make CNS endpoint-state writes atomic by Evan Baker (@rbtr) in #4697
• deps: bump google.golang.org/grpc from 1.83.1 to 1.83.2 by Dependabot (@dependabot)[bot] in #4853
• chore: add dependabot config for release/v1.8 by Behzad Mirkhanzadeh (@behzad-mir) in #4894
• deps: bump golang.org/x/crypto to v0.57.0 (CVE-2026-56855, CVE-2026-78662) by Behzad Mirkhanzadeh (@behzad-mir) in #4901

New Contributors

• Ethan Ermovick (@Arleee1) made their first contribution in #4863

Full Changelog: v1.8.13...v1.9.0