v1.16.0

What's Changed

• Auto generated from templates by gromit by @sredxny in #925
• FIPS images: Add ARM64 docker images TT-16216 by @Razeen-Abdal-Rahman in #926
• TT-16290 renamed the ci aggregator by @sredxny in #931
• [TT-16317] Change links in config to use Mintlify syntax by @imogenkraak in #933
• [TT-16317] Update config comments by @imogenkraak in #936
• [TT-15674] Extend pumps config with ca cert option by @vladzabolotnyi in #941
• fix: add backticks around collection names in comments by @buger in #942
• [TT-15674] fix: adjust x/net packages, crypto and its deps to latest versions by @vladzabolotnyi in #944
• [TT-16347] Update Pump to Go 1.25 by @edsonmichaque in #947
• ci: migrate release workflow to WarpBuild AMD64 runners by @probelabs[bot] in #953
• [TT-15686] Clean up JSON formatted logs for stdout pump by @MaciekMis in #951
• security: pin actions to SHA, harden CI permissions, pin Docker images by @buger in #956
• TT-16964 - remove sbom job from release workflow by @bsten-tyk in #962
• [TT-16946][TT-16950][TT-16951] feat(ci): FIPS base image for FIPS Docker builds + Go 1.25 by @buger in #963
• [TT-16977] fix: goreleaser skipped on push/tag when dep-guard is skipped by @buger in #964
• [TT-16977] Fix release-bot workflow permissions by @buger in #961
• [TT-16950] fix: set nonroot ownership on application files by @buger in #965
• [TT-16977] fix: add jira-user-email to Jira linter workflow by @buger in #968
• [TT-16977] fix: prevent dep-guard from skipping downstream jobs on push by @buger in #971
• [TT-16977] fix: trigger release workflow on PR labeled event by @buger in #974
• [TT-16932] Fix CVE-2026-32286 by @MFCaballero in #959
• [TT-16932] Update gorm and storage deps by @MFCaballero in #977
• [TT-16950] fix: make Docker images backward compatible with runAsUser: 1000 by @buger in #982
• [TT-17030] Migrate release workflow from PAT to GitHub App token by @buger in #986
• [TT-17030] Migrate remaining workflows from PAT to GitHub App token by @buger in #987
• [TT-17030] Fix git auth: use x-access-token prefix for GitHub App tokens by @buger in #988
• Tt 16809 pump generate mcp analytics by @lghiur in #954
• [TT-17004] Fix MCP Mongo aggregate cross-API merge by @andrei-tyk in #989
• TT-17158: Update config doc comments based on PR feedback by @probelabs[bot] in #1000
• TT-17162: update github-actions workflow by @probelabs[bot] in #1008
• docs: update config doc comments and struct tags by @probelabs[bot] in #1012
• TT-17332: increase timeout value to 45mins for api tests to avoid timeout on 90% of completion by @vladzabolotnyi in #1019
• [TT-17339 master] Implement Floating tags in github actions by @konrad-sol in #1023
• [TT-7519] add "original_path" and "listen_path" to observability by @sedkis in #943
• [TT-17281] Add RFC3339 compliant option for consistent Tyk Pump logs and field mapping by @shults in #1017
• [TT-16778] Fix sharded aggregate SQL writes by @chrisanderton in #1018
• [TT-17569] Bump storage to v1.3.4 (CVE fixes) by @lghiur in #1029
• Bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.6.3 to 1.7.8 by @dependabot[bot] in #1009
• fix: bump aws-sdk-go-v2 kinesis to fix CVE GHSA-xmrv-pmrh-hhx2 by @probelabs[bot] in #1033
• Bump version from v1.12.0 to v1.16.0 by @ilijabojanovic in #1038
• Merging to release-1.16.0: Auto generated from templates by gromit (#1025) by @probelabs[bot] in #1045
• Merging to release-1.16.0: [TT-17507] Update jira-linter to use github-actions/jira-linter (#1039) by @probelabs[bot] in #1043
• Merging to release-1.16.0: [TT-17444] Bump golang.org/x/net to v0.55.0 for CVE fixes (#1041) by @probelabs[bot] in #1042

New Contributors

• @imogenkraak made their first contribution in #933
• @vladzabolotnyi made their first contribution in #941
• @edsonmichaque made their first contribution in #947
• @MaciekMis made their first contribution in #951
• @MFCaballero made their first contribution in #959
• @shults made their first contribution in #1017
• @chrisanderton made their first contribution in #1018

Full Changelog: v1.13.1...v1.16.0