v2.0.0

2.0.0 (May 23, 2026)

SECURITY:

• Upgrade dependencies to address CVE findings: migrate integration-tests from archived go-jose.v2 to go-jose/v4 (fixes CVE-2024-28180, GHSA-c5q2-7r4c-mv6g, GO-2024-2631), upgrade golang.org/x/net to v0.55.0, and patch golang.org/x/crypto to v0.52.0 in the bundled go-discover binary. [GH-1107]
• security: Update to UBI base image to 9.8 for fixing [CVE_2026-2100] [GH-1102]
• Upgrade to use x/net 0.53.0. This resolves GO-2026-4918 [GH-1084]
• security: upgrade go version to 1.26 [GH-1049]
• Add microdnf upgrade in dockerfile to include future security fixes [GH-917]

IMPROVEMENTS:

• Update Envoy version to 1.37.2 [GH-1052]

BUG FIXES:

• envoy: add skip_exit to drain_listeners admin API call to prevent premature pod termination when upgrading to Envoy 1.37+ [GH-1061]
• envoy: prevent graceful shutdown errors from closing errorExitCh, which caused Envoy to be killed immediately bypassing the configured grace period [GH-1072]