2.13.10

Changelog

• chore(deps): bump coredns from 1.14.2 to 1.14.6 #17401 @kumahq
• chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 #17530 @renovate
• chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 #17531 @renovate
• chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 #17532 @renovate
• chore(deps): security update #17626 #17682 @kumahq
• feat(api-server): add pluggable per-route metadata provider (backport of #17365) #17370 @kumahq
• feat(xds): unified-name for empty listener tags (backport of #17563) #17672 @kumahq
• fix(auth): require workload-bound token for workload-derived identity (backport of #17474) #17503 @kumahq
• fix(k8s): prevent MeshService going Unavailable during Argo blue-green rollouts #17395 @lukidzi
• fix(kds): attribute zone-to-global synced resources by the connecting zone's client-id (backport of #17456) #17461 @kumahq
• fix(meshaccesslog): match rule-scoped route ids #17558 @kumahq
• fix(meshproxypatch): match unified listener names #17555 @kumahq
• fix(mtp): unified naming for zone egress #17566 @kumahq
• fix(tokens): reject a non-string kid header and recover from dp-server handler panics (backport of #17465) #17467 @bartsmykla
• fix(xds): fix inbound cluster name lookup #17509 @kumahq
• fix(xds): fix unified naming detection for zone proxies #17525 @kumahq
• fix(xds): probe fallback route uses unified cluster name #17501 @kumahq
• fix(xds): unified naming for zone-proxy admin cluster #17554 @kumahq