2.13.9

Changelog

• chore(deps): bump envoy from 1.36.7 to 1.36.8 #16933 @kumahq
• chore(deps): bump go version from 1.26.3 to 1.26.4 #16882 @renovate
• chore(deps): security update #17183 @kumahq
• feat(helm): configurable zone proxy probes (backport of #17228) #17313 @kumahq
• fix(intercp): distinguish unreachable leader from leader change #17153 @kumahq
• fix(kuma): unwrap DeletedFinalStateUnknown in k8s event listener (backport of #17066) #17119 @kumahq
• fix(kuma-cp): add events.k8s.io API group to RBAC (backport of #15635) #17070 @kumahq
• fix(mads): remove noisy MeshMetrics/metrics coexistence log #17079 @kumahq
• fix(meshtls): sort inbound SAN matchers for stable config #17158 @kumahq
• fix(mtls): drop legacy identity secret when MeshIdentity is assigned (backport of #16947) #17223 @kumahq
• fix(xds): ignore workload status in mesh hash (backport of #17064) #17088 @kumahq