chore(deps): update gateway-helm docker tag to v1.9.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
gateway-helm (source)	HelmChart	minor	1.8.2 → 1.9.0	1.9.1 (+1)

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

envoyproxy/gateway (gateway-helm)

v1.9.0

Compare Source

Release Announcement

Check out the v1.9.0 release announcement to learn more about the release.

What's Changed

• Add Flux installation guide by @​matheuscscp in #​8864
• fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 by @​wucm667 in #​8906
• skip invalid listener first in IR by @​zirain in #​8577
• feat: policy field owner by @​kkk777-7 in #​8538
• docs(tasks): add documentation for Dynamic Modules configuration example by @​sjoukedv in #​8908
• fix: remove cross ns policy attachment status by @​zhaohuabing in #​8901
• build(deps): bump npm-check-updates from 22.0.1 to 22.1.0 in /site by @​dependabot[bot] in #​8918
• build(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.0 in /examples/extension-server by @​dependabot[bot] in #​8924
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​8925
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the actions group across 1 directory by @​dependabot[bot] in #​8920
• feat: add runner event metrics by @​zirain in #​8802
• build(deps): bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.0 by @​dependabot[bot] in #​8923
• fix: respect backend endpoint hostname for health checks by @​arkodg in #​8929
• fix(helm): propagate commonLabels to RBAC resources by @​mvanhorn in #​8818
• fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef by @​apkatsikas in #​8871
• fix: do not downgrade ALPN for only hostnames-overlapping listeners by @​zhaohuabing in #​8934
• build(deps): bump the gomod group across 6 directories with 9 updates by @​dependabot[bot] in #​8931
• feat: enableDeferredCreationStats by default by @​zirain in #​8937
• bump golang to 1.26.3 by @​zirain in #​8943
• chore: mute OSV scanner by @​zirain in #​8945
• chore: use os.Stdout instead of t.Output() by @​zirain in #​8860
• [release/v1.7] update docs and add release notes by @​cnvergence in #​8947
• [release/v1.7] add benchmark report for v1.7.3 by @​cnvergence in #​8954
• fix: restore last transition time in merge status conditions by @​rudrakhp in #​8962
• docs: fix the version in release announcement link by @​cnvergence in #​8966
• [release/v1.8] v1.8.0 release docs and announcement by @​jukie in #​8942
• build(deps): bump the actions group across 1 directory with 4 updates by @​dependabot[bot] in #​8976
• build(deps): bump npm-check-updates from 22.1.0 to 22.2.0 in /site by @​dependabot[bot] in #​8972
• chore: remove unnecessary overlapping hostnames in the http3 test yaml by @​zhaohuabing in #​8963
• build(deps): bump the gomod group across 2 directories with 2 updates by @​dependabot[bot] in #​8973
• build(deps): bump the k8s-io group across 1 directory with 6 updates by @​dependabot[bot] in #​8974
• fix: add unary interceptor and fix fail-open auth in GatewayNamespaceMode by @​cnvergence in #​8986
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​8978
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 by @​dependabot[bot] in #​8975
• bump lastVersionTag to v1.8.0 by @​jukie in #​8992
• feat: add envoyproxy status by @​zirain in #​8475
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 in /examples/extension-server by @​dependabot[bot] in #​8977
• Add gateway-api v1.5.1 mention to v1.8.0 release notes by @​jukie in #​8999
• Update benchmarks dashboard for v1.8.0 by @​jukie in #​9002
• Update non--crash-security--bug.md by @​guydc in #​9000
• update docs links to 1.8.0 by @​zhaohuabing in #​9005
• chore: fix gateway API docs links by @​zhaohuabing in #​9006
• [release/v1.8] fix benchmark report for v1.8.0 by @​jukie in #​9007
• fix(charts): add Gateway API v1.5 ListenerSet metrics to kube-state-metrics by @​samuelmasuy in #​9001
• fix(charts): split combined autoscaling/policy RBAC rule in infra-manager by @​samuelmasuy in #​9013
• fix: applyBackendTLSSetting panic by @​zirain in #​8998
• fix(xds): hot-reload xDS server cert in GatewayNamespaceMode by @​nguyenptk in #​8959
• docs: move v1.8 CRD upgrade note by @​arkodg in #​9017
• docs: add bandwidth docs by @​kkk777-7 in #​8939
• fix(helm): correct typo in HPA maxReplicas required message by @​benjaminch in #​9032
• docs: highlight Gateway API compatibility by @​zhaohuabing in #​9010
• build(deps): bump distroless/base-nossl from f71dcb6 to 20f009e in /tools/docker/envoy-gateway by @​dependabot[bot] in #​9038
• chore: replace Deprecated CEL ParsedExpr Oneof With CelExprParsed by @​zhaohuabing in #​8982
• chore: update release note for v1.9 by @​kkk777-7 in #​9045
• build(deps): bump the gomod group across 5 directories with 6 updates by @​dependabot[bot] in #​9040
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9041
• feat: disabled automountServiceAccountToken by default by @​zirain in #​9051
• feat: allow to custom pod securityContext in gateway-helm by @​zirain in #​9036
• fix: bump osv scanner by @​jukie in #​9070
• chore: add deprecated field check by @​kkk777-7 in #​9072
• docs: fix ClientTrafficPolicy verification steps by @​apkatsikas in #​9076
• fix backend.tls.clientCertificateRef override test by @​guydc in #​9077
• add depkeep to enterprise support by @​pkuzco in #​9046
• lua: deprecate disableLua in favor of enableLua by @​rudrakhp in #​9081
• chore: fix osv scan by @​zhaohuabing in #​9080
• fix: allow IANA cipher names by @​zhaohuabing in #​9073
• chore: address comment by @​zirain in #​9055
• build(deps): bump the actions group across 1 directory with 4 updates by @​dependabot[bot] in #​9090
• build(deps): bump cel.dev/expr from 0.25.1 to 0.25.2 by @​dependabot[bot] in #​9089
• build(deps): bump busybox from 1487d0a to fd8d9aa in /tools/docker/envoy-gateway by @​dependabot[bot] in #​9087
• build(deps): bump github.com/docker/cli from 29.5.1+incompatible to 29.5.2+incompatible in the gomod group across 1 directory by @​dependabot[bot] in #​9088
• build(deps): bump the helm group across 1 directory with 4 updates by @​dependabot[bot] in #​9092
• fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target by @​AlecDiraimondo in #​9068
• chore: hide ForwardIDToken by @​zhaohuabing in #​9085
• chore: fix docs link by @​zirain in #​9101
• build(deps): bump npm-check-updates from 22.2.0 to 22.2.1 in /site by @​dependabot[bot] in #​9091
• fix: encode TLS secrets with canonical PEM formatting by @​cnvergence in #​8744
• chore: update deprecated docker libraries by @​cnvergence in #​9106
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​9109
• docs: copy Lua extensions security warning to v1.8 and v1.7 by @​rudrakhp in #​9113
• fix: MaxStreamDuration should worked for non-route cluster by @​zirain in #​9028
• feat: authorization path match by @​kkk777-7 in #​9008
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9108
• chore: update testdata on main by @​jukie in #​9123
• fix(egctl): skip missing CRDs in x status bulk modes by @​jeremiahsnapp in #​9099
• fix(gatewayapi): reject unsupported BackendRef URLRewrite path rewrites by @​Aditya7880900936 in #​9131
• fix: force HTTP1 for Service/ServiceImport with websocket appProtocol by @​zhaohuabing in #​9138
• feat: add requestBody payload to HTTP active health checker by @​michalskalski in #​9111
• chore: bump golang to 1.26.4 by @​zirain in #​9147
• fix: move validation admission policy outside of crds directory by @​zhaohuabing in #​9024
• fix: alway include the controller namespace in the watched namespaces by @​zhaohuabing in #​9100
• build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 in /test by @​dependabot[bot] in #​9160
• build(deps): bump npm-check-updates from 22.2.1 to 22.2.2 in /site by @​dependabot[bot] in #​9157
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​9158
• build(deps): bump the gomod group across 1 directory with 16 updates by @​dependabot[bot] in #​9159
• build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 in /tools by @​dependabot[bot] in #​9164
• fix rate limit validation on K8s 1.36 by @​beckcl in #​9166
• Add release notes for v1.8.1 by @​jukie in #​9170
• Add release notes for v1.7.4 by @​cnvergence in #​9124
• fix github SA for June release by @​zirain in #​9173
• chore: fix date and nit by @​zirain in #​9177
• build(deps): bump opentelemetry-collector from 0.157.2 to 0.158.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @​dependabot[bot] in #​9156
• Bump VERSION to v1.8.1 by @​jukie in #​9175
• docs: update benckmark for 1.8.1 and 1.7.4 by @​zirain in #​9179
• docs: TLSRoute with TLS termination by @​zhaohuabing in #​9107
• docs: explain how to scrape proxy metrics with an existing Prometheus by @​SAY-5 in #​9052
• fix(validation): allow IPv6 to be specific in loadBalancerSourceRanges by @​rissson in #​9050
• fix(egctl): return config errors when port forwarding fails by @​immanuwell in #​9056
• chore: fix codecov by @​zhaohuabing in #​9188
• fix: allow Backend TLS to disable ALPN with an empty list by @​zhaohuabing in #​9162
• fix(gatewayapi): sort api key auth credentials by @​nobbs in #​9042
• fix(status): separate listener programmed state from HTTPRoute Accepted condition by @​apkatsikas in #​9129
• build(deps): bump npm-check-updates from 22.2.2 to 22.2.3 in /site by @​dependabot[bot] in #​9201
• build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 in the actions group across 1 directory by @​dependabot[bot] in #​9203
• feat(auto_host_sni): allow configuring the sni automatically from the upstream endpoint by @​nacx in #​9137
• fix(egctl): correct user-facing grammar in help text by @​immanuwell in #​9217
• fix: reject ExternalName Service as a route backend by @​zhaohuabing in #​9190
• fix(status): fall back to service externalIPs for Gateway addresses by @​jvlxz in #​9209
• fix: don't duplicate ValidatingAdmissionPolicy in install.yaml by @​jukie in #​9182
• feat(xds): add xdsNACKTotal metric by @​QuantumEnigmaa in #​9205
• feat: source rate limit value from dynamic metadata by @​kanurag94 in #​9216
• fix(listenerset): implement hostname conflict listener precedence by @​zirain in #​9192
• fix: correct the config hot reload validation order by @​MengjiaLiang in #​9214
• build(deps): bump the helm group across 1 directory with 4 updates by @​dependabot[bot] in #​9202
• build(deps): bump the k8s-io group across 1 directory with 6 updates by @​dependabot[bot] in #​9241
• build(deps): bump the gomod group across 2 directories with 6 updates by @​dependabot[bot] in #​9240
• fix: deduplicate CA certificates in ClientTrafficPolicy mTLS by @​yuehaii in #​8909
• feat(policy): support ListenerSet as targetRef for ClientTrafficPolicy by @​apkatsikas in #​9026
• fix(docs): links still pointing to /contributions by @​M4tteoP in #​9255
• fix: renew expired TLS certificates in e2e test fixtures by @​rudrakhp with @​Copilot in #​9256
• feat(api): Add filterContext field to Lua type in EnvoyExtensionPolicy by @​norman-zon in #​8730
• build(deps): bump js-yaml and markdownlint-cli in /tools by @​dependabot[bot] in #​9258
• docs: update release schedule information by @​apkatsikas in #​9257
• docs: update Client Traffic Policy docs with new ListenerSet information by @​apkatsikas in #​9262
• build(deps): bump undici from 7.24.7 to 7.28.0 in /tools by @​dependabot[bot] in #​9261
• build(deps-dev): bump tar from 7.5.13 to 7.5.16 in /site by @​dependabot[bot] in #​9260
• feat: option to disable automatic X-Forwarded-For append/add by @​lextiz in #​8576
• build(deps): bump markdown-it and markdownlint-cli in /tools by @​dependabot[bot] in #​9259
• feat: add FailedRefetchDuration to RemoteJWKS by @​jukie in #​9265
• build(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 in /tools by @​dependabot[bot] in #​9266
• build(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 by @​dependabot[bot] in #​9267
• feat(helm): add CRDs dependency toggle by @​cilindrox in #​8850
• fix: proxy protocol with httpProtocolOptions by @​zhaohuabing in #​9234
• fix: validate API Key auth ExtractFrom by @​zhaohuabing in #​9250
• fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum by @​gianniskt in #​9224
• fix(ratelimit): shared global ratelimit with cost not working by @​zirain in #​9245
• chore: run dependabot on release branch by @​zirain in #​9230
• fix(gatewayapi): http retry without backoff by @​zirain in #​9238
• chore: update dependabot by @​zirain in #​9299
• chore: use pinned docker image by @​zirain in #​9300
• build(deps): bump npm-check-updates from 22.2.3 to 22.2.7 in /site by @​dependabot[bot] in #​9277
• perf: resolve ClientTrafficPolicy targets once by @​jukie in #​9272
• build(deps): bump the actions group across 1 directory with 2 updates by @​dependabot[bot] in #​9282
• build(deps): bump the gomod group across 1 directory with 2 updates by @​dependabot[bot] in #​9283
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9279
• chore: split release notes by @​zhaohuabing in #​9312
• build(deps-dev): bump autoprefixer from 10.5.0 to 10.5.1 in /site by @​dependabot[bot] in #​9321
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in /tools/github-actions/setup-deps in the actions group across 1 directory by @​dependabot[bot] in #​9325
• chore: ignore k8s.io and go-control-plane on release branches by @​zirain in #​9331
• feat: support for deployment.envoyGateway.strategy by @​zirain in #​9318
• build(deps): bump otel/opentelemetry-collector-contrib from 0.154.0 to 0.155.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @​dependabot[bot] in #​9344
• build(deps-dev): bump autoprefixer from 10.5.1 to 10.5.2 in /site by @​dependabot[bot] in #​9343
• ci: add tests for Kubernetes 1.36 by @​beckcl in #​8990
• chore: update pr template to help reduce review effort by @​zhaohuabing in #​9350
• helm: follow-up docs and template wording by @​jukie in #​9317
• Add release notes for v1.8.2 by @​jukie in #​9361
• fix: consolidate destination AppProtocol handling by @​zhaohuabing in #​9337
• fix: panic with empty deploy by @​zirain in #​9365
• fix: use target resource namespace in BTP RoutingType index by @​Aias00 in #​9359
• chore: bump envoy go-control-plane by @​zirain in #​9375
• fix: DaemonSet pod not using the configured custom ServiceAccount name by @​zirain in #​9347
• ratelimit: refactor shared and non-shared ratelimit rules by @​zirain in #​9332
• fix: use int64 format for ratelimit Requests field by @​jukie in #​9377
• docs: describe uint32 vs int32 range issue by @​jukie in #​9379
• feat: CEL-based Authorization policy by @​zhaohuabing in #​8981
• feat: Bump gatewayapi v1.6.0 by @​zirain in #​9232
• build(deps): bump npm-check-updates from 22.2.7 to 22.2.9 in /site by @​dependabot[bot] in #​9387
• deps: ignore gateway-api on release branch by @​zirain in #​9393
• chore: update skipped tests by @​zirain in #​9394
• build(deps): bump opentelemetry-collector from 0.159.0 to 0.159.2 in /charts/gateway-addons-helm in the helm group across 1 directory by @​dependabot[bot] in #​9388
• build(deps): bump the gomod group across 6 directories with 6 updates by @​dependabot[bot] in #​9398
• Update sync-dashboard for v1.8.2 by @​jukie in #​9403
• feat: support listenerset policy attach in security policy by @​kkk777-7 in #​9270
• docs(gateway-helm): clarify envoyProxy image values by @​immanuwell in #​9222
• fix: prevent GatewayNamespace mode from hijacking pre-existing ServiceAccounts and ConfigMaps by @​yuehaii in #​9215
• fix: allow trailing dot in Backend FQDN hostnames by @​NeddM in #​9098
• feat: support statusOnError field in EnvoyExtensionPolicy ExtProc by @​dragon3 in #​9044
• detect ipv6 literal hosts in url2cluster and token endpoint check by @​dxbjavid in #​9165
• feat(api): add ClientTrafficPolicy.clientIPDetection.downstreamRemoteAddress for L4-transparent geoip by @​sboulkour in #​8956
• fix: register ListenerSet and route indexes in offline controller by @​Aias00 in #​9320
• build(deps): bump the gomod group across 1 directory with 2 updates by @​dependabot[bot] in #​9436
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9434
• build(deps): bump the actions group across 1 directory with 6 updates by @​dependabot[bot] in #​9439
• chore: bump golang to 1.26.5 by @​zhaohuabing in #​9437
• Add release notes for 1.7.5 by @​cnvergence in #​9433
• docs: update 1.8 install docs by @​zhaohuabing in #​9451
• [release/v1.7] add benchmark report for v1.7.5 by @​cnvergence in #​9453
• feat(helm): harden control-plane and certgen securityContext by @​jukie in #​9069
• perf: deduplicate JWT authn providers by @​Aias00 in #​9430
• e2e: add stats for WASM by @​zirain in #​9424
• fix: UDP/TCP RouteMultipleRoutesAttachment conformance test by @​zirain in #​9247
• docs: document vulnerability disclosure process by @​arkodg in #​9227
• perf: introduce endpoint slice indexer by @​kkk777-7 in #​9221
• Revert LuaPerRoute source materialization for Lua by @​arkodg in #​9426
• feat: support HTTPFilter for GRPCRoute by @​zhaohuabing in #​9404
• fix: default backend TLS max version to 1.3 by @​vishwas-bm in #​9412
• feat(ctp): add allowExpiredCertificate to tls.clientValidation by @​daanvinken in #​9199
• docs: fix invalid proxy protocol example by @​hegerdes in #​9479
• refactor: use stdlib maps and slices instead of golang.org/x/exp by @​mmmommm in #​9482
• fix(listenerset): implement listener conflict precedence for protocol conflicts by @​zirain in #​9196
• feat: wrap watch.namespaces helm template check in a with block by @​cnvergence in #​9067
• Support off and critical log level by @​wweiwei-li in #​9271
• build(deps): bump the actions group across 1 directory with 9 updates by @​dependabot[bot] in #​9506
• build(deps-dev): bump autoprefixer from 10.5.2 to 10.5.3 in /site by @​dependabot[bot] in #​9495
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9501
• build(deps): bump markdownlint-cli from 0.49.0 to 0.49.1 in /tools by @​dependabot[bot] in #​9496
• build(deps): bump sigs.k8s.io/mcs-api from 0.5.0 to 0.5.2 by @​dependabot[bot] in #​9500
• build(deps): bump the gomod group across 1 directory with 4 updates by @​dependabot[bot] in #​9499
• build(deps): bump distroless/base-nossl from 20f009e to 86554c4 in /tools/docker/envoy-gateway by @​dependabot[bot] in #​9494
• fix: redirect port leaking across multiple listeners by @​Aias00 in #​9349
• fix: add default retry policy for Envoy wasm module fetch by @​jukie in #​9462
• fix/refactor: deep copy status in translator for all resources by @​rudrakhp in #​9458
• conformance: fix GatewayListenerUnsupportedProtocol test by @​zirain in #​9490
• fix(logs): restore ISO 8601 timestamp format by @​wiegandf in #​9493
• fix: unreferenced Secret events trigger reconciliation when HTTPRouteFilter CRD exists by @​Greyeye in #​9488
• bump Gateway API to v1.6.1 by @​zirain in #​9515
• Add release notes for v1.8.3 by @​jukie in #​9518
• feat: support client and overall tracing sampling by @​Ri7ay in #​9402
• refactor: use field owner pattern to merge BTPs by @​rudrakhp in #​9514
• api: add host normalization to ClientTrafficPolicy by @​sboulkour in #​9115
• Fix(ext-proc-examples): Add RequestBody and ResponseBody handling in request processing by @​abe-servescale in #​9183
• feat(translator): Support ignoreFailure to tolerate invalid JWT by @​sinitax in #​9313
• feat(ext_proc): add support for observability mode by @​skos-ninja in #​8536
• fix(xds): use DnsCluster extension for DNS clusters by @​andreademurtas in #​9155
• feat: allow RateLimitRedisSettings.url to be sourced from a Secret by @​guanchzhou in #​9143
• chore: fix gen by @​zirain in #​9533
• Remove 1.8.3 release page by @​jukie in #​9526
• docs: recommend ListenerSet over mergeGateways by @​zhaohuabing in #​9524
• feat(helm): add startupProbe to envoy-gateway deployment by @​cleman95 in #​8820
• fix: reject TLS secret when certificate and private key do not match by @​zhaohuabing in #​9480
• feat: support consistent hash for non-route backends by @​zhaohuabing in #​9231
• build(deps-dev): bump autoprefixer from 10.5.3 to 10.5.4 in /site by @​dependabot[bot] in #​9542
• build(deps): bump codespell from 2.4.2 to 2.4.3 in /tools/src/codespell by @​dependabot[bot] in #​9544
• build(deps): bump loki from 7.0.0 to 7.1.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @​dependabot[bot] in #​9545
• build(deps): bump the actions group across 2 directories with 6 updates by @​dependabot[bot] in #​9549
• feat: use grpc status errors in jwtinterceptor by @​cnvergence in #​9020
• Add release note for fix to ratelimit fallback tag by @​jukie in #​9553
• build(deps): bump linkinator from 7.6.1 to 8.0.0 in /tools by @​dependabot[bot] in #​9543
• Update benchmark dashboard for v1.8.3 by @​jukie in #​9560
• fix: dedupe SAN entries before checking algorithm uniqueness by @​dmavrodiev in #​9472
• build(deps): bump the gomod group across 5 directories with 7 updates by @​dependabot[bot] in #​9546
• Bump metallb and kind by @​jukie in #​9562
• Create 1.8.3 release page and final release steps by @​jukie in #​9561
• docs: point community meeting calendar to LFX platform by @​zhaohuabing in #​9569
• fix: bound policy ancestors on the fly to avoid O(N^2) translation latency by @​zhaohuabing in #​9558
• docs: explain invert field in global rate limit example by @​Aditya7880900936 in #​9572
• ci: wire standalone test suite into GitHub Actions by @​takumi12311123 in #​9127
• deps: bump dependencies flagged by OSV scan by @​zhaohuabing in #​9575
• fix(cors validation) allow all RFC-3986 compliant schemes by @​christopherbii in #​9049
• feat(xds): support SNI based dynamic forward proxy for TLSRoute by @​andreademurtas in #​9184
• fix: handle EC parameters before TLS private keys by @​jvlxz in #​9338
• test: fix mismatched tls.key in tlsroute dynamic resolver testdata by @​zhaohuabing in #​9582
• fix: eliminate port race in setupFakeEnvoyStats test helper by @​muwaqar-cflt in #​9580
• feat: support listenerset reference grant by @​kkk777-7 in #​9481
• fix: allow TLSv1.3 for remote JWKS fetching by @​michaelbeaumont in #​9531
• fix: allow requests:0 for global rate limit block rules by @​mvanhorn in #​9333
• fix: validate SDS URL by @​zirain in #​9030
• fix: confirm NotFound against the API server before dropping status writes by @​zhaohuabing in #​9566
• feat(oidc): forward id token by @​zhaohuabing in #​9367
• api: make RateLimitRedisSettings.url a pointer by @​guanchzhou in #​9538
• fix(docs): replace dead Envoy Slack invite link by @​zhaohuabing in #​9586
• feat(xds): raise xDS gRPC server default receive limit and make it configurable by @​linmosko in #​9564
• fix: eliminate cfg.Logger data race in server()'s reload/shutdown path by @​muwaqar-cflt in #​9581
• fix: make ListenerSet and GRPCRoute watches optional by @​zhaohuabing in #​9583
• build(deps): bump npm-check-updates from 22.2.9 to 23.0.0 in /site by @​dependabot[bot] in #​9595
• build(deps): bump linkinator from 8.0.0 to 8.0.2 in /tools by @​dependabot[bot] in #​9596
• build(deps): bump the actions group across 1 directory with 10 updates by @​dependabot[bot] in #​9602
• feat: envoy extension policy listenerset attach by @​kkk777-7 in #​9425
• build(deps): bump the helm group across 1 directory with 2 updates by @​dependabot[bot] in #​9599
• api: add OOB BackendUtilization by @​jukie in #​9400
• build(deps): bump the gomod group across 3 directories with 5 updates by @​dependabot[bot] in #​9598
• fix: don't set Deployment replicas when an HPA is configured by @​zhaohuabing in #​9594
• feat: support listenerset policy attach in backend traffic policy by @​kkk777-7 in #​9419
• feat(infra): Add remote infrastructure provider by @​zac-nixon in #​9027
• fix: use shared system trust store sds secret by @​guydc in [#​9357](https://r

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.