v0.2.1

Released September 4, 2026. Supported until March 4, 2027.

v0.2.1 is a security patch on top of v0.2.0. Every data plane and management plane image is rebuilt on updated Go dependencies and a patched Go toolchain to clear reported vulnerabilities. Only dependency and toolchain versions change: the release carries no source, API, configuration, or behavior change, and contains no new features, bug fixes, or deprecations.

Upgrade and rollback

• No breaking changes. No operator action is required before upgrading.
• The upgrade rolls through without dropping traffic.
• Rollback to v0.2.0 is unconditional.

Security updates

Data plane images

The gateway, the rate limit service, the AI gateway controller and its ext-proc, and the bundled kubectl and helm are rebuilt to clear reported vulnerabilities in their bundled Go dependencies:

• A critical authentication bypass in golang.org/x/crypto/ssh (CVE-2026-56854).
• High-severity denial-of-service and information-disclosure issues in golang.org/x/net (CVE-2026-46600), golang.org/x/text (CVE-2026-56852), google.golang.org/grpc (CVE-2026-84304), and oras.land/oras-go (CVE-2026-50163).

Management plane and CLI images

The management plane components, the tare CLI and liaison images, and the berglas secret resolver are rebuilt on updated golang.org/x/crypto, golang.org/x/net, golang.org/x/text, golang.org/x/mod (CVE-2026-56864, CVE-2026-56865), and google.golang.org/grpc, and on a patched Go toolchain that clears the Go standard library CVEs.

Telemetry

The bundled OpenTelemetry collector image is updated to clear a high-severity issue in Apache Thrift (CVE-2026-43871).