Skip to main content

v0.7.2

Released October 27, 2026. Supported until April 27, 2027.

v0.7.2 ships 4 security updates. The most severe security issue cleared is critical.

About these release notes

A fully detailed version of these release notes (including artifact versions) is included in the Admin Console.

The full release notes are opened from the Admin Console, as described in Check the management plane version.

Upgrade and rollback​

  • The release carries no breaking change. 3 changes name operator steps of their own, given with each change in the full release notes in the Admin Console.
  • The upgrade rolls through without dropping traffic.
  • Rollback to v0.7.1 is unconditional.

Security updates​

Gateway​

The AAA Certificate Services and emSign ECC Root CA - G3 roots are removed from the system trust bundle of the gateway, shared Envoy and envoy-tars images, so TLS verification in those images rejects chains that depend on them.

The AI Gateway controller and external processor are built with Go 1.27.3, which includes the Go fix for blocked intermediate certificates (CVE-2026-111943), so they reject certificate chains that pass through those intermediates.

Envoy proxies include the fix for the critical Brotli decoder vulnerability CVE-2026-111497, protecting proxies that decode Brotli-compressed requests.

Helm charts​

The rate limit service, the kubectl and secret bootstrap images, and the Google Secret Manager client that the management plane services run at startup are built with Go 1.26.10, which includes the Go fix for blocked intermediate certificates (CVE-2026-111943), so they reject certificate chains that pass through those intermediates.