v1.16.6

1.16.6 (February 13, 2024)

SECURITY:

• mesh: Update Envoy version to 1.26.7 to address CVE-2024-23324, CVE-2024-23325, CVE-2024-23322, CVE-2024-23323, CVE-2024-23327, and CVE-2023-44487 [GH-20586]

IMPROVEMENTS:

• ProxyCfg: avoid setting a watch on Internal.ServiceDump when mesh gateway is not used. [GH-20168]
• ProxyCfg: only return the nodes list when querying the Internal.ServiceDump watch from proxycfg [GH-20168]
• Upgrade to use Go 1.21.7. [GH-20545]

BUG FIXES:

• audit-logs: (Enterprise Only) Fixes non ASCII characters in audit logs because of gzip. [GH-20345]
• connect: Fix issue where re-persisting existing proxy-defaults using http protocol fails with a protocol-mismatch error. [GH-20481]
• connect: Fix regression with SAN matching on terminating gateways GH-20360 [GH-20417]
• connect: Remove code coupling where the xDS capacity controller could negatively affect raft autopilot performance. [GH-20511]
• mesh: Fix bug where envoy extensions could not be configured with "permissive" mTLS mode. Note that envoy extensions currently do not apply to non-mTLS traffic in permissive mode. [GH-20406]