diff --git a/app/_data/products/mesh.yml b/app/_data/products/mesh.yml
index b465841170b..e9cafb586b8 100644
--- a/app/_data/products/mesh.yml
+++ b/app/_data/products/mesh.yml
@@ -56,7 +56,7 @@ releases:
     releaseDate: "2025-03-20"
     eol: "2026-03-20"
     branch: release-2.10
-  - version: 2.11.19
+  - version: 2.11.20
     release: "2.11"
     releaseDate: "2025-06-10"
     eol: "2026-12-10"
@@ -67,17 +67,24 @@ releases:
     releaseDate: "2025-09-09"
     eol: "2026-09-09"
     branch: release-2.12
-  - version: 2.13.11
+  - version: 2.13.12
     release: "2.13"
     releaseDate: "2025-12-22"
     eol: "2027-12-22"
     branch: release-2.13
     lts: true
-  - version: 2.14.6
+  - version: 2.14.7
     release: "2.14"
-    latest: true
+    releaseDate: "2026-06-12"
+    eol: "2027-06-12"
     branch: release-2.14
-  - version: preview
+  - version: 3.0.1
     release: "3.0"
+    latest: true
+    releaseDate: "2026-10-15"
+    eol: "2027-10-15"
+    branch: release-3.0
+  - version: preview
+    release: "3.1"
     branch: master
     label: dev
diff --git a/app/assets/mesh/3.0.x/raw/helm-values-prod/values.global-cp.yaml b/app/assets/mesh/3.0.x/raw/helm-values-prod/values.global-cp.yaml
index 09980efac9b..9ff58b2e229 100644
--- a/app/assets/mesh/3.0.x/raw/helm-values-prod/values.global-cp.yaml
+++ b/app/assets/mesh/3.0.x/raw/helm-values-prod/values.global-cp.yaml
@@ -1,48 +1,76 @@
+# Production profile for a universal Global Control Plane hosted on Kubernetes.
+# Prepare an external Postgres database and all referenced Secrets in the
+# installation namespace (kong-mesh-system in the examples) before installing.
 kuma:
   controlPlane:
     mode: "global"
+    environment: "universal"
 
     tls:
       apiServer:
-        # (action): please prepare the content of this secret before installing Kong Mesh
-        # it contains the keys "tls.crt" and "tls.key", and the content items should be in "PEM" format
-        # more details on preparing certificates: https://docs.konghq.com/mesh/latest/production/secure-deployment/certificates/
+        # (action): create this Secret with PEM-encoded tls.crt and tls.key.
+        # The certificate must cover the hostname used by API clients.
+        # kubectl create -n kong-mesh-system secret tls kong-mesh-apiserver-tls --cert=$API_SERVER_CERT_FILE --key=$API_SERVER_KEY_FILE
         secretName: kong-mesh-apiserver-tls
-      kdsGlobalServer:
-        # (action): please prepare the content of this secret before installing Kong Mesh
-        # it contains the keys "ca.crt", "tls.crt" and "tls.key", and the content items should be in "PEM" format
-        # more details on preparing certificates: https://docs.konghq.com/mesh/latest/production/secure-deployment/certificates/
-        secretName: kong-mesh-kds-global-server-tls
-
-    apiServer:
-      corsAllowedDomains:
-        # change these values you want to access the control plane API server or Mesh GUI from a custom domain
-        - https://localhost:5682
-      # if you want to access the API server using the HTTP port, add the following line
-      # - http://localhost:5681
 
     defaults:
-      # change these values if you want to open the admin access rights of control plane API server to more groups
+      # Add the groups or users that should administer this control plane.
+      # Keep mesh-system:admin so the bootstrapped admin token can be used.
+      # Kubernetes administrator groups do not apply in universal mode.
       adminRoleGroups:
         - mesh-system:admin
-        - system:masters
-        - kubeadm:cluster-admins
 
     envVars:
-      # if you want to access the API server using the HTTP port, change the following switch to "true"
+      # Use HTTPS for API access. Configure clients with the API certificate CA.
       KUMA_API_SERVER_HTTP_ENABLED: "false"
+      # CORS stays disabled by default. Set KUMA_API_SERVER_CORS_ALLOWED_DOMAINS
+      # to explicit trusted origins only if cross-origin API access is needed.
+
+      # Each Zone CP must present a zone token and trust the KDS certificate CA.
+      # Generate tokens with kumactl generate zone-token --zone <zone-name> --scope cp.
+      KUMA_MULTIZONE_GLOBAL_KDS_AUTH_TYPE: zoneToken
+      KUMA_MULTIZONE_GLOBAL_KDS_TLS_CERT_FILE: /var/run/secrets/kuma.io/kds-global/tls.crt
+      KUMA_MULTIZONE_GLOBAL_KDS_TLS_KEY_FILE: /var/run/secrets/kuma.io/kds-global/tls.key
+
+      # (action): replace these values with the external database connection details.
+      # Create the database first and give this user permissions to run migrations;
+      # the chart runs migrations in an init container before starting the CP.
+      # The host must match the Postgres server certificate for verifyFull below.
+      KUMA_STORE_POSTGRES_HOST: postgres.example.com
+      KUMA_STORE_POSTGRES_USER: kuma
+      KUMA_STORE_POSTGRES_DB_NAME: kuma
 
     secrets:
-      # (action): please prepare the content of this secret before installing Kong Mesh
-      # to obtain this license, please contact your Kong Account Manager and import it into your cluster:
-      # kubectl create  -n kong-mesh-system secret generic kong-mesh-license --from-file license.json=$KMESH_LICENSE_FILE
+      # (action): obtain a license from your Kong Account Manager and create this Secret.
+      # kubectl create -n kong-mesh-system secret generic kong-mesh-license --from-file license.json=$KMESH_LICENSE_FILE
       - Secret: kong-mesh-license
         Key: license.json
         Env: KMESH_LICENSE_INLINE
+      # (action): create this Secret with the database user's password.
+      # kubectl create -n kong-mesh-system secret generic kong-mesh-postgres --from-file password=$POSTGRES_PASSWORD_FILE
+      - Secret: kong-mesh-postgres
+        Key: password
+        Env: KUMA_STORE_POSTGRES_PASSWORD
+
+    extraSecrets:
+      kdsGlobal:
+        # (action): create this Secret with PEM-encoded tls.crt and tls.key.
+        # The certificate must cover the hostname used by Zone CPs to connect.
+        # Distribute its signing CA to the Zone CPs as their KDS trusted CA.
+        # kubectl create -n kong-mesh-system secret tls kong-mesh-kds-global-tls --cert=$KDS_CERT_FILE --key=$KDS_KEY_FILE
+        name: kong-mesh-kds-global-tls
+        mountPath: /var/run/secrets/kuma.io/kds-global
+        readOnly: true
+
+    globalZoneSyncService:
+      enabled: true
+      # (action): choose how Zone CPs reach this service. Adapt the service type,
+      # annotations and allowed source ranges to your load balancer and network.
+      # Zone CPs connect to grpcs://<global-kds-hostname>:5685.
+      type: LoadBalancer
+      port: 5685
 
-    # please tune the resource allocation according to your actual mesh size and traffic load after Kong Mesh is installed
-    # try to make the resource limits identical to requests to make components are assigned as a QoS class of Guaranteed
-    # more details on sizing the CP: https://docs.konghq.com/mesh/latest/introduction/kuma-requirements/#sizing-your-control-plane
+    # Tune resources according to mesh size and load after installation.
     resources:
       requests:
         cpu: 1000m
@@ -51,10 +79,13 @@ kuma:
         cpu: 1000m
         memory: 1024Mi
 
+    # replicas is used when autoscaling is disabled; otherwise minReplicas applies.
     replicas: 2
     autoscaling:
+      # Requires a working Kubernetes resource metrics API (usually Metrics Server).
       enabled: true
-
+      minReplicas: 2
+      maxReplicas: 5
       metrics:
         - type: Resource
           resource:
@@ -69,6 +100,16 @@ kuma:
               type: Utilization
               averageUtilization: 50
 
-
     podDisruptionBudget:
-      enabled: true
\ No newline at end of file
+      enabled: true
+      maxUnavailable: 1
+
+  postgres:
+    port: "5432"
+    tls:
+      mode: verifyFull
+      # (action): create this Secret with the PEM-encoded Postgres signing CA.
+      # kubectl create -n kong-mesh-system secret generic kong-mesh-postgres-ca --from-file ca.crt=$POSTGRES_CA_FILE
+      caSecretName: kong-mesh-postgres-ca
+      # If Postgres requires client certificates, create a Secret with tls.crt
+      # and tls.key and set postgres.tls.secretName to its name.
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_containerpatches.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_containerpatches.yaml
index b772e8bdbda..5937a4f2d05 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_containerpatches.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_containerpatches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: containerpatches.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_dataplaneinsights.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_dataplaneinsights.yaml
index 0e40c63b7d5..d1861c8ad90 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_dataplaneinsights.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_dataplaneinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: dataplaneinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_dataplanes.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_dataplanes.yaml
index 958ac8a37f1..9e16a4a9a4d 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_dataplanes.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_dataplanes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: dataplanes.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_hostnamegenerators.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_hostnamegenerators.yaml
index 35857db357e..cd1537408e5 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_hostnamegenerators.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_hostnamegenerators.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: hostnamegenerators.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshaccesslogs.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshaccesslogs.yaml
index 899f95555ed..fb85872f739 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshaccesslogs.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshaccesslogs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshaccesslogs.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshcircuitbreakers.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshcircuitbreakers.yaml
index acd54ca5f2a..78c2bdc7e4c 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshcircuitbreakers.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshcircuitbreakers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshcircuitbreakers.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshes.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshes.yaml
index 75f748b6717..e8a65e5cf03 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshes.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshes.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshexternalservices.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshexternalservices.yaml
index dc8a2574719..c424ea5b4af 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshexternalservices.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshexternalservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshexternalservices.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshfaultinjections.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshfaultinjections.yaml
index 3f37cb91701..f2003fac9ad 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshfaultinjections.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshfaultinjections.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshfaultinjections.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshhealthchecks.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshhealthchecks.yaml
index 955ce4eed62..a5e4836a046 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshhealthchecks.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshhealthchecks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshhealthchecks.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshhttproutes.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshhttproutes.yaml
index 6e4ffe8c5b1..7a436b59d4a 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshhttproutes.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshhttproutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshhttproutes.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshidentities.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshidentities.yaml
index 7ee178d9473..a29eeb33def 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshidentities.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshidentities.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshidentities.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshinsights.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshinsights.yaml
index 94dbee1b631..adcca716f84 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshinsights.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshloadbalancingstrategies.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshloadbalancingstrategies.yaml
index 1939bf51fc4..b9c69e789e8 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshloadbalancingstrategies.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshloadbalancingstrategies.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshloadbalancingstrategies.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshmetrics.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshmetrics.yaml
index d7d98aef4d5..43160b24b4a 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshmetrics.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshmetrics.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshmetrics.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshmultizoneservices.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshmultizoneservices.yaml
index fdabbbdc81f..a14ad6e2317 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshmultizoneservices.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshmultizoneservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshmultizoneservices.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshopas.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshopas.yaml
index 6cb88fb5973..e4b3822a97e 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshopas.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshopas.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshopas.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshopentelemetrybackends.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshopentelemetrybackends.yaml
index 86c9fa2f394..c21dfefd4a6 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshopentelemetrybackends.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshopentelemetrybackends.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshopentelemetrybackends.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshpassthroughs.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshpassthroughs.yaml
index 41da6ca8e39..c83445d11dd 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshpassthroughs.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshpassthroughs.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshpassthroughs.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshproxypatches.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshproxypatches.yaml
index 653a8fb1b0e..6360edce044 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshproxypatches.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshproxypatches.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshproxypatches.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshratelimits.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshratelimits.yaml
index 9bfbb03ecbc..bbc53d9248d 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshratelimits.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshratelimits.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshratelimits.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshretries.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshretries.yaml
index cf42c5ca769..7731c4f5ae5 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshretries.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshretries.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshretries.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshservices.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshservices.yaml
index c0fd8671687..5bf2580b77c 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshservices.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshservices.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshservices.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshtcproutes.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshtcproutes.yaml
index 062128f10e3..1948d1744fb 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshtcproutes.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshtcproutes.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshtcproutes.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshtimeouts.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshtimeouts.yaml
index 4ba499ff02a..b5c1c5d17a7 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshtimeouts.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshtimeouts.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshtimeouts.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshtlses.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshtlses.yaml
index 15a41ed65fd..79c02ece372 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshtlses.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshtlses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshtlses.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshtraces.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshtraces.yaml
index a1a18540dbb..c7746dc126b 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshtraces.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshtraces.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshtraces.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshtrafficpermissions.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshtrafficpermissions.yaml
index 353afd66241..4d53b018251 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshtrafficpermissions.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshtrafficpermissions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshtrafficpermissions.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshtrusts.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshtrusts.yaml
index 06b37288be6..f0ec4cf9036 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshtrusts.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshtrusts.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshtrusts.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_meshzoneaddresses.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_meshzoneaddresses.yaml
index 28d2bc91f4b..c80e55717d7 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_meshzoneaddresses.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_meshzoneaddresses.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: meshzoneaddresses.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_workloads.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_workloads.yaml
index cba405b90d5..a435b499db2 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_workloads.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_workloads.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: workloads.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_zoneinsights.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_zoneinsights.yaml
index 2f4a8027400..38ffb96f49b 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_zoneinsights.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_zoneinsights.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: zoneinsights.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/dev/raw/crds/kuma.io_zones.yaml b/app/assets/mesh/dev/raw/crds/kuma.io_zones.yaml
index e36cdbc2256..1f3cfcfa4db 100644
--- a/app/assets/mesh/dev/raw/crds/kuma.io_zones.yaml
+++ b/app/assets/mesh/dev/raw/crds/kuma.io_zones.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: zones.kuma.io
 spec:
   group: kuma.io
diff --git a/app/assets/mesh/raw/CHANGELOG.md b/app/assets/mesh/raw/CHANGELOG.md
index 89172ed01cb..0da37057752 100644
--- a/app/assets/mesh/raw/CHANGELOG.md
+++ b/app/assets/mesh/raw/CHANGELOG.md
@@ -1,6 +1,503 @@
 # Changelog
 <!-- Autogenerated with (github.com/kumahq/ci-tools) release-tool changelog.md -->
 
+## 3.0.1
+> Released on 2026/10/30
+
+* Added a Helm production profile for a universal global control plane backed by Postgres. [#11184](https://github.com/Kong/kong-mesh/pull/11184) @lobkovilya
+* chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [#11338](https://github.com/Kong/kong-mesh/pull/11338) @renovate
+* chore(deps): bump kumahq/kuma from v3.0.0 to v3.0.1 [#11212](https://github.com/Kong/kong-mesh/pull/11212) [#11330](https://github.com/Kong/kong-mesh/pull/11330) [#11373](https://github.com/Kong/kong-mesh/pull/11373) @kong-mesh
+* chore(deps): use latest Kong/kong-mesh-gui [#11295](https://github.com/Kong/kong-mesh/pull/11295) [#11358](https://github.com/Kong/kong-mesh/pull/11358) @kong-mesh
+
+### Includes [kumahq/kuma@3.0.1](https://github.com/kumahq/kuma/releases/tag/3.0.1) changelog
+
+* chore(deps): bump envoy from 1.39.4 to 1.39.6 [#19247](https://github.com/kumahq/kuma/pull/19247) [#19285](https://github.com/kumahq/kuma/pull/19285) @lukidzi
+* chore(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [#19289](https://github.com/kumahq/kuma/pull/19289) @renovate
+* chore(deps): move distroless base images to debian13 (backport of #19224) [#19236](https://github.com/kumahq/kuma/pull/19236) @kumahq
+* chore(deps): move kuma-init to registry.k8s.io distroless-iptables v0.11.2 (backport of #19264) [#19276](https://github.com/kumahq/kuma/pull/19276) @kumahq
+* chore(deps): use latest kumahq/kuma-gui [#19212](https://github.com/kumahq/kuma/pull/19212) [#19284](https://github.com/kumahq/kuma/pull/19284) @kumahq
+* fix(kuma-cp): don't follow HTTP redirects (backport of #19248) [#19268](https://github.com/kumahq/kuma/pull/19268) @kumahq
+* fix(meshtrafficpermission): keep allow in shadow (backport of #19173) [#19265](https://github.com/kumahq/kuma/pull/19265) @kumahq
+
+
+## 2.14.7
+> Released on 2026/10/30
+
+* chore(deps): bump github.com/cert-manager/cert-manager from 1.20.2 to 1.20.3 [#11375](https://github.com/Kong/kong-mesh/pull/11375) @renovate
+* chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 [#11337](https://github.com/Kong/kong-mesh/pull/11337) @renovate
+* chore(deps): bump kumahq/kuma from v2.14.6 to v2.14.7 [#11179](https://github.com/Kong/kong-mesh/pull/11179) [#11214](https://github.com/Kong/kong-mesh/pull/11214) [#11316](https://github.com/Kong/kong-mesh/pull/11316) [#11346](https://github.com/Kong/kong-mesh/pull/11346) [#11369](https://github.com/Kong/kong-mesh/pull/11369) [#11372](https://github.com/Kong/kong-mesh/pull/11372) @kong-mesh
+* chore(deps): security issue in go-jose/go-jose/v4 via minor version upgrade from 4.1.4 to 4.1.6 [#11345](https://github.com/Kong/kong-mesh/pull/11345) @aikido-autofix
+* chore(deps): use latest Kong/kong-mesh-gui [#11347](https://github.com/Kong/kong-mesh/pull/11347) @kong-mesh
+* feat(tracing): export CP traces to Datadog agent (backport of #11313) [#11334](https://github.com/Kong/kong-mesh/pull/11334) @kong-mesh
+
+### Includes [kumahq/kuma@2.14.7](https://github.com/kumahq/kuma/releases/tag/2.14.7) changelog
+
+* chore(deps): bump coredns to v1.15.0 [#19300](https://github.com/kumahq/kuma/pull/19300) @lukidzi
+* chore(deps): bump envoy from 1.38.7 to 1.38.9 [#19246](https://github.com/kumahq/kuma/pull/19246) [#19282](https://github.com/kumahq/kuma/pull/19282) @lukidzi
+* chore(deps): bump golang.org/x/net from 0.60.0 to 0.62.0 [#19288](https://github.com/kumahq/kuma/pull/19288) @renovate
+* chore(deps): move distroless base images to debian13 (backport of #19224) [#19238](https://github.com/kumahq/kuma/pull/19238) @kumahq
+* chore(deps): move kuma-init to registry.k8s.io distroless-iptables v0.11.2 (backport of #19264) [#19274](https://github.com/kumahq/kuma/pull/19274) @kumahq
+* chore(deps): use latest kumahq/kuma-gui [#19213](https://github.com/kumahq/kuma/pull/19213) [#19293](https://github.com/kumahq/kuma/pull/19293) @kumahq
+* feat(kuma-cp): accept extra span processors (backport of #19218) [#19275](https://github.com/kumahq/kuma/pull/19275) @kumahq
+* fix(kds): only accept subscribed resource types (backport of #19062) [#19245](https://github.com/kumahq/kuma/pull/19245) @kumahq
+* fix(kuma-cp): don't follow HTTP redirects (backport of #19248) [#19270](https://github.com/kumahq/kuma/pull/19270) @kumahq
+* fix(meshaccesslog): restore OTel common_config for Envoy < 1.37 data planes [#19216](https://github.com/kumahq/kuma/pull/19216) @lobkovilya
+* fix(meshtrafficpermission): keep allow in shadow (backport of #19173) [#19234](https://github.com/kumahq/kuma/pull/19234) @kumahq
+* fix(xds): pick zone egress per client identity [#19278](https://github.com/kumahq/kuma/pull/19278) @lukidzi
+* fix(xds): skip DNS lookups on global control plane [#19229](https://github.com/kumahq/kuma/pull/19229) @Automaat
+
+
+## 2.13.12
+> Released on 2026/10/30
+
+* chore(deps): bump github.com/cert-manager/cert-manager from 1.19.3 to 1.19.6 [#11374](https://github.com/Kong/kong-mesh/pull/11374) @renovate
+* chore(deps): bump github.com/containerd/containerd/v2 from 2.2.8 to 2.2.9 [#10999](https://github.com/Kong/kong-mesh/pull/10999) @renovate
+* chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 [#11336](https://github.com/Kong/kong-mesh/pull/11336) @renovate
+* chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.43.0 to 1.45.0 [#10911](https://github.com/Kong/kong-mesh/pull/10911) @renovate
+* chore(deps): bump kumahq/kuma from v2.13.11 to v2.13.12 [#10854](https://github.com/Kong/kong-mesh/pull/10854) [#10880](https://github.com/Kong/kong-mesh/pull/10880) [#10894](https://github.com/Kong/kong-mesh/pull/10894) [#10945](https://github.com/Kong/kong-mesh/pull/10945) [#11085](https://github.com/Kong/kong-mesh/pull/11085) [#11098](https://github.com/Kong/kong-mesh/pull/11098) [#11158](https://github.com/Kong/kong-mesh/pull/11158) [#11215](https://github.com/Kong/kong-mesh/pull/11215) [#11329](https://github.com/Kong/kong-mesh/pull/11329) [#11353](https://github.com/Kong/kong-mesh/pull/11353) [#11362](https://github.com/Kong/kong-mesh/pull/11362) [#11371](https://github.com/Kong/kong-mesh/pull/11371) @kong-mesh
+* chore(deps): use latest Kong/kong-mesh-gui [#11365](https://github.com/Kong/kong-mesh/pull/11365) @kong-mesh
+* fix(vault): replace deprecated http2 transport [#11178](https://github.com/Kong/kong-mesh/pull/11178) @lukidzi
+
+### Includes [kumahq/kuma@2.13.12](https://github.com/kumahq/kuma/releases/tag/2.13.12) changelog
+
+* chore(deps): bump coredns to v1.15.0 [#19299](https://github.com/kumahq/kuma/pull/19299) @lukidzi
+* chore(deps): bump envoy from 1.36.10 to 1.37.11 [#19074](https://github.com/kumahq/kuma/pull/19074) [#19142](https://github.com/kumahq/kuma/pull/19142) [#19267](https://github.com/kumahq/kuma/pull/19267) [#19281](https://github.com/kumahq/kuma/pull/19281) @lukidzi
+* chore(deps): bump golang.org/x/net from 0.58.0 to 0.62.0 [#19033](https://github.com/kumahq/kuma/pull/19033) [#19287](https://github.com/kumahq/kuma/pull/19287) @renovate
+* chore(deps): move distroless base images to debian13 (backport of #19224) [#19239](https://github.com/kumahq/kuma/pull/19239) @kumahq
+* chore(deps): move kuma-init to registry.k8s.io distroless-iptables v0.11.2 (backport of #19264) [#19273](https://github.com/kumahq/kuma/pull/19273) @kumahq
+* chore(deps): security update [#18778](https://github.com/kumahq/kuma/pull/18778) @kumahq
+* chore(deps): use latest kumahq/kuma-gui [#19295](https://github.com/kumahq/kuma/pull/19295) @kumahq
+* feat(kds): name the resource type and size of the largest response when a KDS stream fails with ResourceExhausted [#18838](https://github.com/kumahq/kuma/pull/18838) @kumahq
+* fix(api-server): check origin label on delete (backport of #16826) [#18994](https://github.com/kumahq/kuma/pull/18994) @bartsmykla
+* fix(api-server): make kuma.io/origin immutable (backport of #18412) [#18992](https://github.com/kumahq/kuma/pull/18992) @bartsmykla
+* fix(insights): don't mark data plane proxies as degraded because of ignored inbounds [#18736](https://github.com/kumahq/kuma/pull/18736) @Automaat
+* fix(k8s): drop reserved pod labels from Dataplanes (backport of #18648) [#18997](https://github.com/kumahq/kuma/pull/18997) @bartsmykla
+* fix(k8s): read system-namespace-only resources from the system namespace only (backport of #19051) [#19130](https://github.com/kumahq/kuma/pull/19130) @kumahq
+* fix(kds): only accept subscribed resource types (backport of #19062) [#19243](https://github.com/kumahq/kuma/pull/19243) @kumahq
+* fix(kuma-cp): don't follow HTTP redirects (backport of #19248) [#19269](https://github.com/kumahq/kuma/pull/19269) @kumahq
+* fix(meshpassthrough): correct typo on 2.13 [#18881](https://github.com/kumahq/kuma/pull/18881) @lukidzi
+* fix(meshtrafficpermission): keep allow in shadow (backport of #19173) [#19233](https://github.com/kumahq/kuma/pull/19233) @kumahq
+* fix(store): keep labels on the resource after a postgres update (backport of #18929) [#18938](https://github.com/kumahq/kuma/pull/18938) @kumahq
+* fix(xds): do not mutate the cached Dataplane (backport of #18008) [#18771](https://github.com/kumahq/kuma/pull/18771) @kumahq
+* fix(xds): pick up recreated same-name policies (backport of #18731) [#18744](https://github.com/kumahq/kuma/pull/18744) @kumahq
+* fix(xds): speed up Envoy stats tag extraction (backport of #18910) [#18912](https://github.com/kumahq/kuma/pull/18912) @kumahq
+
+
+## 2.11.20
+> Released on 2026/10/30
+
+* chore(deps): bump github.com/containerd/containerd/v2 from 2.2.8 to 2.2.9 [#10979](https://github.com/Kong/kong-mesh/pull/10979) @renovate
+* chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 [#11335](https://github.com/Kong/kong-mesh/pull/11335) @renovate
+* chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.43.0 to 1.45.0 [#10908](https://github.com/Kong/kong-mesh/pull/10908) @renovate
+* chore(deps): bump kumahq/kuma from v2.11.19 to v2.11.20 [#10897](https://github.com/Kong/kong-mesh/pull/10897) [#10970](https://github.com/Kong/kong-mesh/pull/10970) [#11012](https://github.com/Kong/kong-mesh/pull/11012) [#11084](https://github.com/Kong/kong-mesh/pull/11084) [#11095](https://github.com/Kong/kong-mesh/pull/11095) [#11157](https://github.com/Kong/kong-mesh/pull/11157) [#11217](https://github.com/Kong/kong-mesh/pull/11217) [#11328](https://github.com/Kong/kong-mesh/pull/11328) [#11348](https://github.com/Kong/kong-mesh/pull/11348) [#11366](https://github.com/Kong/kong-mesh/pull/11366) [#11370](https://github.com/Kong/kong-mesh/pull/11370) @kong-mesh
+* chore(deps): use latest Kong/kong-mesh-gui [#11368](https://github.com/Kong/kong-mesh/pull/11368) @kong-mesh
+
+### Includes [kumahq/kuma@2.11.20](https://github.com/kumahq/kuma/releases/tag/2.11.20) changelog
+
+* chore(deps): bump coredns to v1.15.0 [#19298](https://github.com/kumahq/kuma/pull/19298) @lukidzi
+* chore(deps): bump envoy from 1.36.10 to 1.37.11 [#19073](https://github.com/kumahq/kuma/pull/19073) [#19141](https://github.com/kumahq/kuma/pull/19141) [#19266](https://github.com/kumahq/kuma/pull/19266) [#19280](https://github.com/kumahq/kuma/pull/19280) @lukidzi
+* chore(deps): bump github.com/moby/sys/user from 0.3.0 to 0.4.1 [#19030](https://github.com/kumahq/kuma/pull/19030) @renovate
+* chore(deps): bump golang.org/x/net from 0.58.0 to 0.62.0 [#19031](https://github.com/kumahq/kuma/pull/19031) [#19286](https://github.com/kumahq/kuma/pull/19286) @renovate
+* chore(deps): move distroless base images to debian13 (backport of #19224) [#19237](https://github.com/kumahq/kuma/pull/19237) @kumahq
+* chore(deps): move kuma-init to registry.k8s.io distroless-iptables v0.11.2 (backport of #19264) [#19272](https://github.com/kumahq/kuma/pull/19272) @kumahq
+* chore(deps): security update [#18777](https://github.com/kumahq/kuma/pull/18777) @kumahq
+* chore(deps): use latest kumahq/kuma-gui [#19297](https://github.com/kumahq/kuma/pull/19297) @kumahq
+* fix(api-server): check origin label on delete (backport of #16826) [#18995](https://github.com/kumahq/kuma/pull/18995) @bartsmykla
+* fix(api-server): make kuma.io/origin immutable (backport of #18412) [#18993](https://github.com/kumahq/kuma/pull/18993) @bartsmykla
+* fix(k8s): drop reserved pod labels from Dataplanes (backport of #18648) [#18998](https://github.com/kumahq/kuma/pull/18998) @bartsmykla
+* fix(k8s): read system-namespace-only resources from the system namespace only (backport of #19051) [#19131](https://github.com/kumahq/kuma/pull/19131) @kumahq
+* fix(kds): only accept subscribed resource types (backport of #19062) [#19244](https://github.com/kumahq/kuma/pull/19244) @kumahq
+* fix(kuma-cp): don't follow HTTP redirects (backport of #19248) [#19271](https://github.com/kumahq/kuma/pull/19271) @kumahq
+* fix(store): keep labels on the resource after a postgres update (backport of #18929) [#18935](https://github.com/kumahq/kuma/pull/18935) @kumahq
+* fix(xds): do not mutate the cached Dataplane (backport of #18008) [#18770](https://github.com/kumahq/kuma/pull/18770) @kumahq
+* fix(xds): speed up Envoy stats tag extraction (backport of #18910) [#18917](https://github.com/kumahq/kuma/pull/18917) @kumahq
+
+
+## 3.0.0
+> Released on 2026/10/15
+
+* feat(api): serve Kong Mesh config on /config [#10961](https://github.com/Kong/kong-mesh/pull/10961) @lukidzi
+* feat(ca): increase default cert lifetime to 5 days [#10378](https://github.com/Kong/kong-mesh/pull/10378) @lukidzi
+* feat(deps)!: migrate module path to github.com/Kong/kong-mesh/v3 [#10000](https://github.com/Kong/kong-mesh/pull/10000) @Automaat
+* feat(konnect)!: remove POST /provision-zone [#10640](https://github.com/Kong/kong-mesh/pull/10640) @bartsmykla
+* feat(konnect): block /config [#10800](https://github.com/Kong/kong-mesh/pull/10800) @slonka
+* feat(konnect): block v3 CPs from the v1 API [#10801](https://github.com/Kong/kong-mesh/pull/10801) @slonka
+* feat(mink): set tenant version on create [#10056](https://github.com/Kong/kong-mesh/pull/10056) @slonka
+* feat(mink): tenants GET/PATCH [#10021](https://github.com/Kong/kong-mesh/pull/10021) @slonka
+* feat(oapi): add license to generated OAS [#10866](https://github.com/Kong/kong-mesh/pull/10866) @Automaat
+* feat(opa): remove legacy proto xDS config gen [#10105](https://github.com/Kong/kong-mesh/pull/10105) @lukidzi
+* feat(policy)!: remove MeshGlobalRateLimit [#10284](https://github.com/Kong/kong-mesh/pull/10284) @slonka
+* feat(postgres): add version column to tenants table [#10018](https://github.com/Kong/kong-mesh/pull/10018) @lobkovilya
+* feat(rbac)!: remove legacy AccessRole qualifiers [#11112](https://github.com/Kong/kong-mesh/pull/11112) @lukidzi
+* feat(rbac)!: stop granting admin to unauthenticated callers [#10678](https://github.com/Kong/kong-mesh/pull/10678) @bartsmykla
+* feat(rbac): expose KRI for RBAC resources [#10051](https://github.com/Kong/kong-mesh/pull/10051) @slonka
+* feat(rbac): match AccessRole targetRef by labels [#10144](https://github.com/Kong/kong-mesh/pull/10144) @bartsmykla
+* feat(rls): shard tenant work by version when CP versions share a database [#10058](https://github.com/Kong/kong-mesh/pull/10058) @slonka
+* fix(config): sanitize the Konnect client secret and RLS password [#10690](https://github.com/Kong/kong-mesh/pull/10690) @bartsmykla
+* fix(helm): name the current kubeadm admin group in the prod profiles [#10687](https://github.com/Kong/kong-mesh/pull/10687) @bartsmykla
+* fix(konnect): stop cross-org control plane deletion [#10675](https://github.com/Kong/kong-mesh/pull/10675) @bartsmykla
+* fix(kuma-cp): log control plane on startup [#10940](https://github.com/Kong/kong-mesh/pull/10940) @slonka
+* fix(kuma-cp): name the real skip-admin-role key [#10679](https://github.com/Kong/kong-mesh/pull/10679) @bartsmykla
+* fix(license): respect API server base path [#10002](https://github.com/Kong/kong-mesh/pull/10002) @Automaat
+* fix(meshidentity): avoid startup errors when cert-manager CRDs are not installed [#11036](https://github.com/Kong/kong-mesh/pull/11036) @lobkovilya
+* fix(meshidentity): drop cert-manager universal log [#10941](https://github.com/Kong/kong-mesh/pull/10941) @slonka
+* fix(meshopa): avoid panic on unset sendRawBody [#11122](https://github.com/Kong/kong-mesh/pull/11122) @lukidzi
+* fix(oapi): add kri to RBAC resource OAS schemas [#10128](https://github.com/Kong/kong-mesh/pull/10128) @slonka
+* fix(policies): drop gateway support in MeshGlobalRateLimit, MeshOPA [#10098](https://github.com/Kong/kong-mesh/pull/10098) @Automaat
+* fix(rbac): compute default RBAC resource labels [#10129](https://github.com/Kong/kong-mesh/pull/10129) @slonka
+* fix(rbac): decide a delete from the object it carries [#10685](https://github.com/Kong/kong-mesh/pull/10685) @bartsmykla
+* fix(rbac): gate /config on the access type made for it [#10683](https://github.com/Kong/kong-mesh/pull/10683) @bartsmykla
+* fix(rls): forget the organization when the tenant is deleted [#10688](https://github.com/Kong/kong-mesh/pull/10688) @bartsmykla
+* fix(rls): key the organization cache the way Postgres reads the id [#10738](https://github.com/Kong/kong-mesh/pull/10738) @bartsmykla
+* fix(rls): make a delete with no relation an actual no-op [#10737](https://github.com/Kong/kong-mesh/pull/10737) @bartsmykla
+* fix(rls): report the real error when a tenant delete fails [#10677](https://github.com/Kong/kong-mesh/pull/10677) @bartsmykla
+* konnect-authn now verifies token signatures against kauth's JWKS and requires `kmesh.konnect.authn.jwksPath` [#10358](https://github.com/Kong/kong-mesh/pull/10358) @bartsmykla
+* reject symlink escapes when writing the AWS IAM dataplane token, and create its directory traversable [#10375](https://github.com/Kong/kong-mesh/pull/10375) @bartsmykla
+* chore(deps): bump Kong shared-go [#11088](https://github.com/Kong/kong-mesh/pull/11088) @renovate
+* chore(deps): bump Kong/kong-mesh-v3-readiness from 0.4.0 to 0.5.0 [#10411](https://github.com/Kong/kong-mesh/pull/10411) @renovate
+* chore(deps): bump aws-sdk-go-v2 monorepo [#9899](https://github.com/Kong/kong-mesh/pull/9899) [#10239](https://github.com/Kong/kong-mesh/pull/10239) [#10397](https://github.com/Kong/kong-mesh/pull/10397) [#10466](https://github.com/Kong/kong-mesh/pull/10466) [#10832](https://github.com/Kong/kong-mesh/pull/10832) [#10933](https://github.com/Kong/kong-mesh/pull/10933) [#11023](https://github.com/Kong/kong-mesh/pull/11023) @renovate
+* chore(deps): bump cert-manager from 1.16.0 to 1.21.2 [#9907](https://github.com/Kong/kong-mesh/pull/9907) [#10160](https://github.com/Kong/kong-mesh/pull/10160) [#10398](https://github.com/Kong/kong-mesh/pull/10398) [#10825](https://github.com/Kong/kong-mesh/pull/10825) @renovate
+* chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from 487f66a to 72b5ad8 [#9895](https://github.com/Kong/kong-mesh/pull/9895) [#10337](https://github.com/Kong/kong-mesh/pull/10337) [#10822](https://github.com/Kong/kong-mesh/pull/10822) @renovate
+* chore(deps): bump github.com/DataDog/dd-trace-go/v2 from 2.5.0 to 2.8.1 [#10131](https://github.com/Kong/kong-mesh/pull/10131) @renovate
+* chore(deps): bump github.com/Kong/kauth-api from 1.178.0 to 1.181.0 [#10166](https://github.com/Kong/kong-mesh/pull/10166) [#10408](https://github.com/Kong/kong-mesh/pull/10408) [#10835](https://github.com/Kong/kong-mesh/pull/10835) @renovate
+* chore(deps): bump github.com/Kong/shared-go/identity from 1.48.0 to 1.57.0 [#9888](https://github.com/Kong/kong-mesh/pull/9888) [#10262](https://github.com/Kong/kong-mesh/pull/10262) [#10348](https://github.com/Kong/kong-mesh/pull/10348) [#10564](https://github.com/Kong/kong-mesh/pull/10564) [#10813](https://github.com/Kong/kong-mesh/pull/10813) [#10872](https://github.com/Kong/kong-mesh/pull/10872) [#10976](https://github.com/Kong/kong-mesh/pull/10976) @renovate
+* chore(deps): bump github.com/Kong/shared-go/rest/v2 from 2.18.0 to 2.20.0 [#10049](https://github.com/Kong/kong-mesh/pull/10049) [#10333](https://github.com/Kong/kong-mesh/pull/10333) [#10582](https://github.com/Kong/kong-mesh/pull/10582) [#10977](https://github.com/Kong/kong-mesh/pull/10977) @renovate
+* chore(deps): bump github.com/Kong/shared-go/slogdiscard from 1.2.0 to 1.2.2 [#10379](https://github.com/Kong/kong-mesh/pull/10379) [#11013](https://github.com/Kong/kong-mesh/pull/11013) @renovate
+* chore(deps): bump github.com/Kong/shared-go/zap-utils/v2 from 2.4.2 to 2.7.2 [#10050](https://github.com/Kong/kong-mesh/pull/10050) [#10380](https://github.com/Kong/kong-mesh/pull/10380) [#10978](https://github.com/Kong/kong-mesh/pull/10978) @renovate
+* chore(deps): bump github.com/aws/smithy-go from 1.27.3 to 1.28.5 [#9945](https://github.com/Kong/kong-mesh/pull/9945) [#10833](https://github.com/Kong/kong-mesh/pull/10833) [#11136](https://github.com/Kong/kong-mesh/pull/11136) @renovate
+* chore(deps): bump github.com/cert-manager/cert-manager from 1.20.2 to 1.21.2 [#10161](https://github.com/Kong/kong-mesh/pull/10161) [#10401](https://github.com/Kong/kong-mesh/pull/10401) [#10828](https://github.com/Kong/kong-mesh/pull/10828) @renovate
+* chore(deps): bump github.com/onsi/gomega from 1.43.1 to 1.44.0 [#10929](https://github.com/Kong/kong-mesh/pull/10929) @renovate
+* chore(deps): bump github.com/open-policy-agent/opa from 1.17.0 to 1.21.1 [#9940](https://github.com/Kong/kong-mesh/pull/9940) [#10409](https://github.com/Kong/kong-mesh/pull/10409) [#10836](https://github.com/Kong/kong-mesh/pull/10836) [#10930](https://github.com/Kong/kong-mesh/pull/10930) [#11029](https://github.com/Kong/kong-mesh/pull/11029) @renovate
+* chore(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0 [#10413](https://github.com/Kong/kong-mesh/pull/10413) [#10837](https://github.com/Kong/kong-mesh/pull/10837) @renovate
+* chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.45.0 [#10915](https://github.com/Kong/kong-mesh/pull/10915) @renovate
+* chore(deps): bump kumahq/kuma from 0fcd9c983f82 to v3.0.0 [#9929](https://github.com/Kong/kong-mesh/pull/9929) [#9952](https://github.com/Kong/kong-mesh/pull/9952) [#10005](https://github.com/Kong/kong-mesh/pull/10005) [#10007](https://github.com/Kong/kong-mesh/pull/10007) [#10013](https://github.com/Kong/kong-mesh/pull/10013) [#10023](https://github.com/Kong/kong-mesh/pull/10023) [#10025](https://github.com/Kong/kong-mesh/pull/10025) [#10055](https://github.com/Kong/kong-mesh/pull/10055) [#10072](https://github.com/Kong/kong-mesh/pull/10072) [#10073](https://github.com/Kong/kong-mesh/pull/10073) [#10108](https://github.com/Kong/kong-mesh/pull/10108) [#10116](https://github.com/Kong/kong-mesh/pull/10116) [#10135](https://github.com/Kong/kong-mesh/pull/10135) [#10145](https://github.com/Kong/kong-mesh/pull/10145) [#10174](https://github.com/Kong/kong-mesh/pull/10174) [#10178](https://github.com/Kong/kong-mesh/pull/10178) [#10254](https://github.com/Kong/kong-mesh/pull/10254) [#10256](https://github.com/Kong/kong-mesh/pull/10256) [#10260](https://github.com/Kong/kong-mesh/pull/10260) [#10277](https://github.com/Kong/kong-mesh/pull/10277) [#10286](https://github.com/Kong/kong-mesh/pull/10286) [#10288](https://github.com/Kong/kong-mesh/pull/10288) [#10297](https://github.com/Kong/kong-mesh/pull/10297) [#10381](https://github.com/Kong/kong-mesh/pull/10381) [#10390](https://github.com/Kong/kong-mesh/pull/10390) [#10391](https://github.com/Kong/kong-mesh/pull/10391) [#10419](https://github.com/Kong/kong-mesh/pull/10419) [#10420](https://github.com/Kong/kong-mesh/pull/10420) [#10496](https://github.com/Kong/kong-mesh/pull/10496) [#10507](https://github.com/Kong/kong-mesh/pull/10507) [#10518](https://github.com/Kong/kong-mesh/pull/10518) [#10523](https://github.com/Kong/kong-mesh/pull/10523) [#10535](https://github.com/Kong/kong-mesh/pull/10535) [#10552](https://github.com/Kong/kong-mesh/pull/10552) [#10559](https://github.com/Kong/kong-mesh/pull/10559) [#10562](https://github.com/Kong/kong-mesh/pull/10562) [#10570](https://github.com/Kong/kong-mesh/pull/10570) [#10576](https://github.com/Kong/kong-mesh/pull/10576) [#10580](https://github.com/Kong/kong-mesh/pull/10580) [#10584](https://github.com/Kong/kong-mesh/pull/10584) [#10586](https://github.com/Kong/kong-mesh/pull/10586) [#10600](https://github.com/Kong/kong-mesh/pull/10600) [#10602](https://github.com/Kong/kong-mesh/pull/10602) [#10615](https://github.com/Kong/kong-mesh/pull/10615) [#10630](https://github.com/Kong/kong-mesh/pull/10630) [#10633](https://github.com/Kong/kong-mesh/pull/10633) [#10745](https://github.com/Kong/kong-mesh/pull/10745) [#10753](https://github.com/Kong/kong-mesh/pull/10753) [#10758](https://github.com/Kong/kong-mesh/pull/10758) [#10768](https://github.com/Kong/kong-mesh/pull/10768) [#10773](https://github.com/Kong/kong-mesh/pull/10773) [#10774](https://github.com/Kong/kong-mesh/pull/10774) [#10863](https://github.com/Kong/kong-mesh/pull/10863) [#10868](https://github.com/Kong/kong-mesh/pull/10868) [#10869](https://github.com/Kong/kong-mesh/pull/10869) [#10876](https://github.com/Kong/kong-mesh/pull/10876) [#10896](https://github.com/Kong/kong-mesh/pull/10896) [#10916](https://github.com/Kong/kong-mesh/pull/10916) [#10942](https://github.com/Kong/kong-mesh/pull/10942) [#10959](https://github.com/Kong/kong-mesh/pull/10959) [#10962](https://github.com/Kong/kong-mesh/pull/10962) [#11004](https://github.com/Kong/kong-mesh/pull/11004) [#11007](https://github.com/Kong/kong-mesh/pull/11007) [#11010](https://github.com/Kong/kong-mesh/pull/11010) [#11038](https://github.com/Kong/kong-mesh/pull/11038) [#11039](https://github.com/Kong/kong-mesh/pull/11039) [#11047](https://github.com/Kong/kong-mesh/pull/11047) [#11058](https://github.com/Kong/kong-mesh/pull/11058) [#11093](https://github.com/Kong/kong-mesh/pull/11093) [#11160](https://github.com/Kong/kong-mesh/pull/11160) [#11167](https://github.com/Kong/kong-mesh/pull/11167) [#11173](https://github.com/Kong/kong-mesh/pull/11173) [#11175](https://github.com/Kong/kong-mesh/pull/11175) [#11177](https://github.com/Kong/kong-mesh/pull/11177) [#11180](https://github.com/Kong/kong-mesh/pull/11180) [#11185](https://github.com/Kong/kong-mesh/pull/11185) [#11188](https://github.com/Kong/kong-mesh/pull/11188) @bartsmykla,@kong-mesh,@lobkovilya
+* chore(deps): bump opentelemetry-go-contrib monorepo from 0.71.0 to 0.72.0 [#11031](https://github.com/Kong/kong-mesh/pull/11031) @renovate
+* chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 [#10092](https://github.com/Kong/kong-mesh/pull/10092) @renovate
+* chore(deps): bump registry.access.redhat.com/ubi9-minimal from 9.8-1780378819 to 9.8-1791808450 [#9968](https://github.com/Kong/kong-mesh/pull/9968) [#10404](https://github.com/Kong/kong-mesh/pull/10404) [#10471](https://github.com/Kong/kong-mesh/pull/10471) [#10829](https://github.com/Kong/kong-mesh/pull/10829) [#10932](https://github.com/Kong/kong-mesh/pull/10932) [#11026](https://github.com/Kong/kong-mesh/pull/11026) [#11139](https://github.com/Kong/kong-mesh/pull/11139) @renovate
+* chore(deps): security update [#10668](https://github.com/Kong/kong-mesh/pull/10668) [#10926](https://github.com/Kong/kong-mesh/pull/10926) @kong-mesh
+* chore(deps): use latest Kong/kong-mesh-gui [#9881](https://github.com/Kong/kong-mesh/pull/9881) [#10006](https://github.com/Kong/kong-mesh/pull/10006) [#10107](https://github.com/Kong/kong-mesh/pull/10107) [#10250](https://github.com/Kong/kong-mesh/pull/10250) [#10285](https://github.com/Kong/kong-mesh/pull/10285) [#10439](https://github.com/Kong/kong-mesh/pull/10439) [#10534](https://github.com/Kong/kong-mesh/pull/10534) [#10551](https://github.com/Kong/kong-mesh/pull/10551) [#10579](https://github.com/Kong/kong-mesh/pull/10579) [#10637](https://github.com/Kong/kong-mesh/pull/10637) [#10771](https://github.com/Kong/kong-mesh/pull/10771) [#10784](https://github.com/Kong/kong-mesh/pull/10784) [#10797](https://github.com/Kong/kong-mesh/pull/10797) [#10874](https://github.com/Kong/kong-mesh/pull/10874) [#10887](https://github.com/Kong/kong-mesh/pull/10887) [#10918](https://github.com/Kong/kong-mesh/pull/10918) [#10958](https://github.com/Kong/kong-mesh/pull/10958) [#10994](https://github.com/Kong/kong-mesh/pull/10994) [#11104](https://github.com/Kong/kong-mesh/pull/11104) [#11186](https://github.com/Kong/kong-mesh/pull/11186) @kong-mesh
+
+### Includes [kumahq/kuma@3.0.0](https://github.com/kumahq/kuma/releases/tag/3.0.0) changelog
+
+* chore(helm): the control plane and hook containers now drop all Linux capabilities and disallow privilege escalation [#18124](https://github.com/kumahq/kuma/pull/18124) @bartsmykla
+* control plane now computes the kuma.io/display-name label for all resources [#17162](https://github.com/kumahq/kuma/pull/17162) @lobkovilya
+* feat(api-server)!: remove legacy overview paths [#18367](https://github.com/kumahq/kuma/pull/18367) @Automaat
+* feat(api-server)!: remove legacy policies endpoint [#18375](https://github.com/kumahq/kuma/pull/18375) @Automaat
+* feat(api-server)!: remove ServiceInsight endpoints [#18376](https://github.com/kumahq/kuma/pull/18376) @Automaat
+* feat(api-server): add `isInsight` and `adminOnly` to `_resources` entries [#18544](https://github.com/kumahq/kuma/pull/18544) @Automaat
+* feat(api-server): add clusters to layout listeners [#18353](https://github.com/kumahq/kuma/pull/18353) @Automaat
+* feat(api-server): add create-only resource endpoints [#18990](https://github.com/kumahq/kuma/pull/18990) @lobkovilya
+* feat(api-server): add KRI overview endpoint [#18351](https://github.com/kumahq/kuma/pull/18351) @Automaat
+* feat(api-server): add mesh _overview endpoints [#18349](https://github.com/kumahq/kuma/pull/18349) @Automaat
+* feat(api-server): add pluggable per-route metadata provider [#17365](https://github.com/kumahq/kuma/pull/17365) @bartsmykla
+* feat(api-server): filter overviews by status [#18352](https://github.com/kumahq/kuma/pull/18352) @Automaat
+* feat(api-server): remove cross-mesh resource listing [#18999](https://github.com/kumahq/kuma/pull/18999) @Automaat
+* feat(api-server): remove legacy per-policy inspect endpoints [#18405](https://github.com/kumahq/kuma/pull/18405) @Automaat
+* feat(ca): increase default cert lifetime to 5 days [#17878](https://github.com/kumahq/kuma/pull/17878) @lukidzi
+* feat(config)!: remove experimental auto reachable services [#17200](https://github.com/kumahq/kuma/pull/17200) @Automaat
+* feat(db): add tolerateNewerDBVersions flag [#17019](https://github.com/kumahq/kuma/pull/17019) @slonka
+* feat(defaults)!: stop auto-creating default TrafficPermission/TrafficRoute [#17316](https://github.com/kumahq/kuma/pull/17316) @Automaat
+* feat(deps)!: migrate module path to /v3 [#16997](https://github.com/kumahq/kuma/pull/16997) @Automaat
+* feat(dns)!: remove CoreDNS from data plane [#17230](https://github.com/kumahq/kuma/pull/17230) @lukidzi
+* feat(dp)!: select reachableBackends by labels only [#18832](https://github.com/kumahq/kuma/pull/18832) @lukidzi
+* feat(gateway)!: drop legacy connection policies + GatewayRoute [#17446](https://github.com/kumahq/kuma/pull/17446) @Automaat
+* feat(gatewayapi): accept MeshService as parent and backend ref [#18013](https://github.com/kumahq/kuma/pull/18013) @Automaat
+* feat(gatewayapi): honor parentRef port names [#18051](https://github.com/kumahq/kuma/pull/18051) @Automaat
+* feat(gatewayapi): route mesh gRPC traffic with GRPCRoute [#18280](https://github.com/kumahq/kuma/pull/18280) @Automaat
+* feat(helm): configurable zone proxy probes [#17228](https://github.com/kumahq/kuma/pull/17228) @lukidzi
+* feat(intercp): add version to catalog instance [#17164](https://github.com/kumahq/kuma/pull/17164) @slonka
+* feat(kds): add zone-version header to KDS client [#17670](https://github.com/kumahq/kuma/pull/17670) @lobkovilya
+* feat(kds): authenticate zones with zone token [#18803](https://github.com/kumahq/kuma/pull/18803) @lukidzi
+* feat(kds): name the resource type and size of the largest response when a KDS stream fails with ResourceExhausted [#18727](https://github.com/kumahq/kuma/pull/18727) @lukidzi
+* feat(kds): stop syncing zone token secrets [#18855](https://github.com/kumahq/kuma/pull/18855) @lukidzi
+* feat(kubernetes): reject global mode in bootstrap on k8s [#17479](https://github.com/kumahq/kuma/pull/17479) @Automaat
+* feat(kuma-cp)!: remove inbound tags from Dataplane [#17867](https://github.com/kumahq/kuma/pull/17867) @Automaat
+* feat(kuma-cp): default DPP refresh interval to 10s [#18384](https://github.com/kumahq/kuma/pull/18384) @lukidzi
+* feat(kuma-cp): default inboundTagsDisabled to true [#17596](https://github.com/kumahq/kuma/pull/17596) @Automaat
+* feat(kuma-cp): reject fields not in the schema on resource write [#18858](https://github.com/kumahq/kuma/pull/18858) @bartsmykla
+* feat(kuma-cp): reload TLS certs without restart [#17882](https://github.com/kumahq/kuma/pull/17882) @lukidzi
+* feat(kuma-dp): default unifiedResourceNaming to true [#17483](https://github.com/kumahq/kuma/pull/17483) @Automaat
+* feat(kuma-dp): log resolved DNS queries, and add a per-component log level for kuma-dp [#18554](https://github.com/kumahq/kuma/pull/18554) @Automaat
+* feat(labels): compute `kuma.io/origin` on global and zone control planes [#17176](https://github.com/kumahq/kuma/pull/17176) @lobkovilya
+* feat(labels): drop the legacy proxy label scrub from Compute [#18753](https://github.com/kumahq/kuma/pull/18753) @lobkovilya
+* feat(labels): enforce `kuma.io/origin` and `kuma.io/zone` on read [#18579](https://github.com/kumahq/kuma/pull/18579) @lobkovilya
+* feat(labels): reject a control-plane-owned label whose value differs from the computed one [#18760](https://github.com/kumahq/kuma/pull/18760) @lobkovilya
+* feat(labels): reject unknown reserved keys and validate user-settable label values on every write [#18759](https://github.com/kumahq/kuma/pull/18759) @lobkovilya
+* feat(mads): restrict to universal deployment mode [#17868](https://github.com/kumahq/kuma/pull/17868) @Automaat
+* feat(mesh)!: remove kuma.io/service tag [#18392](https://github.com/kumahq/kuma/pull/18392) @Automaat
+* feat(mesh)!: remove legacy policy resource definitions [#17484](https://github.com/kumahq/kuma/pull/17484) @Automaat
+* feat(mesh): default nil meshServices to Exclusive [#17102](https://github.com/kumahq/kuma/pull/17102) @Automaat
+* feat(mesh): remove meshServices.mode API from Mesh [#17476](https://github.com/kumahq/kuma/pull/17476) @Automaat
+* feat(meshhttproute): support backend request header modifiers [#18278](https://github.com/kumahq/kuma/pull/18278) @Automaat
+* feat(meshidentity): make the SPIFFE ID immutable [#18669](https://github.com/kumahq/kuma/pull/18669) @Automaat
+* feat(meshidentity): validate user-supplied CAs [#17930](https://github.com/kumahq/kuma/pull/17930) @lukidzi
+* feat(meshpassthrough)!: default to None [#18842](https://github.com/kumahq/kuma/pull/18842) @lukidzi
+* feat(meshtls): remove deprecated from[] [#17598](https://github.com/kumahq/kuma/pull/17598) @lukidzi
+* feat(motb): deprecate inline OTel endpoint [#16023](https://github.com/kumahq/kuma/pull/16023) @bartsmykla
+* feat(policy)!: drop MeshAccessLog OTel Endpoint for BackendRef [#17564](https://github.com/kumahq/kuma/pull/17564) @Automaat
+* feat(policy)!: remove deprecated from[] from MeshCircuitBreaker [#17570](https://github.com/kumahq/kuma/pull/17570) @Automaat
+* feat(policy): MLBS on zone proxy egress [#17718](https://github.com/kumahq/kuma/pull/17718) @lukidzi
+* feat(readiness): gate on identity cert [#18558](https://github.com/kumahq/kuma/pull/18558) @Automaat
+* feat(resources)!: enforce RFC 1035 names [#18026](https://github.com/kumahq/kuma/pull/18026) @lukidzi
+* feat(store)!: always enable resource store cache [#18729](https://github.com/kumahq/kuma/pull/18729) @Automaat
+* feat(tproxy): remove eBPF transparent proxy feature [#17225](https://github.com/kumahq/kuma/pull/17225) @lukidzi
+* feat(validation): restrict crossZone to MeshMultizoneService [#18210](https://github.com/kumahq/kuma/pull/18210) @Automaat
+* feat(xds)!: default reachableBackends to empty [#18831](https://github.com/kumahq/kuma/pull/18831) @lukidzi
+* feat(xds)!: drop legacy CircuitBreaker from xDS generation [#17345](https://github.com/kumahq/kuma/pull/17345) @Automaat
+* feat(xds)!: drop legacy HealthCheck from xDS generation [#17324](https://github.com/kumahq/kuma/pull/17324) @Automaat
+* feat(xds)!: drop legacy Timeout consumption from xDS generation [#17398](https://github.com/kumahq/kuma/pull/17398) @Automaat
+* feat(xds)!: drop RateLimit from xDS generation [#17323](https://github.com/kumahq/kuma/pull/17323) @Automaat
+* feat(xds)!: drop TrafficPermission from xDS generation [#17428](https://github.com/kumahq/kuma/pull/17428) @Automaat
+* feat(xds)!: drop TrafficRoute from xDS generation [#17423](https://github.com/kumahq/kuma/pull/17423) @Automaat
+* feat(xds)!: drop TrafficTrace from xDS generation [#17384](https://github.com/kumahq/kuma/pull/17384) @Automaat
+* feat(xds)!: drop VirtualOutbound from xDS generation [#17415](https://github.com/kumahq/kuma/pull/17415) @Automaat
+* feat(xds): add mesh context build duration metric [#18685](https://github.com/kumahq/kuma/pull/18685) @Automaat
+* feat(xds): make delta xDS the default and remove SOTW [#17040](https://github.com/kumahq/kuma/pull/17040) @Automaat
+* feat(xds): unified-name for empty listener tags [#17563](https://github.com/kumahq/kuma/pull/17563) @lukidzi
+* feat(xds): warn on stream close after large send [#16784](https://github.com/kumahq/kuma/pull/16784) @Automaat
+* fix API server configuration error aggregation [#18421](https://github.com/kumahq/kuma/pull/18421) @Automaat
+* fix applying resources whose name is longer than 63 characters on Universal [#18336](https://github.com/kumahq/kuma/pull/18336) @lobkovilya
+* fix malformed API label filters [#18420](https://github.com/kumahq/kuma/pull/18420) @Automaat
+* fix(api): align HTTP API with its error schema [#19155](https://github.com/kumahq/kuma/pull/19155) @kumahq
+* fix(api-server)!: match layout to generated xDS [#18837](https://github.com/kumahq/kuma/pull/18837) @lukidzi
+* fix(api-server): align catalog writability [#18449](https://github.com/kumahq/kuma/pull/18449) @Automaat
+* fix(api-server): always render `zone` in a zone overview [#18663](https://github.com/kumahq/kuma/pull/18663) @Automaat
+* fix(api-server): check kuma.io/origin on federated zones for every resource type [#18698](https://github.com/kumahq/kuma/pull/18698) @lobkovilya
+* fix(api-server): inline REST for non-proto specs [#18545](https://github.com/kumahq/kuma/pull/18545) @Automaat
+* fix(api-server): make kuma.io/origin immutable and reject writes to foreign-origin resources [#18412](https://github.com/kumahq/kuma/pull/18412) @lobkovilya
+* fix(api-server): make startup transactional [#18423](https://github.com/kumahq/kuma/pull/18423) @Automaat
+* fix(api-server): reject kuma.io/zone on Global and validate kuma.io/mesh on every mode [#18419](https://github.com/kumahq/kuma/pull/18419) @lobkovilya
+* fix(api-server): rules panic and role validation [#16978](https://github.com/kumahq/kuma/pull/16978) @Automaat
+* fix(api-server): send Content-Type on GUI fallback responses [#18399](https://github.com/kumahq/kuma/pull/18399) @Automaat
+* fix(api-server): validate name path parameters [#19156](https://github.com/kumahq/kuma/pull/19156) @kumahq
+* fix(auth): require workload-bound token for workload-derived identity [#17474](https://github.com/kumahq/kuma/pull/17474) @bartsmykla
+* fix(charts): drain zone egress before shutdown [#18568](https://github.com/kumahq/kuma/pull/18568) @lukidzi
+* fix(charts): drain zone ingress before shutdown [#18950](https://github.com/kumahq/kuma/pull/18950) @lukidzi
+* fix(config): enforce RFC1123 compliance for zone names [#18011](https://github.com/kumahq/kuma/pull/18011) @Automaat
+* fix(dashboards): use labels emitted by kuma-dp [#18574](https://github.com/kumahq/kuma/pull/18574) @lukidzi
+* fix(dataplane): reject unknown enum values [#19111](https://github.com/kumahq/kuma/pull/19111) @kumahq
+* fix(gatewayapi): break HTTPRoute conflicts by creationTimestamp [#18272](https://github.com/kumahq/kuma/pull/18272) @Automaat
+* fix(gatewayapi): deny traffic when a backendRef is not permitted [#18267](https://github.com/kumahq/kuma/pull/18267) @Automaat
+* fix(gatewayapi): fail closed on missing backendRef port [#18141](https://github.com/kumahq/kuma/pull/18141) @Automaat
+* fix(gatewayapi): fail closed when a backendRef does not resolve [#18009](https://github.com/kumahq/kuma/pull/18009) @Automaat
+* fix(gatewayapi): give a generated producer route the producer role [#18203](https://github.com/kumahq/kuma/pull/18203) @Automaat
+* fix(gatewayapi): harden generated meshhttproute names [#18274](https://github.com/kumahq/kuma/pull/18274) @Automaat
+* fix(gatewayapi): reject headless service route parents [#18150](https://github.com/kumahq/kuma/pull/18150) @Automaat
+* fix(gatewayapi): reject route filters the mesh cannot apply [#18297](https://github.com/kumahq/kuma/pull/18297) @Automaat
+* fix(gatewayapi): require ReferenceGrant for cross-namespace backendRefs [#18075](https://github.com/kumahq/kuma/pull/18075) @Automaat
+* fix(helm): allow universal global control plane [#18212](https://github.com/kumahq/kuma/pull/18212) @slonka
+* fix(helm): deny loopback admin and restore parentEnv in universal mode [#18452](https://github.com/kumahq/kuma/pull/18452) @bartsmykla
+* fix(helm): drop legacy Gateway API route CRUD from control-plane workloads RBAC [#19045](https://github.com/kumahq/kuma/pull/19045) @kumahq
+* fix(helm): honor dataPlane.image.pullPolicy in the injected sidecar and init containers [#19025](https://github.com/kumahq/kuma/pull/19025) @Automaat
+* fix(helm): label system namespace on upgrade [#19047](https://github.com/kumahq/kuma/pull/19047) @slonka
+* fix(helm): match Zone in the defaulting webhook [#18601](https://github.com/kumahq/kuma/pull/18601) @Automaat
+* fix(helm): restore global zone sync service [#18256](https://github.com/kumahq/kuma/pull/18256) @slonka
+* fix(helm): skip installing CRDs by default when installing in universal [#16078](https://github.com/kumahq/kuma/pull/16078) @lahabana
+* fix(helm): stop zone proxy roll on upgrade [#18882](https://github.com/kumahq/kuma/pull/18882) @lukidzi
+* fix(insights): don't mark data plane proxies as degraded because of ignored inbounds [#18734](https://github.com/kumahq/kuma/pull/18734) @Automaat
+* fix(inspect-api): skip DNS validation for HostnameGenerator hostnames [#17016](https://github.com/kumahq/kuma/pull/17016) @lobkovilya
+* fix(intercp): distinguish unreachable leader from leader change [#17068](https://github.com/kumahq/kuma/pull/17068) @Automaat
+* fix(k8s): always probe the sidecar readiness port [#18346](https://github.com/kumahq/kuma/pull/18346) @Automaat
+* fix(k8s): copy node labels to Dataplane labels [#17480](https://github.com/kumahq/kuma/pull/17480) @lukidzi
+* fix(k8s): dedup inbounds only when tags disabled [#17197](https://github.com/kumahq/kuma/pull/17197) @lukidzi
+* fix(k8s): default sidecar concurrency to 2 [#18696](https://github.com/kumahq/kuma/pull/18696) @lukidzi
+* fix(k8s): drop Mesh owner from MeshZoneAddress [#18749](https://github.com/kumahq/kuma/pull/18749) @lukidzi
+* fix(k8s): drop reserved pod labels before computing Dataplane labels [#18411](https://github.com/kumahq/kuma/pull/18411) [#18648](https://github.com/kumahq/kuma/pull/18648) @lobkovilya
+* fix(k8s): enforce control-plane-owned labels on read [#18271](https://github.com/kumahq/kuma/pull/18271) @lobkovilya
+* fix(k8s): parse kuma.io/gateway as a boolean [#18354](https://github.com/kumahq/kuma/pull/18354) @Automaat
+* fix(k8s): read system-namespace-only resources from the system namespace only [#19051](https://github.com/kumahq/kuma/pull/19051) @lobkovilya
+* fix(k8s): reconcile pods that match a Service only once ignoredServiceSelectorLabels are stripped [#18441](https://github.com/kumahq/kuma/pull/18441) @Automaat
+* fix(k8s): reject mesh not matching ownerReference [#18060](https://github.com/kumahq/kuma/pull/18060) @Automaat
+* fix(k8s): reject user-set service-account label [#18273](https://github.com/kumahq/kuma/pull/18273) @lukidzi
+* fix(k8s): stop dropping traffic on selector move [#18561](https://github.com/kumahq/kuma/pull/18561) @lukidzi
+* fix(kds): attribute zone-to-global synced resources by the connecting zone's client-id [#17456](https://github.com/kumahq/kuma/pull/17456) @bartsmykla
+* fix(kds): keep 2.14 zones serving MeshServices behind a 3.0 global [#18870](https://github.com/kumahq/kuma/pull/18870) @bartsmykla
+* fix(kds): keep zone KDS multiplex alive when a diagnostic rpc stream fails [#19009](https://github.com/kumahq/kuma/pull/19009) @kumahq
+* fix(kds): omit MeshTrust status from sync [#18598](https://github.com/kumahq/kuma/pull/18598) @Automaat
+* fix(kds): only accept subscribed resource types [#19062](https://github.com/kumahq/kuma/pull/19062) @slonka
+* fix(kds): replace rather than merge when reading a spec from the JSON wire form [#18672](https://github.com/kumahq/kuma/pull/18672) @Automaat
+* fix(kds): restore event-based watchdog intervals [#18621](https://github.com/kumahq/kuma/pull/18621) @Automaat
+* fix(kds): retry sync updates on write conflicts [#17738](https://github.com/kumahq/kuma/pull/17738) @lukidzi
+* fix(kds): survive oversized Envoy admin responses [#18127](https://github.com/kumahq/kuma/pull/18127) @lukidzi
+* fix(kuma): unwrap DeletedFinalStateUnknown in k8s event listener [#17066](https://github.com/kumahq/kuma/pull/17066) @Automaat
+* fix(kuma-cp): advertise a zone ingress node that serves traffic [#18078](https://github.com/kumahq/kuma/pull/18078) @lukidzi
+* fix(kuma-cp): leave headroom below GOMEMLIMIT [#18853](https://github.com/kumahq/kuma/pull/18853) @lukidzi
+* fix(kuma-dp): avoid double scrape on otel export (backport of #18871) [#18906](https://github.com/kumahq/kuma/pull/18906) @kumahq
+* fix(kuma-dp): restrict readiness reporter to /ready [#17317](https://github.com/kumahq/kuma/pull/17317) @bartsmykla
+* fix(kumactl): strip kuma.io/zone from federation exports [#18730](https://github.com/kumahq/kuma/pull/18730) @bartsmykla
+* fix(kumactl): use current policy inspect API [#18425](https://github.com/kumahq/kuma/pull/18425) @Automaat
+* fix(kumactl): warn when the server's major version is higher than kumactl's, including preview servers [#19042](https://github.com/kumahq/kuma/pull/19042) @Automaat
+* fix(labels): make Compute authoritative for zone, env, namespace and service-account [#18410](https://github.com/kumahq/kuma/pull/18410) @lobkovilya
+* fix(mesh): gateway tag not required tagless [#17610](https://github.com/kumahq/kuma/pull/17610) @Automaat
+* fix(meshaccesslog): match rule-scoped route ids [#17548](https://github.com/kumahq/kuma/pull/17548) @Automaat
+* fix(meshhttproute): 503 for valid all-zero refs [#19053](https://github.com/kumahq/kuma/pull/19053) @slonka
+* fix(meshhttproute): resolve mirror backendRef [#17676](https://github.com/kumahq/kuma/pull/17676) @lukidzi
+* fix(meshhttproute): return 404 when no route rule matches [#18268](https://github.com/kumahq/kuma/pull/18268) @Automaat
+* fix(meshhttproute): return 500 for unresolvable backendref shares [#18146](https://github.com/kumahq/kuma/pull/18146) @Automaat
+* fix(meshhttproute): return 503 for zero-weight backends [#18340](https://github.com/kumahq/kuma/pull/18340) @Automaat
+* fix(meshhttproute): sort pathless match as root [#19018](https://github.com/kumahq/kuma/pull/19018) @lukidzi
+* fix(meshidentity): reconcile labels on generated MeshTrusts [#18989](https://github.com/kumahq/kuma/pull/18989) @lobkovilya
+* fix(meshidentity): reconcile the MeshTrust trust domain when it changes [#18607](https://github.com/kumahq/kuma/pull/18607) @Automaat
+* fix(meshmetric): honor includeUnused sidecar flag [#18477](https://github.com/kumahq/kuma/pull/18477) @Automaat
+* fix(meshmetric): require client certs for ActiveMTLSBackend [#19026](https://github.com/kumahq/kuma/pull/19026) @bartsmykla
+* fix(meshpassthrough): correct validator typo [#18879](https://github.com/kumahq/kuma/pull/18879) @lukidzi
+* fix(meshpassthrough): drop duplicate chain matches [#18226](https://github.com/kumahq/kuma/pull/18226) @lukidzi
+* fix(meshpassthrough): keep mysql port excludes [#19024](https://github.com/kumahq/kuma/pull/19024) @slonka
+* fix(meshpassthrough): resolve domain matches in the sidecar so they pin the destination [#18658](https://github.com/kumahq/kuma/pull/18658) @Automaat
+* fix(meshproxypatch): honor circuit breaker patches [#18207](https://github.com/kumahq/kuma/pull/18207) @lukidzi
+* fix(meshproxypatch): match unified listener names [#17545](https://github.com/kumahq/kuma/pull/17545) @Automaat
+* fix(meshservice): identities fallback tagless [#17657](https://github.com/kumahq/kuma/pull/17657) @Automaat
+* fix(meshservice): reconcile generated selector [#18876](https://github.com/kumahq/kuma/pull/18876) @lukidzi
+* fix(meshservice): stop telling clients to originate mTLS before the destination can terminate it [#18475](https://github.com/kumahq/kuma/pull/18475) @Automaat
+* fix(meshtimeout): keep zone egress rule timeouts [#18979](https://github.com/kumahq/kuma/pull/18979) @lukidzi
+* fix(meshtimeout): rules/to are mutually exclusive [#17589](https://github.com/kumahq/kuma/pull/17589) @Automaat
+* fix(meshtls): allow TLS 1.3 on outbound mTLS [#18865](https://github.com/kumahq/kuma/pull/18865) @lukidzi
+* fix(meshtls): apply the TLS version and ciphers to the upstream side of proxies that have no inbounds, such as delegated gateways [#18444](https://github.com/kumahq/kuma/pull/18444) @Automaat
+* fix(meshtls): honor inbound ports and tls bounds [#17847](https://github.com/kumahq/kuma/pull/17847) @lukidzi
+* fix(meshtls): sort inbound SAN matchers for stable config [#17144](https://github.com/kumahq/kuma/pull/17144) @lukidzi
+* fix(meshtrafficpermission): reject empty match entries [#19020](https://github.com/kumahq/kuma/pull/19020) @bartsmykla
+* fix(mtls): derive identity without tags [#17606](https://github.com/kumahq/kuma/pull/17606) @Automaat
+* fix(mtls): drop legacy identity secret when MeshIdentity is assigned [#16947](https://github.com/kumahq/kuma/pull/16947) @lukidzi
+* fix(mtp): unified naming for zone egress [#17560](https://github.com/kumahq/kuma/pull/17560) @Automaat
+* fix(oas): always serve dataplane outbound address [#18668](https://github.com/kumahq/kuma/pull/18668) @Automaat
+* fix(oas): render proto enums as string enums [#18350](https://github.com/kumahq/kuma/pull/18350) @Automaat
+* fix(oas): require pagination fields on list endpoints [#18666](https://github.com/kumahq/kuma/pull/18666) @Automaat
+* fix(observability): use NoBackendRefsConfigured reason when no MeshOpenTelemetryBackend references are configured [#19010](https://github.com/kumahq/kuma/pull/19010) @kumahq
+* fix(policy): scope producer role to own namespace [#18848](https://github.com/kumahq/kuma/pull/18848) @slonka
+* fix(resyncer): change log level from error to info [#18269](https://github.com/kumahq/kuma/pull/18269) @lobkovilya
+* fix(ServiceInsight): keep delegated gateways when meshServices.mode is Exclusive [#17431](https://github.com/kumahq/kuma/pull/17431) @lobkovilya
+* fix(store): keep labels on the resource after a postgres update [#18929](https://github.com/kumahq/kuma/pull/18929) @lobkovilya
+* fix(tokens): correct admin token extraction hint [#18828](https://github.com/kumahq/kuma/pull/18828) @slonka
+* fix(tokens): reject a non-string kid header and recover from dp-server handler panics [#17465](https://github.com/kumahq/kuma/pull/17465) @bartsmykla
+* fix(version): accept the previous major's last minor as compatible [#19135](https://github.com/kumahq/kuma/pull/19135) @kumahq
+* fix(xds): avoid panic when fetching resources fails in base mesh context [#17675](https://github.com/kumahq/kuma/pull/17675) @lobkovilya
+* fix(xds): build cross-zone SNI from port name [#17739](https://github.com/kumahq/kuma/pull/17739) @lukidzi
+* fix(xds): de-gate mTLS-only paths for MeshIdentity [#17931](https://github.com/kumahq/kuma/pull/17931) @lukidzi
+* fix(xds): do not mutate the cached Dataplane [#18751](https://github.com/kumahq/kuma/pull/18751) @lukidzi
+* fix(xds): drop MES with unloadable TLS material [#18873](https://github.com/kumahq/kuma/pull/18873) @lukidzi
+* fix(xds): drop resourceVersion from Dataplane hash [#17127](https://github.com/kumahq/kuma/pull/17127) @Automaat
+* fix(xds): empty reachable labels select all [#18860](https://github.com/kumahq/kuma/pull/18860) @lukidzi
+* fix(xds): fix inbound cluster name lookup [#17504](https://github.com/kumahq/kuma/pull/17504) @Automaat
+* fix(xds): fix unified naming detection for zone proxies [#17511](https://github.com/kumahq/kuma/pull/17511) @Automaat
+* fix(xds): ignore workload status in mesh hash [#17064](https://github.com/kumahq/kuma/pull/17064) @Automaat
+* fix(xds): keep every MES matched by reachable refs [#18833](https://github.com/kumahq/kuma/pull/18833) @lukidzi
+* fix(xds): pick up recreated same-name policies [#18731](https://github.com/kumahq/kuma/pull/18731) @lukidzi
+* fix(xds): probe fallback route uses unified cluster name [#17498](https://github.com/kumahq/kuma/pull/17498) @Automaat
+* fix(xds): reject unsupported SOTW streams [#18343](https://github.com/kumahq/kuma/pull/18343) @Automaat
+* fix(xds): resync dataplanes when identity is ready [#17764](https://github.com/kumahq/kuma/pull/17764) @lukidzi
+* fix(xds): skip zone egress without identity [#18747](https://github.com/kumahq/kuma/pull/18747) @lukidzi
+* fix(xds): speed up Envoy stats tag extraction [#18910](https://github.com/kumahq/kuma/pull/18910) @bartsmykla
+* fix(xds): throttle dataplane cert issuance on CA failure [#17448](https://github.com/kumahq/kuma/pull/17448) @slonka
+* fix(xds): unified naming for zone-proxy admin cluster [#17543](https://github.com/kumahq/kuma/pull/17543) @Automaat
+* fix(xds): use resolved dataplane addr in mesh ctx [#17836](https://github.com/kumahq/kuma/pull/17836) @lukidzi
+* fix(xds): validate labels of the Dataplane passed to kuma-dp run [#18898](https://github.com/kumahq/kuma/pull/18898) @lobkovilya
+* fix(xds): wait for destination TLS before mTLS [#17848](https://github.com/kumahq/kuma/pull/17848) @lukidzi
+* fix: preserve explicit inbound service-tag identity for mixed-label Universal dataplanes after inboundTagsDisabled removal [#17728](https://github.com/kumahq/kuma/pull/17728) @Automaat
+* honor the API server maximum TLS version [#18422](https://github.com/kumahq/kuma/pull/18422) @Automaat
+* KDS no longer tears down the stream when the store rejects a single synced resource - the resource is NACKed and the rest of the batch is applied. [#18077](https://github.com/kumahq/kuma/pull/18077) @lukidzi
+* perf(api-server): cache inspection endpoint reads [#18844](https://github.com/kumahq/kuma/pull/18844) @slonka
+* perf(api-server): cache the dataplane _rules inspection endpoint (backport of #17760) [#18843](https://github.com/kumahq/kuma/pull/18843) @kumahq
+* perf(k8s): reuse manager informers for events [#18852](https://github.com/kumahq/kuma/pull/18852) @lukidzi
+* perf(kds): align flush ticks across zones [#18624](https://github.com/kumahq/kuma/pull/18624) @Automaat
+* perf(kds): cache the zone lookup in sync filter [#18626](https://github.com/kumahq/kuma/pull/18626) @Automaat
+* perf(kds): carry unchanged types over verbatim [#18625](https://github.com/kumahq/kuma/pull/18625) @Automaat
+* perf(kds): reuse versions for unchanged types [#18622](https://github.com/kumahq/kuma/pull/18622) @Automaat
+* perf(kds): share mapped resources across zones [#18638](https://github.com/kumahq/kuma/pull/18638) @Automaat
+* perf(mads): reuse MeshMetric matches per mesh [#18687](https://github.com/kumahq/kuma/pull/18687) @Automaat
+* perf(matchers): add LRU cache for MatchedPolicies [#17017](https://github.com/kumahq/kuma/pull/17017) @Automaat
+* perf(xds): rebuild mesh context parts on their own [#18684](https://github.com/kumahq/kuma/pull/18684) @Automaat
+* perf(xds): replace proto.Equal with content hashes in reconcile [#17008](https://github.com/kumahq/kuma/pull/17008) @Automaat
+* perf(xds): reuse unchanged mesh context parts [#18683](https://github.com/kumahq/kuma/pull/18683) @Automaat
+* perf(xds): stabilize policy matching hash [#18686](https://github.com/kumahq/kuma/pull/18686) @Automaat
+* refactor(api)!: remove the `kuma.io/gateway` label and annotation [#18662](https://github.com/kumahq/kuma/pull/18662) @Automaat
+* refactor(api)!: remove the ServiceInsight resource [#18538](https://github.com/kumahq/kuma/pull/18538) @Automaat
+* refactor(core): remove Kafka as a supported protocol [#17831](https://github.com/kumahq/kuma/pull/17831) @Automaat
+* refactor(dataplane): mark gateways with a label [#18366](https://github.com/kumahq/kuma/pull/18366) @Automaat
+* refactor(defaults)!: a new Mesh no longer comes with default policies [#18661](https://github.com/kumahq/kuma/pull/18661) @bartsmykla
+* refactor(defaults): remove default policy updates [#18342](https://github.com/kumahq/kuma/pull/18342) @Automaat
+* refactor(mesh)!: drop non-Exclusive meshServices.mode branches [#17457](https://github.com/kumahq/kuma/pull/17457) @Automaat
+* refactor(targetref)!: narrow backendRef kinds [#18391](https://github.com/kumahq/kuma/pull/18391) @Automaat
+* refactor(xds): remove legacy reachableServices [#17615](https://github.com/kumahq/kuma/pull/17615) @lukidzi
+* Remove the `BUILTIN` gateway type, the `gatewayBuiltin` insight statistics and the `?gateway=builtin` filter [#18058](https://github.com/kumahq/kuma/pull/18058) @lukidzi
+* Remove unused control plane DNS settings and correct the control plane configuration reference. [#19146](https://github.com/kumahq/kuma/pull/19146) @lobkovilya
+* Removed a noisy info log emitted on every MADS snapshot generation when both MeshMetrics and Mesh 'metrics' were configured. [#17069](https://github.com/kumahq/kuma/pull/17069) @lobkovilya
+* chore(deps): bump Kong/kong-mesh-v3-readiness from 0.1.0 to 0.6.4 [#17021](https://github.com/kumahq/kuma/pull/17021) [#17023](https://github.com/kumahq/kuma/pull/17023) [#17026](https://github.com/kumahq/kuma/pull/17026) [#17950](https://github.com/kumahq/kuma/pull/17950) [#18183](https://github.com/kumahq/kuma/pull/18183) [#18464](https://github.com/kumahq/kuma/pull/18464) [#18717](https://github.com/kumahq/kuma/pull/18717) [#18957](https://github.com/kumahq/kuma/pull/18957) [#19089](https://github.com/kumahq/kuma/pull/19089) @renovate
+* chore(deps): bump ci-tools/release-tool from 1.4.6 to 1.5.0 [#19013](https://github.com/kumahq/kuma/pull/19013) @kumahq
+* chore(deps): bump cirello.io/pglock from 1.16.1 to 1.18.0 [#17334](https://github.com/kumahq/kuma/pull/17334) [#18961](https://github.com/kumahq/kuma/pull/18961) [#19092](https://github.com/kumahq/kuma/pull/19092) @renovate
+* chore(deps): bump coredns from 1.14.2 to 1.14.6 [#17368](https://github.com/kumahq/kuma/pull/17368) @renovate
+* chore(deps): bump debian from 13.5 to 13.7 [#17645](https://github.com/kumahq/kuma/pull/17645) [#18815](https://github.com/kumahq/kuma/pull/18815) @renovate
+* chore(deps): bump debian:13.5 from 4ae6766 to d07d1b5 [#16950](https://github.com/kumahq/kuma/pull/16950) [#17043](https://github.com/kumahq/kuma/pull/17043) @renovate
+* chore(deps): bump debian:13.6 from fac46bf to f324c7f [#17937](https://github.com/kumahq/kuma/pull/17937) [#18237](https://github.com/kumahq/kuma/pull/18237) @renovate
+* chore(deps): bump debian:13.7 from 9cc0800 to 913f670 [#19077](https://github.com/kumahq/kuma/pull/19077) @renovate
+* chore(deps): bump envoy from 1.38.2 to 1.39.4 [#17022](https://github.com/kumahq/kuma/pull/17022) [#17427](https://github.com/kumahq/kuma/pull/17427) [#18228](https://github.com/kumahq/kuma/pull/18228) [#19070](https://github.com/kumahq/kuma/pull/19070) [#19144](https://github.com/kumahq/kuma/pull/19144) @lukidzi,@renovate
+* chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug from 35a3865 to 51c3587 [#17325](https://github.com/kumahq/kuma/pull/17325) [#17485](https://github.com/kumahq/kuma/pull/17485) [#18085](https://github.com/kumahq/kuma/pull/18085) [#18171](https://github.com/kumahq/kuma/pull/18171) @renovate
+* chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug-nonroot from 6cec643 to 83b8737 [#17326](https://github.com/kumahq/kuma/pull/17326) [#17486](https://github.com/kumahq/kuma/pull/17486) [#18086](https://github.com/kumahq/kuma/pull/18086) [#18172](https://github.com/kumahq/kuma/pull/18172) @renovate
+* chore(deps): bump gcr.io/distroless/static-debian12:debug-nonroot from f414196 to d5563cc [#17327](https://github.com/kumahq/kuma/pull/17327) [#17487](https://github.com/kumahq/kuma/pull/17487) [#18087](https://github.com/kumahq/kuma/pull/18087) [#18173](https://github.com/kumahq/kuma/pull/18173) @renovate
+* chore(deps): bump gcr.io/k8s-staging-build-image/distroless-iptables from 0.9.2 to 0.11.0 [#16956](https://github.com/kumahq/kuma/pull/16956) [#17335](https://github.com/kumahq/kuma/pull/17335) [#17637](https://github.com/kumahq/kuma/pull/17637) [#18817](https://github.com/kumahq/kuma/pull/18817) @renovate
+* chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from 5a7b674 to 7403610 [#16951](https://github.com/kumahq/kuma/pull/16951) [#17044](https://github.com/kumahq/kuma/pull/17044) [#17104](https://github.com/kumahq/kuma/pull/17104) [#17329](https://github.com/kumahq/kuma/pull/17329) [#17488](https://github.com/kumahq/kuma/pull/17488) [#17629](https://github.com/kumahq/kuma/pull/17629) [#17938](https://github.com/kumahq/kuma/pull/17938) [#18088](https://github.com/kumahq/kuma/pull/18088) [#18174](https://github.com/kumahq/kuma/pull/18174) [#18458](https://github.com/kumahq/kuma/pull/18458) [#19078](https://github.com/kumahq/kuma/pull/19078) @renovate
+* chore(deps): bump ghcr.io/spiffe/spire-agent from 1.15.1 to 1.15.2 [#17638](https://github.com/kumahq/kuma/pull/17638) @renovate
+* chore(deps): bump ghcr.io/spiffe/spire-server from 1.15.1 to 1.15.2 [#17337](https://github.com/kumahq/kuma/pull/17337) @renovate
+* chore(deps): bump ginkgo from 2.29.0 to 2.33.1 [#16961](https://github.com/kumahq/kuma/pull/16961) [#17053](https://github.com/kumahq/kuma/pull/17053) [#18091](https://github.com/kumahq/kuma/pull/18091) [#18705](https://github.com/kumahq/kuma/pull/18705) [#18818](https://github.com/kumahq/kuma/pull/18818) [#19085](https://github.com/kumahq/kuma/pull/19085) @renovate
+* chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20251124112456-a79f5cb04181 from a79f5cb to ddf65ac [#17045](https://github.com/kumahq/kuma/pull/17045) @renovate
+* chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20260622121138-ddf65ac69581 from ddf65ac to ea51ed6 [#17630](https://github.com/kumahq/kuma/pull/17630) @renovate
+* chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20260720125501-ea51ed66dcc4 from ea51ed6 to f0426b3 [#17782](https://github.com/kumahq/kuma/pull/17782) @renovate
+* chore(deps): bump github.com/cilium/ebpf from 0.21.0 to 0.22.0 [#17054](https://github.com/kumahq/kuma/pull/17054) @renovate
+* chore(deps): bump github.com/containernetworking/cni from 1.3.0 to 1.3.1 [#18461](https://github.com/kumahq/kuma/pull/18461) @renovate
+* chore(deps): bump github.com/emicklei/go-restful/v3 from 3.13.0 to 3.14.0 [#19093](https://github.com/kumahq/kuma/pull/19093) @renovate
+* chore(deps): bump github.com/envoyproxy/go-control-plane* [#18123](https://github.com/kumahq/kuma/pull/18123) @renovate
+* chore(deps): bump github.com/exaring/otelpgx from 0.11.1 to 0.13.0 [#18706](https://github.com/kumahq/kuma/pull/18706) [#19094](https://github.com/kumahq/kuma/pull/19094) @renovate
+* chore(deps): bump github.com/go-logr/logr from 1.4.3 to 1.4.4 [#17639](https://github.com/kumahq/kuma/pull/17639) @renovate
+* chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.19.1 to 4.20.1 [#18707](https://github.com/kumahq/kuma/pull/18707) @renovate
+* chore(deps): bump github.com/gruntwork-io/terratest from 1.0.0 to 1.0.1 [#17049](https://github.com/kumahq/kuma/pull/17049) @renovate
+* chore(deps): bump github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0 [#18708](https://github.com/kumahq/kuma/pull/18708) @renovate
+* chore(deps): bump github.com/miekg/dns from 1.1.72 to 1.1.73 [#18179](https://github.com/kumahq/kuma/pull/18179) @renovate
+* chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.3 [#18109](https://github.com/kumahq/kuma/pull/18109) @bartsmykla
+* chore(deps): bump github.com/onsi/gomega from 1.41.0 to 1.44.0 [#16962](https://github.com/kumahq/kuma/pull/16962) [#17050](https://github.com/kumahq/kuma/pull/17050) [#18246](https://github.com/kumahq/kuma/pull/18246) [#18809](https://github.com/kumahq/kuma/pull/18809) [#18891](https://github.com/kumahq/kuma/pull/18891) @renovate
+* chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.25.0 [#17646](https://github.com/kumahq/kuma/pull/17646) [#19095](https://github.com/kumahq/kuma/pull/19095) @renovate
+* chore(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 [#18462](https://github.com/kumahq/kuma/pull/18462) @renovate
+* chore(deps): bump github.com/prometheus/common from 0.68.1 to 0.72.0 [#16986](https://github.com/kumahq/kuma/pull/16986) [#17647](https://github.com/kumahq/kuma/pull/17647) [#18467](https://github.com/kumahq/kuma/pull/18467) [#18962](https://github.com/kumahq/kuma/pull/18962) @renovate
+* chore(deps): bump github.com/sethvargo/go-retry from 0.3.0 to 0.5.0 [#17648](https://github.com/kumahq/kuma/pull/17648) [#19097](https://github.com/kumahq/kuma/pull/19097) @renovate
+* chore(deps): bump github.com/shopspring/decimal from 1.4.0 to 1.5.0 [#19098](https://github.com/kumahq/kuma/pull/19098) @renovate
+* chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.7.0 to 2.9.0 [#16987](https://github.com/kumahq/kuma/pull/16987) [#18810](https://github.com/kumahq/kuma/pull/18810) [#19099](https://github.com/kumahq/kuma/pull/19099) @renovate
+* chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 [#18188](https://github.com/kumahq/kuma/pull/18188) @renovate
+* chore(deps): bump github.com/testcontainers/testcontainers-go from 0.43.0 to 0.44.0 [#17949](https://github.com/kumahq/kuma/pull/17949) @renovate
+* chore(deps): bump go.opentelemetry.io/proto/otlp from 1.10.0 to 1.11.1 [#17649](https://github.com/kumahq/kuma/pull/17649) [#18955](https://github.com/kumahq/kuma/pull/18955) @renovate
+* chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.56.0 [#16963](https://github.com/kumahq/kuma/pull/16963) [#17192](https://github.com/kumahq/kuma/pull/17192) [#18347](https://github.com/kumahq/kuma/pull/18347) @renovate
+* chore(deps): bump golang.org/x/exp from 055de63 to faecfb2 [#16952](https://github.com/kumahq/kuma/pull/16952) [#17330](https://github.com/kumahq/kuma/pull/17330) [#17489](https://github.com/kumahq/kuma/pull/17489) [#17783](https://github.com/kumahq/kuma/pull/17783) [#18089](https://github.com/kumahq/kuma/pull/18089) [#18175](https://github.com/kumahq/kuma/pull/18175) [#18255](https://github.com/kumahq/kuma/pull/18255) [#18702](https://github.com/kumahq/kuma/pull/18702) [#19079](https://github.com/kumahq/kuma/pull/19079) @renovate
+* chore(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 [#18068](https://github.com/kumahq/kuma/pull/18068) @renovate
+* chore(deps): bump golang.org/x/net from 0.59.0 to 0.60.0 [#19029](https://github.com/kumahq/kuma/pull/19029) @renovate
+* chore(deps): bump golang.org/x/tools from 0.46.0 to 0.52.0 [#17055](https://github.com/kumahq/kuma/pull/17055) [#17342](https://github.com/kumahq/kuma/pull/17342) [#18714](https://github.com/kumahq/kuma/pull/18714) [#18963](https://github.com/kumahq/kuma/pull/18963) [#19104](https://github.com/kumahq/kuma/pull/19104) @renovate
+* chore(deps): bump golangci-lint from 2.12.2 to 2.14.0 [#18189](https://github.com/kumahq/kuma/pull/18189) [#18242](https://github.com/kumahq/kuma/pull/18242) [#18892](https://github.com/kumahq/kuma/pull/18892) @renovate
+* chore(deps): bump google.golang.org/genproto/googleapis/* from 3dc84a4 to fad4113 [#16953](https://github.com/kumahq/kuma/pull/16953) [#16980](https://github.com/kumahq/kuma/pull/16980) [#17105](https://github.com/kumahq/kuma/pull/17105) [#17631](https://github.com/kumahq/kuma/pull/17631) [#17784](https://github.com/kumahq/kuma/pull/17784) [#17939](https://github.com/kumahq/kuma/pull/17939) [#18176](https://github.com/kumahq/kuma/pull/18176) [#18238](https://github.com/kumahq/kuma/pull/18238) [#18459](https://github.com/kumahq/kuma/pull/18459) [#18703](https://github.com/kumahq/kuma/pull/18703) [#18805](https://github.com/kumahq/kuma/pull/18805) [#18884](https://github.com/kumahq/kuma/pull/18884) [#19080](https://github.com/kumahq/kuma/pull/19080) @renovate
+* chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.84.0 [#17110](https://github.com/kumahq/kuma/pull/17110) [#17515](https://github.com/kumahq/kuma/pull/17515) [#17789](https://github.com/kumahq/kuma/pull/17789) [#17999](https://github.com/kumahq/kuma/pull/17999) [#18181](https://github.com/kumahq/kuma/pull/18181) [#18243](https://github.com/kumahq/kuma/pull/18243) [#18819](https://github.com/kumahq/kuma/pull/18819) @renovate
+* chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 [#18093](https://github.com/kumahq/kuma/pull/18093) @renovate
+* chore(deps): bump helm from 4.2.0 to 4.3.0 [#16957](https://github.com/kumahq/kuma/pull/16957) [#16984](https://github.com/kumahq/kuma/pull/16984) [#17338](https://github.com/kumahq/kuma/pull/17338) [#18094](https://github.com/kumahq/kuma/pull/18094) [#18715](https://github.com/kumahq/kuma/pull/18715) @renovate
+* chore(deps): bump jdx/mise-action from 4.3.0 to 5.1.1" [#18977](https://github.com/kumahq/kuma/pull/18977) @lukidzi
+* chore(deps): bump k8s.io/kube-openapi from 865597e to be32def [#16981](https://github.com/kumahq/kuma/pull/16981) [#17046](https://github.com/kumahq/kuma/pull/17046) [#17331](https://github.com/kumahq/kuma/pull/17331) [#17632](https://github.com/kumahq/kuma/pull/17632) [#18177](https://github.com/kumahq/kuma/pull/18177) @renovate
+* chore(deps): bump k8s.io/utils from ff6756f to cf1189d [#16982](https://github.com/kumahq/kuma/pull/16982) [#17047](https://github.com/kumahq/kuma/pull/17047) [#17332](https://github.com/kumahq/kuma/pull/17332) @renovate
+* chore(deps): bump kindest/node from 1.36.1 to 1.37.0 [#18248](https://github.com/kumahq/kuma/pull/18248) @renovate
+* chore(deps): bump kubectl from 1.36.1 to 1.37.1 [#16958](https://github.com/kumahq/kuma/pull/16958) [#17642](https://github.com/kumahq/kuma/pull/17642) [#18184](https://github.com/kumahq/kuma/pull/18184) [#18253](https://github.com/kumahq/kuma/pull/18253) [#18889](https://github.com/kumahq/kuma/pull/18889) @renovate
+* chore(deps): bump kubernetes monorepo from 0.36.1 to 0.36.2 [#16959](https://github.com/kumahq/kuma/pull/16959) @renovate
+* chore(deps): bump kubernetes monorepo from 0.36.2 to 0.36.3 [#17643](https://github.com/kumahq/kuma/pull/17643) @renovate
+* chore(deps): bump kubernetes monorepo from 0.36.3 to 0.36.4 [#18185](https://github.com/kumahq/kuma/pull/18185) @renovate
+* chore(deps): bump kubernetes monorepo from 0.36.4 to 0.37.0 [#18249](https://github.com/kumahq/kuma/pull/18249) @renovate
+* chore(deps): bump kubernetes monorepo from 0.37.0 to 0.37.1 - autoclosed [#18890](https://github.com/kumahq/kuma/pull/18890) @renovate
+* chore(deps): bump opentelemetry-go monorepo [#17951](https://github.com/kumahq/kuma/pull/17951) [#18250](https://github.com/kumahq/kuma/pull/18250) [#18964](https://github.com/kumahq/kuma/pull/18964) @renovate
+* chore(deps): bump opentelemetry-go-contrib monorepo from 0.69.0 to 0.70.0 [#17952](https://github.com/kumahq/kuma/pull/17952) @renovate
+* chore(deps): bump opentelemetry-go-contrib monorepo from 0.70.0 to 0.71.0 [#18251](https://github.com/kumahq/kuma/pull/18251) @renovate
+* chore(deps): bump opentelemetry-go-contrib monorepo from 0.71.0 to 0.72.0 [#18965](https://github.com/kumahq/kuma/pull/18965) @renovate
+* chore(deps): bump postgres:latest from 8ff36f3 to 74935e7 [#16955](https://github.com/kumahq/kuma/pull/16955) [#17048](https://github.com/kumahq/kuma/pull/17048) [#17333](https://github.com/kumahq/kuma/pull/17333) [#17633](https://github.com/kumahq/kuma/pull/17633) [#17941](https://github.com/kumahq/kuma/pull/17941) [#18090](https://github.com/kumahq/kuma/pull/18090) [#18239](https://github.com/kumahq/kuma/pull/18239) [#18806](https://github.com/kumahq/kuma/pull/18806) [#18885](https://github.com/kumahq/kuma/pull/18885) [#19081](https://github.com/kumahq/kuma/pull/19081) @renovate
+* chore(deps): bump projectcalico/tigera-operator from 3.32.0 to 3.33.0 [#17051](https://github.com/kumahq/kuma/pull/17051) [#18245](https://github.com/kumahq/kuma/pull/18245) [#18966](https://github.com/kumahq/kuma/pull/18966) @renovate
+* chore(deps): bump protobuf monorepo [#16968](https://github.com/kumahq/kuma/pull/16968) @renovate
+* chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.2 [#18468](https://github.com/kumahq/kuma/pull/18468) [#18813](https://github.com/kumahq/kuma/pull/18813) [#18959](https://github.com/kumahq/kuma/pull/18959) @renovate
+* chore(deps): bump sigs.k8s.io/controller-tools from 0.21.0 to 0.22.0 [#18469](https://github.com/kumahq/kuma/pull/18469) @renovate
+* chore(deps): bump sigs.k8s.io/gateway-api from 1.5.1 to 1.6.0 [#17111](https://github.com/kumahq/kuma/pull/17111) @renovate
+* chore(deps): bump spire from 1.15.2 to 1.15.3 [#18186](https://github.com/kumahq/kuma/pull/18186) @renovate
+* chore(deps): bump testcontainers-go monorepo [#16989](https://github.com/kumahq/kuma/pull/16989) @renovate
+* chore(deps): security update [#17620](https://github.com/kumahq/kuma/pull/17620) [#18066](https://github.com/kumahq/kuma/pull/18066) [#18136](https://github.com/kumahq/kuma/pull/18136) @kumahq
+* chore(deps): use latest kumahq/kuma-gui [#16971](https://github.com/kumahq/kuma/pull/16971) [#16974](https://github.com/kumahq/kuma/pull/16974) [#16975](https://github.com/kumahq/kuma/pull/16975) [#17024](https://github.com/kumahq/kuma/pull/17024) [#17039](https://github.com/kumahq/kuma/pull/17039) [#17041](https://github.com/kumahq/kuma/pull/17041) [#17071](https://github.com/kumahq/kuma/pull/17071) [#17082](https://github.com/kumahq/kuma/pull/17082) [#17083](https://github.com/kumahq/kuma/pull/17083) [#17165](https://github.com/kumahq/kuma/pull/17165) [#17198](https://github.com/kumahq/kuma/pull/17198) [#17354](https://github.com/kumahq/kuma/pull/17354) [#17382](https://github.com/kumahq/kuma/pull/17382) [#17425](https://github.com/kumahq/kuma/pull/17425) [#17493](https://github.com/kumahq/kuma/pull/17493) [#17549](https://github.com/kumahq/kuma/pull/17549) [#17717](https://github.com/kumahq/kuma/pull/17717) [#17750](https://github.com/kumahq/kuma/pull/17750) [#17817](https://github.com/kumahq/kuma/pull/17817) [#17896](https://github.com/kumahq/kuma/pull/17896) [#17908](https://github.com/kumahq/kuma/pull/17908) [#17975](https://github.com/kumahq/kuma/pull/17975) [#18012](https://github.com/kumahq/kuma/pull/18012) [#18102](https://github.com/kumahq/kuma/pull/18102) [#18116](https://github.com/kumahq/kuma/pull/18116) [#18125](https://github.com/kumahq/kuma/pull/18125) [#18142](https://github.com/kumahq/kuma/pull/18142) [#18149](https://github.com/kumahq/kuma/pull/18149) [#18152](https://github.com/kumahq/kuma/pull/18152) [#18197](https://github.com/kumahq/kuma/pull/18197) [#18204](https://github.com/kumahq/kuma/pull/18204) [#18211](https://github.com/kumahq/kuma/pull/18211) [#18277](https://github.com/kumahq/kuma/pull/18277) [#18292](https://github.com/kumahq/kuma/pull/18292) [#18335](https://github.com/kumahq/kuma/pull/18335) [#18362](https://github.com/kumahq/kuma/pull/18362) [#18404](https://github.com/kumahq/kuma/pull/18404) [#18573](https://github.com/kumahq/kuma/pull/18573) [#18599](https://github.com/kumahq/kuma/pull/18599) [#18660](https://github.com/kumahq/kuma/pull/18660) [#18694](https://github.com/kumahq/kuma/pull/18694) [#18724](https://github.com/kumahq/kuma/pull/18724) [#18726](https://github.com/kumahq/kuma/pull/18726) [#18761](https://github.com/kumahq/kuma/pull/18761) [#18835](https://github.com/kumahq/kuma/pull/18835) [#18836](https://github.com/kumahq/kuma/pull/18836) [#18845](https://github.com/kumahq/kuma/pull/18845) [#18847](https://github.com/kumahq/kuma/pull/18847) [#18849](https://github.com/kumahq/kuma/pull/18849) [#18856](https://github.com/kumahq/kuma/pull/18856) [#18869](https://github.com/kumahq/kuma/pull/18869) [#18874](https://github.com/kumahq/kuma/pull/18874) [#18897](https://github.com/kumahq/kuma/pull/18897) [#18903](https://github.com/kumahq/kuma/pull/18903) [#18909](https://github.com/kumahq/kuma/pull/18909) [#18927](https://github.com/kumahq/kuma/pull/18927) [#19004](https://github.com/kumahq/kuma/pull/19004) [#19048](https://github.com/kumahq/kuma/pull/19048) [#19138](https://github.com/kumahq/kuma/pull/19138) [#19162](https://github.com/kumahq/kuma/pull/19162) @kumahq
+
+
 ## 2.14.6
 > Released on 2026/10/14