1.39.5 (October 22, 2026)

Minor behavior changes

Changes that may cause incompatibilities for some users, but should not for most

contrib: The Istio peer metadata conversion now takes a peer’s app name and version from the app and version labels again, and uses app.kubernetes.io/name and app.kubernetes.io/version only when those labels are absent or empty. A workload’s own stats always use app and version, so giving the app.kubernetes.io/* labels precedence made source_app, destination_app, source_version and destination_version reported by a peer differ from the values the workload reports for itself, and the same workload showed up under two names. This restores the label precedence Istio proxies used before app.kubernetes.io/* labels were preferred.
dns_resolver: Updated the webpki-roots and rustls-webpki crates used by the built-in Hickory DNS resolver dynamic module, so that DNS-over-TLS and DNS-over-HTTPS upstreams no longer trust the compromised eMudhra intermediate CA certificates (see https://emudhra.we-have-a-problem.com/).
tls: Removed the AAA Certificate Services and emSign ECC Root CA - G3 roots from the root certificate bundle built into Envoy Mobile. Both roots issued or cross-signed eMudhra intermediate CA certificates whose private keys were compromised (see https://emudhra.we-have-a-problem.com/). Servers whose certificate chains only lead to these roots are no longer trusted by Envoy Mobile when it uses its built-in bundle.

Changes expected to improve the state of the world and are unlikely to have negative effects

release: Updated docker image to resolve the eMudhra Intermediate CA Compromise vulnerability.