.. _version_history_1.40.1:

1.40.1 (October 23, 2026)
==========================





Minor behavior changes
----------------------

*Changes that may cause incompatibilities for some users, but should
not for most*



* **contrib**: The Istio peer metadata conversion now takes a peer's app name and version from the ``app`` and
  ``version`` labels again, and uses ``app.kubernetes.io/name`` and ``app.kubernetes.io/version``
  only when those labels are absent or empty. A workload's own stats always use ``app`` and
  ``version``, so giving the ``app.kubernetes.io/*`` labels precedence made ``source_app``,
  ``destination_app``, ``source_version`` and ``destination_version`` reported by a peer differ from
  the values the workload reports for itself, and the same workload showed up under two names. This
  restores the label precedence Istio proxies used before ``app.kubernetes.io/*`` labels were
  preferred.
* **dns_resolver**: Updated the ``webpki-roots`` and ``rustls-webpki`` crates used by the built-in Hickory DNS resolver
  dynamic module, so that DNS-over-TLS and DNS-over-HTTPS upstreams no longer trust the compromised
  eMudhra intermediate CA certificates (see https://emudhra.we-have-a-problem.com/).
* **tls**: Removed the ``AAA Certificate Services`` and ``emSign ECC Root CA - G3`` roots from the root
  certificate bundle built into Envoy Mobile. Both roots issued or cross-signed eMudhra intermediate
  CA certificates whose private keys were compromised (see
  https://emudhra.we-have-a-problem.com/). Servers whose certificate chains only lead to these roots
  are no longer trusted by Envoy Mobile when it uses its built-in bundle.



Bug fixes
---------

*Changes expected to improve the state of the world and are unlikely
to have negative effects*



* **release**: Updated docker image to resolve the ``eMudhra`` Intermediate CA Compromise vulnerability.