v5.4.1

What's Changed

🐛 Bug Fixes

• Missing Policies on Ingress will return 500 by @nginx-bot in #9463

🔨 Maintenance

• Add make secrets step to version bump by @nginx-bot in #9405
• Update NGINX OSS to 1.29.7, NGINX Plus to R36 P3, Update WAF to 5.12 by @haywoodsh in #9456

⬆️ Dependencies

• Update NGINX Agent to 3.8 by @nginx-bot in #9438
• Update golangci/golangci-lint Docker tag to v2.11.4 (release-5.4) by @renovate[bot] in #9431
• Update nginx:1.29.6 Docker digest to dec7a90 (release-5.4) by @renovate[bot] in #9395
• Update pre-commit hook DavidAnson/markdownlint-cli2 to v0.22.0 (release-5.4) by @renovate[bot] in #9428
• Update Go dependencies to latest versions by @AlexFenlon in #9441
• Update redhat/ubi9 Docker tag to v9.7-1774227732 (release-5.4) by @renovate[bot] in #9426, #9467
• Update GitHub Actions and Python dependencies by @AlexFenlon in #9443
• Update Docker base image dependencies by @AlexFenlon in #9442
• Update redhat/ubi8 Docker digest to cfbe9b3 (release-5.4) by @renovate[bot] in #9397
• Update dependency preflight to v1.17.0 (release-5.4) by @renovate[bot] in #9468

Full Changelog: v5.4.0...v5.4.1

Upgrade

• For NGINX, use the v5.4.1 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.4.1 images from the F5 Container registry or build your own image using the v5.4.1 source code.
• For Helm, use version 2.5.1 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.4.1/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.4.1/charts/nginx-ingress
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.4.0

What's Changed

🚀 Features

• Add nginx.org/ssl-redirect annotation support by @haywoodsh in #8656
• Add nginx.org/http-redirect-code annotation and ConfigMap support by @haywoodsh in #8711
• Add nginx.org/app-root annotation support by @AlexFenlon in #8720
• Initialise the $service variable early in the server block by @pdabelf5 in #8861
• Add custom time format to JSON and TEXT logging by @AlexFenlon in #8168
• Add RouteSelector Labels to VirtualServer and VirtualServerRoutes by @AlexFenlon in #8936
• feat: Add proxy-next-upstream directives to Ingress Annotations by @spencerugbo in #8972
• Support loadBalancerClass in Helm chart by @rodrigosandrin in #8555
• Add framework to attach Policy CR's to Ingress with annotations by @pdabelf5 in #9209
• add CORS policy to VS/VSR by @vepatel in #9148
• Ingress Policy: AccessControl by @sean-breen in #9280
• feat: add CORS to Ingress via Policy by @vepatel in #9292
• Automate Community PR Pipeline Run by @spencerugbo in #9260
• Enable Session Persistence for NGINX OSS config by @sean-breen in #9316
• Config rollback manager by @haywoodsh in #9288

🐛 Bug Fixes

• Refactor getValidTarget to return a list of items by @javorszky in #8869
• Fix Agent OTel metrics failing to start by @sean-breen in #8949
• fix load command by @vepatel in #9172
• Invalid VS with OIDC policy applied at VS Spec with trusted cert by @pdabelf5 in #9140
• Fix unexpected ";" using zone-sync in the Configmap while disabling IPV6 by @AlexFenlon in #9213
• update openid_connect.js by @vepatel in #9315

🔨 Maintenance

55 changes

• fix git user for release wf by @vepatel in #8601
• Fix shell variable globbing issue using quotes by @javorszky in #8603
• Bump IC to 5.4.0 and helm chart to 2.5.0 by @javorszky in #8604
• Bump WAF version to 5.10.0 by @AlexFenlon in #8606
• Split release docs tasks by @pdabelf5 in #8607
• Allow easy syncing of F5 WAF images for e2e tests by @pdabelf5 in #8609
• update release branch by @vepatel in #8614
• Update Community Call by @danielnginx in #8617
• fix govulncheck image promotion by @vepatel in #8648
• Get k8s version from tests/makefile rather than dockerfile by @javorszky in #8650
• fix cosign version by @vepatel in #8668
• update release branch docs by @javorszky in #8672
• Add 5.3.0 to bug-report template by @AlexFenlon in #8687
• Write images to GH cache on main & release branches by @pdabelf5 in #8713
• update nginx oss and alpine base by @vepatel in #8733
• Update Azure upload credentials by @pdabelf5 in #8745
• Tweak some maintenance make targets by @javorszky in #8618
• Use nginx-bot to checkout & commit renovate PR's by @pdabelf5 in #8773
• Give renovate build workflow id-write permissions by @pdabelf5 in #8775
• Use stdlib for slices package by @pdabelf5 in #8813
• Fix tilde spelling in validation.go by @AlexFenlon in #8818
• Update the NAP threat campaigns version by @javorszky in #8829
• Update app-protect-attack-signatures to 2026 versions by @pdabelf5 in #8860
• Update waf to 5.11.0 by @javorszky in #8874
• Actually update nap to 511 by @javorszky in #8878
• Correctly set PREBUILT_BASE_IMG build arg for full builds by @pdabelf5 in #8913
• Refactor TestAddVirtualServerWithVirtualServerRoutes for better clarity by @AlexFenlon in #8838
• Set pre-commit schedule to quarterly by @pdabelf5 in #8914
• Move JWT annotations names to consts by @pdabelf5 in #8937
• Replace hardcoded keys by @javorszky in #8536
• Add resource reference validation function by @pdabelf5 in #8454
• Update helm chart link in draft release notes by @pdabelf5 in #8989
• Update preflight to 1.16.0 & track version with renovate by @pdabelf5 in #9000
• Update example Secrets to work with new generated Secrets by @AlexFenlon in #9001
• use correct manifest sha for building cares dependency by @sean-breen in #9058
• Update NGINX versions by @pdabelf5 in #9066
• Only run notifications on scheduled or release workflows by @pdabelf5 in #9118
• Adds ARG NGINX_VERSION to fix undefined var by @javorszky in #9053
• Update bug template to include latest version of NIC by @AlexFenlon in #9090
• Fix VSR Selector flaky pytests by @AlexFenlon in #9078
• Add secret generation to regression tests by @javorszky in #9173
• Decouple generatePolicies() from vsc by @pdabelf5 in #9089
• Update WAF to 5.11.2 by @pdabelf5 in #9190
• Add 5.3.4 to the BUG template by @AlexFenlon in #9206
• Update Community Call Dates by @AlexFenlon in #9207
• Update 5.3.3 to 5.3.4 by @AlexFenlon in #9210
• Dynamically determine the architecture for the pytest image build by @pdabelf5 in #9217
• fix secret names in examples by @vepatel in #9237
• Refactor variable names by @sean-breen in #9215
• add parentType to policy owner struct by @vepatel in #9287
• Split virtual server tests into separate files by @pdabelf5 in #9293
• Refactor utils to remove duplicated methods and eliminate import circulations by @haywoodsh in #9317
• Update dependencies and Docker tags for various packages by @pdabelf5 in #9346

📝 Documentation

• Release 5.4.0 by @haywoodsh in #9409

⬆️ Dependencies

63 changes

• Update golang:1.25-alpine Docker digest to e689855 (main) by @renovate[bot] in #8612, #8760, #8890, #8909, #9003, #9061, #9093
• Update dependency go to v1.26.1 (main) by @renovate[bot] in #8613, #8891, #9065, #9297
• Update python:3.14-trixie Docker digest to abc08a8 (main) by @renovate[bot] in #8621, #8724, #8796, #8805, https://g...

v5.3.4

What's Changed

⬆️ Dependencies

• Update python:3.14-trixie Docker digest to abc08a8 (release-5.3) by @renovate[bot] in #9106
• Update module sigs.k8s.io/structured-merge-diff/v6 to v6.3.2 (release-5.3) by @renovate[bot] in #9101
• Update nginx:1.29.5 Docker digest to 341bf0f (release-5.3) by @renovate[bot] in #9100
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to 3754cfe (release-5.3) by @renovate[bot] in #9097, #9128, #9151
• Update nginx:1.29.5-alpine3.23 Docker digest to 1d13701 (release-5.3) by @renovate[bot] in #9104
• Update golang:1.25-alpine Docker digest to f6751d8 (release-5.3) by @renovate[bot] in #9099
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to e06094a (release-5.3) by @renovate[bot] in #9098, #9129, #9152, #9180
• Loosen F5 WAF package versions to allow patch releases by @nginx-bot in #9117
• Update redhat/ubi8 Docker digest to a287489 (release-5.3) by @renovate[bot] in #9113, #9143
• Update module golang.org/x/tools to v0.42.0 (release-5.3) by @renovate[bot] in #9114
• Update quay.io/keycloak/keycloak Docker tag to v26.5.3 (release-5.3) by @renovate[bot] in #9133
• Update golangci/golangci-lint Docker tag to v2.9.0 (release-5.3) by @renovate[bot] in #9136
• Update k8s.io/utils digest to b8788ab (release-5.3) by @renovate[bot] in #9130
• Update pre-commit hook DavidAnson/markdownlint-cli2 to v0.21.0 (release-5.3) by @renovate[bot] in #9170
• Update dependency dominikh/go-tools to v2026 (release-5.3) by @renovate[bot] in #9164
• Update pre-commit hook rhysd/actionlint to v1.7.11 (release-5.3) by @renovate[bot] in #9168
• Update kindest/node Docker tag to v1.35.1 (release-5.3) by @renovate[bot] in #9161
• Update Go to v1.26 by @nginx-bot in #9177
• Update module sigs.k8s.io/controller-tools to v0.20.1 (release-5.3) by @renovate[bot] in #9162
• Update module github.com/gruntwork-io/terratest to v0.56.0 (release-5.3) by @renovate[bot] in #9163
• Update kubernetes packages to v0.35.1 (release-5.3) by @renovate[bot] in #9131
• Update pre-commit hook python-jsonschema/check-jsonschema to v0.36.2 (release-5.3) by @renovate[bot] in #9181
• Update WAF to 5.11.2 by @AlexFenlon in #9189

Full Changelog: v5.3.3...v5.3.4

Upgrade

• For NGINX, use the v5.3.4 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.3.4 images from the F5 Container registry or build your own image using the v5.3.4 source code.
• For Helm, use version 2.4.4 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.4/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.4/charts/nginx-ingress
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.3.3

What's Changed

🔨 Maintenance

• Fix release workflow issues by @pdabelf5 in #8993

⬆️ Dependencies

• Update module github.com/golang-jwt/jwt/v5 to v5.3.1 (release-5.3) by @renovate[bot] in #9009
• Update nginx:1.29.4-alpine3.23 Docker digest to 4870c12 (release-5.3) by @renovate[bot] in #9008, #9019
• Update golang:1.25-alpine Docker digest to f4622e3 (release-5.3) by @renovate[bot] in #9007, #9069
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to 8697918 (release-5.3) by @renovate[bot] in #8997, #9030, #9048, #9068
• Update alpine:3.22 Docker digest to 55ae5d2 (release-5.3) by @renovate[bot] in #9006
• Update opentelemetry-go monorepo to v1.40.0 (release-5.3) by @renovate[bot] in #9037
• Update module github.com/cert-manager/cert-manager to v1.19.3 [SECURITY] (release-5.3) by @renovate[bot] in #9040
• Update quay.io/jetstack/cert-manager-cainjector Docker tag to v1.19.3 (release-5.3) by @renovate[bot] in #9034
• Update quay.io/jetstack/cert-manager-webhook Docker tag to v1.19.3 (release-5.3) by @renovate[bot] in #9036
• Update redhat/ubi8 Docker digest to bf6868a (release-5.3) by @renovate[bot] in #9031, #9071
• Update quay.io/jetstack/cert-manager-controller Docker tag to v1.19.3 (release-5.3) by @renovate[bot] in #9035
• Update python:3.14-trixie Docker digest to ca9350a (release-5.3) by @renovate[bot] in #9051, #9070
• Update debian:12-slim Docker digest to 98f4b71 (release-5.3) by @renovate[bot] in #9047
• Update nginx:1.29.4 Docker digest to 9dd2888 (release-5.3) by @renovate[bot] in #9050
• Update NGINX versions by @nginx-bot in #9075
• Update dependency go to v1.25.7 (release-5.3) by @renovate[bot] in #9072
• Update redhat/ubi9-minimal Docker tag to v9.7-1770267347 (release-5.3) by @renovate[bot] in #9074
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to 901482f (release-5.3) by @renovate[bot] in #9049

Other Changes

• Update NGINX Agent to 3.7 by @nginx-bot in #9076

Full Changelog: v5.3.2...v5.3.3

Upgrade

• For NGINX, use the v5.3.3 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.3.3 images from the F5 Container registry or build your own image using the v5.3.3 source code.
• For Helm, use version 2.4.3 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.3/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.3/charts/nginx-ingress
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.3.2

What's Changed

🔨 Maintenance

• Update nginxplus version in package tests by @nginx-bot in #8771
• Tweak some maintenance make targets by @nginx-bot in #8772
• Use nginx-bot to checkout & commit renovate PR's by @pdabelf5 in #8774
• Use stdlib for slices package by @nginx-bot in #8815

📝 Documentation

• Release 5.3.2 by @nginx-bot in #8990

⬆️ Dependencies

• Update module github.com/aws/aws-sdk-go-v2/config to v1.32.6 (release-5.3) by @renovate[bot] in #8752
• Update nginx:1.29.4-alpine3.23 Docker digest to 8491795 (release-5.3) by @renovate[bot] in #8767, #8779, #8854
• Update redhat/ubi8 Docker digest to a7e3d45 (release-5.3) by @renovate[bot] in #8768, #8924, #8980
• Update k8s.io/utils digest to 914a6e7 (release-5.3) by @renovate[bot] in #8766, #8778, #8843
• Update golang:1.25-alpine Docker digest to e689855 (release-5.3) by @renovate[bot] in #8765, #8893, #8911
• Update ghcr.io/nginx/alpine-fips Docker tag to v0.5.0 (release-5.3) by @renovate[bot] in #8753
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to 8352fd3 (release-5.3) by @renovate[bot] in #8785, #8791, #8852
• Update redhat/ubi9 Docker tag to v9.7-1766364927 (release-5.3) by @renovate[bot] in #8786, #8822, #8926, #8982
• Update kindest/node Docker tag to v1.35.0 (release-5.3) by @renovate[bot] in #8754
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to 998262b (release-5.3) by @renovate[bot] in #8784, #8851, #8905, #8931, #8964
• Update nginx:1.29.4 Docker digest to c881927 (release-5.3) by @renovate[bot] in #8793, #8853
• Update pre-commit hook rhysd/actionlint to v1.7.10 (release-5.3) by @renovate[bot] in #8800
• Update python:3.14-trixie Docker digest to d9ce54c (release-5.3) by @renovate[bot] in #8799, #8806, #8873, #8943
• Update debian:12-slim Docker digest to 94c4d59 (release-5.3) by @renovate[bot] in #8798, #8863, #8884
• Update module github.com/gkampitakis/go-snaps to v0.5.19 (release-5.3) by @renovate[bot] in #8804
• Update quay.io/keycloak/keycloak Docker tag (release-5.3) by @renovate[bot] in #8824
• update app protect threat campaign version by @javorszky in #8839
• Update coredns/coredns Docker tag to v1.14.1 (release-5.3) by @renovate[bot] in #8845, #8906
• Update app-protect-attack-signatures to 2026 versions by @nginx-bot in #8865
• Update module golang.org/x/tools to v0.41.0 (release-5.3) by @renovate[bot] in #8864
• Update aws-sdk-go-v2 monorepo (release-5.3) by @renovate[bot] in #8855
• Update waf to 5.11.0 on release 5.3 by @javorszky in #8875
• Update nap to 511 on release branch by @javorszky in #8879
• Update quay.io/keycloak/keycloak Docker tag to v26.5.2 (release-5.3) by @renovate[bot] in #8885, #8967
• Update golangci/golangci-lint Docker tag to v2.8.0 (release-5.3) by @renovate[bot] in #8833
• Update module sigs.k8s.io/controller-tools to v0.20.0 (release-5.3) by @renovate[bot] in #8769
• Update module github.com/gruntwork-io/terratest to v0.55.0 (release-5.3) by @renovate[bot] in #8886
• Update dependency go to v1.25.6 (release-5.3) by @renovate[bot] in #8894
• Update module sigs.k8s.io/structured-merge-diff/v6 to v6.3.1 (release-5.3) by @renovate[bot] in #8895
• Update pre-commit hook psf/black-pre-commit-mirror to v26 (release-5.3) by @renovate[bot] in #8912
• Update redhat/ubi9-minimal Docker tag to v9.7-1768783948 (release-5.3) by @renovate[bot] in #8927, #8983
• Update docker/dockerfile Docker tag to v1.21 (release-5.3) by @renovate[bot] in #8955
• Update module github.com/aws/aws-sdk-go-v2/service/marketplacemetering to v1.35.6 (release-5.3) by @renovate[bot] in #8954
• Update pre-commit hook python-jsonschema/check-jsonschema to v0.36.1 (release-5.3) by @renovate[bot] in #8981

Full Changelog: v5.3.1...v5.3.2

Upgrade

• For NGINX, use the v5.3.2 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.3.2 images from the F5 Container registry or build your own image using the v5.3.2 source code.
• For Helm, use version 2.4.2 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.2/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.2/deployments/helm-chart
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.3.1

What's Changed

🐛 Bug Fixes

• Update stub_status client path by @vepatel in #8690
• Update service template for ipFamilies by @vepatel in #8731
• [Security] Fix CVE-2025-14727 Adding more validation on rewrite-target by @vepatel in #8743

🔨 Maintenance

• Bump NIC version to 5.3.1 and helm chart version to 2.4.1 by @javorszky in #8739

📝 Documentation

• Update versions of nic (5.3.1), helm chart (2.4.1), operator (3.4.1) by @javorszky in #8741

⬆️ Dependencies

• Update NGINX Agent to 3.6.0 by @AlexFenlon in #8703
• update nginx oss to 1.29.4 and alpine base to 3.23 by @vepatel in #8736
• Update redhat/ubi9 Docker tag to v9.7-1764794285 (release-5.3) by @renovate[bot] in #8636
• Update nginx:1.29.3 Docker digest to 2f4e101 (release-5.3) by @renovate[bot] in #8663
• Update quay.io/jetstack/cert-manager-controller Docker tag to v1.19.2 (release-5.3) by @renovate[bot] in #8682
• Update redhat/ubi9-minimal Docker tag to v9.7-1764794109 (release-5.3) by @renovate[bot] in #8637
• Update module golang.org/x/tools to v0.40.0 (release-5.3) by @renovate[bot] in #8664
• Update quay.io/skopeo/stable Docker tag to v1.21.0 (release-5.3) by @renovate[bot] in #8702
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to c69c8a1 (release-5.3) by @renovate[bot] in #8699
• Update pre-commit hook psf/black-pre-commit-mirror to v25.12.0 (release-5.3) by @renovate[bot] in #8666
• Update module github.com/gkampitakis/go-snaps to v0.5.18 (release-5.3) by @renovate[bot] in #8635
• Update kubernetes packages to v0.34.3 (release-5.3) by @renovate[bot] in #8701
• Update golangci/golangci-lint Docker tag to v2.7.2 (release-5.3) by @renovate[bot] in #8639
• Update quay.io/jetstack/cert-manager-cainjector Docker tag to v1.19.2 (release-5.3) by @renovate[bot] in #8681
• Update module github.com/cert-manager/cert-manager to v1.19.2 (release-5.3) by @renovate[bot] in #8679
• Update quay.io/jetstack/cert-manager-webhook Docker tag to v1.19.2 (release-5.3) by @renovate[bot] in #8683
• Update coredns/coredns Docker tag to v1.13.2 (release-5.3) by @renovate[bot] in #8700
• Update pre-commit hook DavidAnson/markdownlint-cli2 to v0.20.0 (release-5.3) by @renovate[bot] in #8647
• Update debian:12-slim Docker digest to e899040 (release-5.3) by @renovate[bot] in #8662
• Update python:3.14-trixie Docker digest to 5093d1e (release-5.3) by @renovate[bot] in #8632, #8727
• Update opentelemetry-go monorepo to v1.39.0 (release-5.3) by @renovate[bot] in #8665
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to 6b69a5d (release-5.3) by @renovate[bot] in #8698
• Update kindest/node Docker tag to v1.34.2 (release-5.3) by @renovate[bot] in #8718
• Update aws-sdk-go-v2 monorepo (release-5.3) by @renovate[bot] in #8633
• Update pre-commit hook python-jsonschema/check-jsonschema to v0.36.0 (release-5.3) by @renovate[bot] in #8729

Full Changelog: v5.3.0...v5.3.1

Upgrade

• For NGINX, use the v5.3.1 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.3.1 images from the F5 Container registry or build your own image using the v5.3.1 source code.
• For Helm, use version 2.4.1 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.1/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.1/deployments/helm-chart
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.3.0

What's Changed

🚀 Features

• add sslVerify for jwksUri by @vepatel in #8292
• Add support for ssl ciphers related annotations by @vepatel in #8447
• Implement OIDC front channel logout NGINX directives by @javorszky in #8340
• Add OIDC timeout customization to ConfigMap by @AlexFenlon in #8495
• Support namespaced upstream service reference in VirtualServer by @haywoodsh in #8453
• add rewrite-target annotation by @vepatel in #8508
• Add client-body-buffer-size directive to Ingress Annotations & Configmap by @AlexFenlon in #8548
• Add client-body-buffer-size directive to VirtualServer by @AlexFenlon in #8557
• Add OIDC Policy IDP TLS validation by @pdabelf5 in #8556
• extend cache policy for more configurable parameters by @haywoodsh in #8533

🐛 Bug Fixes

• remove type field for objects with schema ref by @vepatel in #8299
• Cleanup stale socket files on startup by @AlexFenlon in #8455

📦 Helm Chart

• Include metrics in the helm agent config by @dareste in #8404
• Optionally create HorizontalPodAutoscaler by @pdabelf5 in #8452

🧪 Tests

• Wrap oidc fclo initiated test in a while loop by @javorszky in #8460
• Disable failing foreign upstream test by @pdabelf5 in #8546
• Change foreign upstream resource creation order by @haywoodsh in #8535

🔨 Maintenance

• Version Bump for 5.3.0 by @github-actions[bot] in #8241
• update script to include statefulset yaml by @vepatel in #8259
• fix dry-run logic for docs PR by @vepatel in #8261
• add cache policy to telemetry by @vepatel in #8265
• Use F5 self-hosted runners by @AlexFenlon in #8268
• Fix helm not found in CI pipeline by @AlexFenlon in #8281
• Login to dockerhub when building authenticated images by @pdabelf5 in #8293
• Update Community Call dates by @AlexFenlon in #8295
• Pin all NAP WAF package versions by @pdabelf5 in #8317
• Pin goreleaser version & update with renovate by @pdabelf5 in #8319
• Add assertions document to binary build workflow by @pdabelf5 in #8336
• Only add assertion doc on release runs by @pdabelf5 in #8345
• Update k8s variable syntax for minikube & kind by @pdabelf5 in #8347
• Re-enable NGINX bot by @pdabelf5 in #8354
• Fix Snapshots failing in Version Bump workflow by @AlexFenlon in #8357
• Update k8s version fetch logic by @vepatel in #8379
• Group python and actions changes into one PR of each type by @pdabelf5 in #8393
• Allow easier updates to Agent versions on NAP images by @AlexFenlon in #8303
• Update release with f5 runner by @vepatel in #8402
• Publish helm chart to nginx-charts by @pdabelf5 in #8403
• Remove assertion doc from CI by @AlexFenlon in #8422
• Update goproxy logic & cleanup netrc by @pdabelf5 in #8421
• Add versions to bug report template by @pdabelf5 in #8434
• Split Python tests to reduce run time by @pdabelf5 in #8419
• Replace discouraged PlayWright functions in our pytests by @javorszky in #8467
• Remove unused pytest option by @pdabelf5 in #8531
• Migrate client secret to OIDC for Azure Marketplace by @pdabelf5 in #8532
• Migrate additional Github secrets to Azure Vault by @AlexFenlon in #8528
• Migrate OpenShift & Plus secrets to Azure Vault by @pdabelf5 in #8515
• Migrate NGINX Plus secrets to Azure Vault by @pdabelf5 in #8517
• Migrate docker & nginx bot credentials to Azure Vault by @pdabelf5 in #8530
• Migrate GCR secrets to Azure Vault by @pdabelf5 in #8518
• Fix spacing in README tables by @AlexFenlon in #8597
• Update automated release docs to match previous version by @AlexFenlon in #8591
• update nginx plus waf pkg and alpine base version by @vepatel in #8600
• [cherry-pick] fix git user for release wf by @nginx-bot in #8602
• Fix shell variable globbing issue using quotes by @nginx-bot in #8605
• Update permissions on image promotion CI by @nginx-bot in #8610

📝 Documentation

• Fix foreign service example by @haywoodsh in #8516
• Update README links to reflect documentation URL changes by @ADubhlaoich in #8519
• Update Helm chart NOTES.txt with newer documentation links by @ADubhlaoich in #8586
• update release branch docs by @vepatel in #8653

⬆️ Dependencies

87 changes

• chore(deps): bump the python group with 2 updates by @dependabot[bot] in #8243
• Docker image update e10758e1 by @github-actions[bot] in #8244
• chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 in the actions group by @dependabot[bot] in #8249, #8263
• chore(deps): bump python from d99178e to a805109 in /tests by @dependabot[bot] in #8248, #8254
• Bump preflight version to v1.14.1 by @pdabelf5 in #8252
• chore(deps): bump the actions group with 2 updates by @dependabot[bot] in #8269
• chore(deps): bump the python group with 5 updates by @dependabot[bot] in #8270
• chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 in the actions group by @dependabot[bot] in #8275
• Docker image update 80954460 by @github-actions[bot] in #8279
• Docker image update 11a34148 by @github-actions[bot] in #8284
• chore(deps): bump the python group with 5 updates by @dependabot[bot] in #8287
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #8286, #8369, #8423, #8539, #8566
• chore: Configure Renovate by @renovate[bot] in #8298
• chore(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #8300
• Update quay.io/keycloak/keycloak Docker tag to v26.4.7 (main) by @renovate[bot] in #8308, #8459, #8510, #8565, #8576, #8595
• Update docker/dockerfile Docker tag to v1.20 (main) by @renovate[bot] in #8307, #8374, #8570, #8584
• Update dependency requests to v2.32.5 by @renovate[bot] in #8312
• Docker ima...

v5.2.1

What's Changed

🐛 Bug Fixes

• Remove type field for objects with schema ref by @vepatel in #8302

🔨 Maintenance

• Pin NGINX OSS to 1.29.1 by @AlexFenlon in #8386
• Re-enable NGINX bot by @pdabelf5 in #8363
• Version Bump for 5.2.1 by @github-actions[bot] in #8353
• Update kubernetes version to v1.34.0 in helm schema by @nginx-bot in #8378

📝 Documentation

• Release 5.2.1 by @vepatel in #8368

⬆️ Dependencies

• Update WAF 5.9.0 by @AlexFenlon in #8348
• Update dependencies by @vepatel in #8273
• Docker image update 80954460 by @github-actions[bot] in #8280
• Docker image update 11a34148 by @github-actions[bot] in #8291
• Docker image update 119a0c53 by @github-actions[bot] in #8320
• Docker image update 40eeffe2 by @github-actions[bot] in #8331
• Update aws-sdk-go-v2 monorepo by @github-actions[bot] in #8321
• Update module github.com/gkampitakis/go-snaps to v0.5.15 by @github-actions[bot] in #8330
• Update module github.com/golang-jwt/jwt/v4 to v5 by @github-actions[bot] in #8352
• Update k8s.io/utils digest to bc988d5 by @github-actions[bot] in #8358

Other Changes

• [pre-commit.ci] pre-commit autoupdate by @github-actions[bot] in #8297
• Update dependency cryptography to v46.0.2 by @github-actions[bot] in #8325
• Update dependency certifi to v2025.8.3 by @github-actions[bot] in #8346
• Update dependency grpcio to v1.75.1 by @github-actions[bot] in #8359
• Update examples with keycloak 26.x by @nginx-bot in #8365
• [pre-commit.ci] pre-commit autoupdate by @nginx-bot in #8370
• Update balabit/syslog-ng Docker tag to v4.10.1 by @nginx-bot in #8373
• Update docker/dockerfile Docker tag to v1.19 by @nginx-bot in #8377

Full Changelog: v5.2.0...v5.2.1

Upgrade

• For NGINX, use the v5.2.1 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.2.1 images from the F5 Container registry or build your own image using the v5.2.1 source code.
• For Helm, use version 2.3.1 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.2.1/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.2.1/deployments/helm-chart
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator

v5.2.0

What's Changed

🚀 Features

• Add nginx content cache as cache policy by @vepatel in #8005
• StatefulSet support by @haywoodsh in #8159
• Add support for automatic adjustment of buffer related directives by @javorszky in #8133
• Allow StartupProbe to be configured via helm by @vepatel in #8011
• Add SNI to NIC JWT Policy by @javorszky in #7993
• Add support for VIOL_BOT_CLIENT and VIOL_GEOLOCATION violations by @mikegoltsman in #8093
• Add globalConfigurationCustomName parameter by @frantsao and @mohamadaldawamnah in #8142
• Add support for FIPS 140-3 compliance by @AlexFenlon in #8195
• Add support for N+ license expiry in prometheus metrics by @vepatel in #8229

🧪 Tests

• Update tests README by @vepatel in #7951
• Update snaps by @vepatel in #8032
• Ensure packages are installed on images by @pdabelf5 in #7991
• Add service insight pytest for cross namespace VSR by @pdabelf5 in #8055
• Add integration test for agent by @mohamadaldawamnah in #8094
• Add integration test to App Protect agent file by @mohamadaldawamnah in #8116
• Fix Helm tests failing with latest version by @AlexFenlon in #8179

🔨 Maintenance

• add helm gh action by @vepatel in #8175
• Add namespaced secret to example by @vepatel in #7941
• Refine label additions that drive release categories by @pdabelf5 in #7957
• Clean up docker scout scan job names by @pdabelf5 in #7965
• Update release notes scripts by @pdabelf5 in #7962
• Version Bump for 5.2.0 by @github-actions[bot] in #7939
• Pin OSS version in Dockerfile by @pdabelf5 in #7989
• Always build the binary when we force a rebuild by @pdabelf5 in #7981
• Update community call dates by @AlexFenlon in #8034
• add crd docs in dev docs by @vepatel in #7992
• Collapse package report comment by @pdabelf5 in #8045
• Add GOPROXY to binary builds by @pdabelf5 in #8053
• Add control labels to Agent for N1C by @AlexFenlon in #8068
• Remove extra double quote in variable assignment by @pdabelf5 in #8067
• update crd descriptions by @mohamadaldawamnah in #8038
• Remove aws marketplace images from patching workflow by @pdabelf5 in #8050
• Update to ubuntu 24.04 runners by @pdabelf5 in #8081
• Remove unnecessary crd files by @pdabelf5 in #8117
• Setup netrc when forcing build by @pdabelf5 in #8151
• CRD changes trigger pytests by @pdabelf5 in #8165
• Always run tests when inputs.run_tests is true by @pdabelf5 in #8166
• Bring Release 5.1.1 to main by @AlexFenlon in #8163
• Remove existence check from templates before range by @javorszky in #8181
• Update CI workflow_call boolean inputs by @pdabelf5 in #8197
• remove http cache for jwks by @vepatel in #8198
• Update proxy endpoint for published builds by @pdabelf5 in #8194
• Adds sha256 hash to quay.io/skopeo import by @javorszky in #8196
• remove shared cache config from helm by @vepatel in #8211
• Fix gofumpt empty string errors by @AlexFenlon in #8221
• update golang to 1.25 by @vepatel in #8220
• Correct yaml indentation for daemon-set readiness probe by @pdabelf5 in #8233
• Fix Proxy Buffer Config Adjustments by @AlexFenlon in #8226
• update dependencies by @vepatel in #8251

📝 Documentation

• update main version by @vepatel in #8087
• Fix hyperlink to image build procedure in README.md by @ogipierogi in #8157
• Fix broken hyperlink to F5 Container Registry Download doc in README.md by @ogipierogi in #8158
• Ensure all links resolve correctly in README.md by @pdabelf5 in #8171
• Release 5.2.0 by @github-actions[bot] in #8258

⬆️ Dependencies

• Update NGINX Agent to 3.3 by @AlexFenlon in #8208
• Docker image update 1e04714a by @github-actions[bot] in #7946
• Docker image update e4f97356 by @github-actions[bot] in #7961
• chore(deps): bump the go group with 2 updates by @dependabot[bot] in #7959
• Docker image update 203eea12 by @github-actions[bot] in #7977
• Docker image update 230ecec3 by @github-actions[bot] in #7979
• chore(deps): bump the docker-images group in /build with 3 updates by @dependabot[bot] in #7978
• chore(deps): bump github.com/cert-manager/cert-manager from 1.18.1 to 1.18.2 in the go group by @dependabot[bot] in #7983
• Docker image update 7a5ba83b by @github-actions[bot] in #7984
• Docker image update 6a8781f0 by @github-actions[bot] in #7996
• Docker image update 5f914290 by @github-actions[bot] in #8012
• chore(deps): bump the go group across 1 directory with 6 updates by @dependabot[bot] in #8037
• Docker image update 8f0038c0 by @github-actions[bot] in #8036
• Docker image update 39f71fa3 by @github-actions[bot] in #8044
• chore(deps): bump the go group with 2 updates by @dependabot[bot] in #8057
• Docker image update b2e33b58 by @github-actions[bot] in #8063
• chore(deps): bump the go group across 1 directory with 4 updates by @dependabot[bot] in #8083
• Docker image update 92ebb2db by @github-actions[bot] in #8085
• Docker image update f1ecbe96 by @github-actions[bot] in #8107
• chore(deps): bump the go group across 1 directory with 3 updates by @dependabot[bot] in #8096
• Docker image update 68bc681d by @github-actions[bot] in #8114
• chore(deps): bump the go group with 2 updates by @dependabot[bot] in #8126
• Docker image update 15b09e30 by @github-actions[bot] in #8128
• Docker image update 8f6021bc by @github-actions[bot] in #8134
• Docker image update 883e338e by @github-actions[bot] in #8147
• chore(deps): bump the go group with 5 updates by @dependabot[bot] in #8143
• Docker image update 3952b73e by @github-actions[bot] in #8154
• chore(deps): bump the go group with 3 updates by @dependabot[bot] in #8183
• Docker image update 24ce9eb1 by @github-actions[bot] in #8173
• chore(deps): bump the go group with 3 updates by @dependabot[bot] in #8186
• Docker image update 5784bad7 by @github-actions[bot] in #818...

v5.1.1

What's Changed

🐛 Bug Fixes

• Update interval checks for mgmt directive by @vepatel in #8043
• Status updates for VS endpoints by @vepatel in #8074
• Don't send request headers & body to jwks uri by @pdabelf5 in #8119

📦 Helm Chart

• Update agent endpoint by @pdabelf5 in #8028

🧪 Tests

• update test dockerfile by @vepatel in #8136

🔨 Maintenance

• Update release upload to azure workflow by @pdabelf5 in #8017

📝 Documentation

• Add production documentation link for OpenTelemetry by @ADubhlaoich in #8041

⬆️ Dependencies

• Docker image update dbfdbafc (#8024) by @pdabelf5 in #8030
• Docker image update b2e33b58 by @github-actions[bot] in #8080
• Docker image update 783e8763 by @github-actions[bot] in #8112
• chore(deps): bump the go group across 1 directory with 3 updates (#8096) by @pdabelf5 in #8115
• Update Go Group on release-5.1 by @AlexFenlon in #8131
• Update to NGINX OSS 1.29.1, PLUS R35, Agent v3.2, App Protect and Alpine 3.22 by @AlexFenlon in #8139
• Dependancies update for 5.1.1 by @AlexFenlon in #8148
• Docker image update 8f6021bc by @github-actions[bot] in #8140

Full Changelog: v5.1.0...v5.1.1

Upgrade

• For NGINX, use the v5.1.1 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.1.1 images from the F5 Container registry or build your own image using the v5.1.1 source code.
• For Helm, use version 2.2.2 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.1.1/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.1.1/deployments/helm-chart
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator