enterprise-2.20.1
July 24, 2026
The 2.20.1 stable point release includes FIPS support. It fixes a panic in
linkerd policy generate and the proxy now disallows requests to undefined
service ports (previously only denied when no ServiceProfile existed). It also
updates some dependencies to address reported CVEs in underlying components.
Previous release: enterprise-2.20.0.
Supported Kubernetes versions
For this release, the minimum supported Kubernetes version remains 1.31, and the maximum supported Kubernetes version remains 1.35.
Who should upgrade?
Customers who require FIPS support or need bug fixes introduced in 2.20 should upgrade when feasible.
Customers who rely on connecting to undefined ports should take note of the breaking change and see upgrade guidance.
Other users may upgrade to this release at their convenience to take advantage of the fixes and addressed CVEs.
Upgrade guidance
This is a stable point release designed to introduce minimal change. Please see the instructions in Upgrading BEL for how to upgrade.
To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension v0.40.3 or later.
Changelog
- Breaking change: Meshed connections to a ClusterIP Service on a port absent from the Service’s spec are now denied even when a ServiceProfile is defined for that Service (previously only denied when no ServiceProfile existed). Affects you only if you rely on connecting to undefined ports. [#15473]
- Fixed panic in
linkerd policy generatecommand, and add support for proxies injected in (the now default) native sidecar mode. - Update
golangto remediate- GO-2026-5856 (maps to CVE-2026-42505)
- GO-2026-4970 (maps to CVE-2026-39822)
- Update
golang.org/x/textto remediate- GO-2026-5970 (maps to CVE-2026-56852)
- Update
oras.land/oras-go/v2to remediate - Update
google.golang.org/grpcto remediate - Update
opentelemetryto remediate - Update
libcryptto remediate