April 2026 — kgateway-dev/kgateway: Delivered a critical RBAC policy correctness fix that addresses non-matching traffic handling for Deny actions. The on_no_match flag is now derived from the policy action, ensuring non-matching traffic is allowed when appropriate, instead of being universally denied by a hardcoded value. Added targeted tests to verify RBAC behavior across multiple scenarios, increasing confidence in policy correctness.

Month 2026-03 — Security hardening and reliability improvements across solo-io/gloo dependencies and tooling, delivering stronger security posture, more robust CI, and streamlined dependency management. Key updates include dependency upgrades across example projects to address vulnerabilities, upgrading ArgoCD in nightly tests for testing accuracy, and upgrading Go to 1.26.1 with GOTOOLCHAIN auto to enhance build stability and CVE remediation.

February 2026 focused on extending Gloo Edge with HTTPS forward proxy capabilities by adding CONNECT protocol termination. Delivered a concrete, test-backed feature with configuration options and documentation updates, enabling broader deployment scenarios and customer value.