Merge branch 'main' into docs/authentication-filter-proposal-functional-tests

Author: shaun-nx

.github/CHANGELOG_TEMPLATE.md

@@ -41,3 +41,4 @@ CONTAINER IMAGES:
 - Control plane: `ghcr.io/nginx/nginx-gateway-fabric:%%VERSION%%`
 - Data plane: `ghcr.io/nginx/nginx-gateway-fabric/nginx:%%VERSION%%`
 - Data plane with NGINX Plus: `private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:%%VERSION%%`
+- Operator: `ghcr.io/nginx/nginx-gateway-fabric/operator:%%VERSION%%`

.github/workflows/build.yml

@@ -185,7 +185,7 @@ jobs:
       - name: Scan SBOM
         id: scan
         if: ${{ !inputs.dry_run }}
-        uses: anchore/scan-action@40a61b52209e9d50e87917c5b901783d546b12d0 # v7.2.1
+        uses: anchore/scan-action@3c9a191a0fbab285ca6b8530b5de5a642cba332f # v7.2.2
         with:
           sbom: "sbom-${{ inputs.image }}.json"
           only-fixed: true

.github/workflows/ci.yml

@@ -194,7 +194,7 @@ jobs:
         run: make unit-test
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -222,7 +222,7 @@ jobs:
         run: npm --prefix ${{ github.workspace }}/internal/controller/nginx/modules install-ci-test
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -285,7 +285,7 @@ jobs:
 
       - name: Download Syft
         if: ${{ inputs.is_production_release }}
-        uses: anchore/sbom-action/download-syft@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10
+        uses: anchore/sbom-action/download-syft@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
 
       - name: Install Cosign
         if: ${{ inputs.is_production_release }}

.github/workflows/lint.yml

@@ -50,7 +50,7 @@ jobs:
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           working-directory: ${{ matrix.directory }}
-          version: v2.6.2 # renovate: datasource=github-tags depName=golangci/golangci-lint
+          version: v2.7.2 # renovate: datasource=github-tags depName=golangci/golangci-lint
 
   njs-lint:
     name: NJS Lint

.github/workflows/nfr.yml

@@ -191,7 +191,7 @@ jobs:
           merge-multiple: true
 
       - name: Open a PR with the results
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: NFR Test Results for NGF version ${{ needs.vars.outputs.version }}

.github/workflows/release-pr.yml

@@ -82,7 +82,7 @@ jobs:
           make generate-all
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: Release ${{ inputs.version }}

.pre-commit-config.yaml

@@ -38,7 +38,7 @@ repos:
           - javascript
 
   - repo: https://github.com/golangci/golangci-lint
-    rev: v2.6.2
+    rev: v2.7.2
     hooks:
       - id: golangci-lint-full
         name: golangci-lint-root

CHANGELOG.md

@@ -4,6 +4,35 @@ This document includes a curated changelog for each release. We also publish a c
 a [GitHub release](https://github.com/nginx/nginx-gateway-fabric/releases), which, by contrast, is auto-generated
 and includes links to all PRs that went into the release.
 
+## Release 2.2.2
+
+_December 10, 2025_
+
+BUG FIXES:
+
+- Complete processing in flight requests and ensure only main NGINX process is reloaded. [1319](https://github.com/nginx/agent/pull/1391)
+- Fix permission issue with nginx-gateway container for UBI. [4404](https://github.com/nginx/nginx-gateway-fabric/pull/4404)
+
+HELM CHART:
+
+- The version of the Helm chart is now 2.2.2
+
+COMPATIBILITY:
+
+- Gateway API version: `1.3.0`
+- Gateway API Inference Extension version: `1.0.1`
+- NGINX version: `1.29.2`
+- NGINX Plus version: `R35`
+- NGINX Agent version: `v3.6.0`
+- Kubernetes version: `1.25+`
+
+CONTAINER IMAGES:
+
+- Control plane: `ghcr.io/nginx/nginx-gateway-fabric:2.2.2`
+- Data plane: `ghcr.io/nginx/nginx-gateway-fabric/nginx:2.2.2`
+- Data plane with NGINX Plus: `private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:2.2.2`
+- Operator: `ghcr.io/nginx/nginx-gateway-fabric/operator:1.0.2`
+
 ## Release 2.2.1
 
 _November 13, 2025_

Makefile

@@ -24,7 +24,7 @@ GO_LINKER_FLAGS = $(GO_LINKER_FLAGS_OPTIMIZATIONS) $(GO_LINKER_FlAGS_VARS)
 
 # tools versions
 # renovate: datasource=github-tags depName=golangci/golangci-lint
-GOLANGCI_LINT_VERSION = v2.6.2
+GOLANGCI_LINT_VERSION = v2.7.2
 # renovate: datasource=docker depName=kindest/node
 KIND_K8S_VERSION = v1.34.0
 # renovate: datasource=github-tags depName=norwoodj/helm-docs

README.md

@@ -36,7 +36,7 @@ You can find the comprehensive NGINX Gateway Fabric user documentation on the [N
 We publish NGINX Gateway Fabric releases on GitHub. See
 our [releases page](https://github.com/nginx/nginx-gateway-fabric/releases).
 
-The latest release is [2.2.1](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v2.2.1).
+The latest release is [2.2.2](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v2.2.2).
 
 The edge version is useful for experimenting with new features that are not yet published in a release. To use, choose
 the _edge_ version built from the [latest commit](https://github.com/nginx/nginx-gateway-fabric/commits/main)
@@ -47,7 +47,7 @@ to the correct versions:
 
 | Version | Description | Installation Manifests | Documentation and Examples |
 | ------- | ----------- | ---------------------- | -------------------------- |
-| Latest release | For production use | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.1/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.1/examples). |
+| Latest release | For production use | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.2/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.2/examples). |
 | Edge | For experimental use and latest features | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/main/deploy). | [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/main/examples). |
 
 ### Versioning
@@ -69,6 +69,7 @@ The following table lists the software versions NGINX Gateway Fabric supports.
 | NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus | NGINX Agent |
 |----------------------|-------------|------------|-----------|------------|-------------|
 | Edge                 | 1.4.1       | 1.25+      | 1.29.3    | R36        | v3.6.0      |
+| 2.2.2                | 1.3.0       | 1.25+      | 1.29.2    | R35        | v3.6.0      |
 | 2.2.1                | 1.3.0       | 1.25+      | 1.29.2    | R35        | v3.5.0      |
 | 2.2.0                | 1.3.0       | 1.25+      | 1.29.2    | R35        | v3.3.2      |
 | 2.1.4                | 1.3.0       | 1.25+      | 1.29.1    | R35        | v3.3.1      |