This is a patch release with dependency updates and some minor fixes.

Minor fixes

• bandwidth: handle nil bandwidth in CHECK by @squeed in #1222
• vrf: fix route filtering to preserve IPAM-configured routes by @mlguerrero12 in #1227
• CVE-2025-52881: Bump selinux to 1.13.0 by @sbiradar10 in #1231
• bridge: include attempted IP address in AddrAdd error message by @Amulyam24 in #1225

New Contributors

• @sbiradar10 made their first contribution in #1231
• @Amulyam24 made their first contribution in #1225

Full Changelog: v1.9.0...v1.9.1

What's Changed

This release fixes CVE-2025-67499, a bug in the nftables backend for the portmap plugin that can cause traffic to be unexpectedly intercepted.

Bugs

• portmap: ensure nftables backend only intercept local traffic by @champtar in #1210.

Other changes

• Fix file exists errro in dummy cni by @liuyuan10 in #1205
• Ignore settling with down state since it would never settle by @bn222 in #1207

Full Changelog: v1.8.0...v1.9.0

The Bridge CNI plugin has removed limitations on VLAN trunk implementation. This aligns with recommended access and trunk port configurations, ensuring proper VLAN isolation and enhanced usability.

What's Changed

• Allow vlan parameter to set native vlan on trunk ports by @mlguerrero12 in #1180
• Set default value of PreserveDefaultVlan to False by @mlguerrero12 in #1181
• remove duplicate route.Table and route.Scope assignments by @runsisi in #1192
• Set value of gw to nil for opt121 routes in DHCP by @omartin2010 in #1187

New Contributors

• @runsisi made their first contribution in #1192
• @omartin2010 made their first contribution in #1187

Full Changelog: v1.7.0...v1.8.0

What's Changed

(Administrative note: the GitHub release v1.7.0 somehow got split in to two immutable releases. v1.7.1 is a re-release that corrects the issue. Apologies for the trouble).

New features / options

• bridge: Add option to enable port isolation by @ormergi in #1141
• Add a new firewall ingress-policy "isolated" by @swagatbora90 in #1140

Other improvements

• host-device: Return interface name in result by @sriramy in #1147
• Add retries for netlink calls that may return a EINTR by @adrianmoisey in #1154
• Enable KeepAddrOnDown for ipv6 addresses by @mlguerrero12 in #1155
• Implement exponential backoff in vrf plugin by @mlguerrero12 in #1156

Bug fixes

• DHCP lease maintenance should terminate when interface no longer exists. by @dougbtv in #1143
• Fix addresses and routes reinserted to the VRF by @mlguerrero12 in #1151
• Check error returned by ipv6 SettleAddresses by @mlguerrero12 in #1168

New Contributors

• @sriramy made their first contribution in #1147
• @swagatbora90 made their first contribution in #1140
• @dougbtv made their first contribution in #1143
• @adrianmoisey made their first contribution in #1154

Full Changelog: v1.6.2...v1.7.1

(administrative note: release v1.6.1 was somehow double-created in GitHub; v1.6.2 is identical but fixes the duplication.)

What's Changed

• portmap: fix nftables backend by @champtar in #1116
• ipmasq: fix nftables backend by @champtar in #1120
• portmap: fix iptables conditions detection by @champtar in #1117

Full Changelog: v1.6.0...v1.6.2

portmap: fix iptables conditions detection

As show in the docs, iptables conditions can also start with '!'

Fixes 01a94e1

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>

This is the v1.6.0 release of the CNI community plugins.

Changelog

Important

• revert htb changes due to ongoing issues and missing maintainer by @h0nIg in #1105. This reverts the (undocumented) feature added in v1.5 where traffic from a specific CIDR would be exempted from bandwidth shaping. Unfortunately the implementation was lacking. We hope to re-add this feature in the future.

New features

• nftables support for ipmasq and portmap by @danwinship in #935
• dhcp: Add priority option to dhcp. by @lisongmin in #1091

CNI v1.1 support

• Use of Scope for routes in IPAM by @LionelJouin in #1087
• Pass status along ipam update by @LionelJouin in #1082

Other improvements

• macvlan: add bcqueuelen setting by @champtar in #1074
• SBR: option to pass the table id by @LionelJouin in #1088
• host-device: use temp network namespace for rename by @champtar in #1073

Fixes

• Fix unnecessary retrying when the link is down in dhcp by @lisongmin in #1076
• Fix inadvertent txqueuelen being set to zero by @gudmundur in #1100
• VRF: Wait for the local/host routes to be added by @LionelJouin in #1104
• fix(dhcp): can not renew an ip address by @lisongmin in #1092

Misc / CI

• Change chown to change current dir as well by @s1061123 in #1058
• ci, go.mod: bump to go 1.23 by @squeed in #1094
• Ignore link-local routes in SBR tests by @LionelJouin in #1102

New Contributors

• @lisongmin made their first contribution in #1076
• @LionelJouin made their first contribution in #1088
• @gudmundur made their first contribution in #1100
• @h0nIg made their first contribution in #1105

Full Changelog: v1.5.1...v1.6.0