- Updated Envoy Docker images and Envoy Mobile root bundle to drop compromised eMudhra intermediate CAs, fixing upstream security issue.
- Refreshed webpki roots in the Hickory DNS resolver so DNS-over-TLS/HTTPS no longer trusts compromised CAs.
- Adjusted Istio contrib peer metadata conversion to prefer app and version labels, aligning reported app/version metadata.