apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issues:
- 40474
releaseNotes:
- |
  **Fixed** an issue causing traffic to not match (and return a `404`) when using wildcard domain names and including an unexpected port in the `Host` header.
- |
  **Fixed** an issue causing traffic to match an unexpected route when using wildcard domain names and including an port in the `Host` header.
- |

apiVersion: release-notes/v2
kind: bug-fix
area: security
issue: [51556]
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: installation

issue:
  - 39599

releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: installation
issue:
- 43312
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
- 32210
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |
    **Fixed** a regression in Istio 1.21.0 causing `VirtualService`s routing to `ExternalName` services to not work when 

// added; while a non-nil error will block the request If the token selected is not found, no error
// will be returned, causing no authorization header to be set. This ensures that even if the JWT
// token is missing (for example, on a VM that has rebooted, causing the token to be removed from
// volatile memory), we can still proceed and allow other authentication methods to potentially
// handle the request, such as mTLS.

apiVersion: release-notes/v2
kind: bug-fix
area: installation
issue:
  - 43632
  - 45034
releaseNotes:
- |

issue:
- 40801
releaseNotes:
- |
  **Fixed** an issue with where a `DestinationRule` applying to multiple services could incorrectly apply an unexpected `subjectAltNames` field.
- |

  - eu.bookinfo.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  endpoints:
  # Rather than relying on an external host that might become unreachable (causing test failures)
  # we can mock the external endpoint using service t which has no sidecar.
  - address: t.istio-system.svc.cluster.local # TODO: this is brittle
    ports: