13 Nov 2025

#### Bug fixes

- ebpf: kube-proxy binds service health probes to node IPs instead of "any" [calico 11300](https://github.com/projectcalico/calico/pull/11300) (@tomastigera)
- fix (release-tool): include image tarballs in release archive file [calico 11295](https://github.com/projectcalico/calico/pull/11295) (@radTuti)
- Fix BGP advertisement of externalIP addresses on Services with type=ClusterIP. [calico 11234](https://github.com/projectcalico/calico/pull/11234) (@caseydavenport)
- Fix IPAM block leak of older blocks when deleting IP pools. [calico 11233](https://github.com/projectcalico/calico/pull/11233) (@caseydavenport)
- ebpf: start only a single kube-proxy health-server in dual stack mode [calico 11224](https://github.com/projectcalico/calico/pull/11224) (@tomastigera)
- Bugfix: reinstate support for VMs that are configured not to respond to ARP requests. [calico 11100](https://github.com/projectcalico/calico/pull/11100) (@nelljerram)

#### Other changes

- updated tigera-operator RBAC: create mutatingwebhooks, and update mutatingwebhooks. update restricted to specific resourceNames: envoy-gateway-topology-injector.tigera-gateway [calico 11277](https://github.com/projectcalico/calico/pull/11277) (@electricjesus)
- Default KubeControllersConfiguration.LoadBalancer when not set to AllServices [calico 11266](https://github.com/projectcalico/calico/pull/11266) (@MichalFupso)
