18 Dec 2025

#### Bug fixes

- Fix IPPool CIDR Validation Failing on Semantically-Identical IPv6 CIDRs. [calico 11438](https://github.com/projectcalico/calico/pull/11438) (@skoryk-oleksandr)
- Fix AllowSpoofedSourcePrefixes for dual stack clusters. [calico 11372](https://github.com/projectcalico/calico/pull/11372) (@lucastigera)
- Openstack: Stop compressing DWARF debugging information with dwz because Golang 1.25 has moved to the unsupported DWARF 5. [calico 11422](https://github.com/projectcalico/calico/pull/11422) (@nelljerram)

##### eBPF

- Fixed bug where ingress and egress policy program indexes were confused, resulting in cleaning up the wrong policy program. [calico 11569](https://github.com/projectcalico/calico/pull/11569) (@fasaxc)
- Fixed map operations for older kernels. [calico 11497](https://github.com/projectcalico/calico/pull/11497) (@sridhartigera)
- Fixed loading connecttime load balancer program in 6.12 kernel. [calico 11407](https://github.com/projectcalico/calico/pull/11407) (@sridhartigera)

#### Other changes

- Bump bundled Envoy Gateway to v1.5.6. [calico 11528](https://github.com/projectcalico/calico/pull/11528) (@nelljerram)
- Re-create and swap out Calico ipsets that are not possible to list due to different failures like user-space/kernel incompatibility. [calico 11464](https://github.com/projectcalico/calico/pull/11464) (@mazdakn)
- Felix now explicitly sets priority 1024 for IPv6 routes instead of relying on kernel default, ensuring routes round-trip correctly when read from the kernel. [calico 11394](https://github.com/projectcalico/calico/pull/11394) (@fasaxc)
