Folks it has been a wild ride for maintaining such an impactful project. I have learned a lot about OSS and met some incredible people along the way. We have released our final versions to support k8s 1.35 and patch this latest CVE
https://github.com/kubernetes/kubernetes/issues/137560 . Unless there are major regressions with this patch, we plan to archive the repo after Kubecon, images and helm charts of released versions will still be available for users.
The Kubernetes SRC will remain the CVE Numbering Authority of scope for issuing CVEs in ingress-nginx code that was written by Kubernetes contributors, and will continue to serve in that capacity. They will not be issuing patch releases for any vulnerabilities reported after EoL, nor responding to other vulnerability-related issues such as CVEs detected in dependencies or release artifacts. If other projects maintain a fork of ingress-nginx, they can request CVE issuance from SRE instead of having to go to MITRE. Per SRC Member
@Tabitha SablePlease join us at Kubecon EU 2026 with Gateway api maintainers to discuss more about the future of Gateway and moving away from ingress
https://kccnceu2026.sched.com/event/2EsAI/gateway-api-bridging-the-gap-from-ingress-to-[…]na-lach-rostislav-bobrovsky-google-norwin-schnyder-airlock