diff --git a/CHANGELOG/v1.12.0-rc.1.md b/CHANGELOG/v1.12.0-rc.1.md
new file mode 100644
index 000000000000..eff444ef7303
--- /dev/null
+++ b/CHANGELOG/v1.12.0-rc.1.md
@@ -0,0 +1,446 @@
+π¨ This is a RELEASE CANDIDATE. Use it only for testing purposes. If you find any bugs, file an [issue](https://github.com/kubernetes-sigs/cluster-api/issues/new).
+
+## π Kubernetes version support
+
+- Management Cluster: v1.31.x -> v1.34.x
+- Workload Cluster: v1.29.x -> v1.34.x
+
+[More information about version support can be found here](https://cluster-api.sigs.k8s.io/reference/versions.html)
+
+## Highlights
+
+- Bumped to Go 1.24, controller-runtime v0.22, k8s.io/* v0.34, controller-gen v0.19
+- In-place updates
+ - Cluster API introduces support for update extensions allowing users to execute changes on existing machines without deleting the machines and creating a new one.
+ - Both KCP and Machine deployments support in-place updates based on the new update extension
+ - Can be enabled with the new `InPlaceUpdates` feature gate
+ - More details can be found in the [proposal](https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/proposals/20240807-in-place-updates.md)
+- Chained upgrades
+ - Clusters using managed topologies can now upgrade by more than one minor Kubernetes version by performing chained and efficient upgrades.
+ - Upgrade plan will be computed using Kubernetes version from the ClusterClass or by calling a new runtimeExtension (also defined in the ClusterClass)
+ - Existing lifecycle hooks have been adapted to the new workflow, new lifecycle hooks have been introduced to allow granular control of the upgrade steps.
+ - More details can be found in the [proposal](https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/proposals/20250513-chained-and-efficient-upgrades-for-clusters-with-managed-topologies.md)
+- MachineHealthCheck: Add support for checking Machine conditions (#12827)
+- Machine: First part of the [Taint propagation proposal](https://github.com/kubernetes-sigs/cluster-api/blob/main/docs/proposals/20250513-propogate-taints.md) (Machine/MachineSet/MachineDeployment) (#12936, #12966)
+ - [Feature tracking issue](https://github.com/kubernetes-sigs/cluster-api/issues/12972)
+ - Can be enabled with the new `MachineTaintPropagation` feature gate
+- KCP/CABPK: Add EncryptionAlgorithm field to Kubeadmconfig to support keys generated with `RSA-3072`, `RSA-4096`, `ECDSA-P256`, `ECDSA-P384` (#12859)
+- Introduce ReconcilerRateLimiting feature (#13006)
+ - Can be enabled with the new `ReconcilerRateLimiting` feature gate
+ - Rate-limits all reconcilers to at most 1 request per second
+
+Note: Cluster API is only supported on conformant Kubernetes Clusters and contract-relevant provider resources (e.g. InfraCluster) have to be implemented as CRDs (i.e. not via an aggregated apiserver).
+
+## Other changes
+
+- clusterctl: Add conditions filter for clusterctl describe (#12991)
+- clusterctl: `clusterctl move` blocks when Cluster or ClusterClass is paused (#12786)
+- KCP: Enable websocket dialer with fallback to spdy (for communication with etcd) (#12902)
+- Runtime SDK: Add defensive response status checking in runtime client (#12898)
+- Improved logging across several controllers
+- Improved e2e test coverage, e.g.: CAPD: Add scale from/to 0 support for CAPD (#12572)
+- New providers in clusterctl: HCP (#12800) control plane provider, Metal3 IPAM provider (#12756), metal-stack infrastructure provider (#12925)
+
+## Deprecation and Removals Warning
+
+- ClusterResourceSet: Remove deprecated ClusterResourceSet feature gate (#12950)
+- Reminder: [v1alpha3 & v1alpha4 will be removed in CAPI v1.13](https://github.com/kubernetes-sigs/cluster-api/issues/11919) (they are already not served since a while)
+- Reminder: [v1beta1 is on track to be unserved in CAPI v1.14](https://github.com/kubernetes-sigs/cluster-api/issues/11920)
+ - Reminder: Provider should start implementing the v1beta2 contract ASAP.
+
+For additional details for providers, please take a look at [Cluster API v1.11 compared to v1.12](https://main.cluster-api.sigs.k8s.io/developer/providers/migrations/v1.11-to-v1.12).
+
+## Changes since v1.12.0-rc.0
+## :chart_with_upwards_trend: Overview
+- 14 new commits merged
+- 7 bugs fixed π
+
+## :bug: Bug Fixes
+- ClusterClass: Do not overwrite global http.DefaultClient TLSConfig (#13063)
+- e2e: Fix WaitForMachinesReady interval (#13051)
+- e2e: Increase reconcile timeout for DockerMachine (#13099)
+- KCP: Grant `delete` permissions to Secrets. (#13097)
+- Machine/MachineSet: Use MachineSet template values in completeMoveMachine for in-place updates (#13085)
+- Testing/e2e: Fix unit test flakes, improve clusterctl download error in e2e tests (#13056)
+- util: Fix a panic in conditions.Delete method if the sources condition list is empty (#13053)
+
+## :seedling: Others
+- API: Relax validation for Machine .status.addresses to maximum of 128 instead of 32 items (#13090)
+- CI: Bump softprops/action-gh-release from 2.4.2 to 2.5.0 in the all-github-actions group (#13094)
+- e2e: Do not expect Machines for MachinePools not supporting Machines (#13077)
+- e2e: Make clusterctl upgrade test to work when there are no machines (#13074)
+- Runtime SDK: Add httpClientCache to runtime client (#13080)
+
+## Dependencies
+
+### Added
+_Nothing has changed._
+
+### Changed
+_Nothing has changed._
+
+### Removed
+_Nothing has changed._
+
+
+More details about the release
+
+## Changes since v1.11.0
+## :chart_with_upwards_trend: Overview
+- 287 new commits merged
+- 5 breaking changes :warning:
+- 42 feature additions β¨
+- 42 bugs fixed π
+
+## :warning: Breaking Changes
+- CI: Improve KAL config docs for forbidding OpenAPI defaulting (#12869)
+- clusterctl: Block move when Cluster or ClusterClass is paused (#12786)
+- Dependency: Bump to controller-runtime v0.22 & controller-tools v0.19 (#12634)
+- Runtime SDK: Improve chained upgrade observability (#12973)
+- Runtime SDK: Make the AfterClusterUpgrade hook blocking (#12984)
+
+## :sparkles: New Features
+- API/Machine/MachineSet/MachineDeployment: Machine related API changes, conversion and feature gate (#12936)
+- CABPK: Add EncryptionAlgorithm to Kubeadmconfig (#12859)
+- CAPD: Add scale from/to 0 support for CAPD (#12572)
+- CI: Bump autoscaler to a9cb59fdd (#12643)
+- CI: Bump Kubernetes in tests to v1.34.0 and claim support for v1.34 (#12699)
+- ClusterCache/KCP: Deprecate GetClientCertificatePrivateKey and stop using it in KCP (#12846)
+- ClusterCache: Add GetUncachedClient() (#12803)
+- ClusterClass: Add .spec.upgrade.external.generateUpgradePlanExtension field to ClusterClass (#12809)
+- ClusterClass: Add types and hook for GenerateUpgradePlan (#12823)
+- ClusterClass: Additional validation in Cluster/ClusterClass webhook for chained upgrades (#12816)
+- ClusterClass: Call GenerateUpgradePlanRequest Runtime Extension (#12903)
+- ClusterClass: Implement core logic for chained upgrades (#12726)
+- clusterctl: Add conditions filter for clusterctl describe (#12991)
+- Control-plane: Add new control-plane provider HCP (#12800)
+- e2e: Bump Kubernetes version used for testing to v1.34.0-rc.1 (#12623)
+- e2e: Bump Kubernetes version used for testing to v1.34.0-rc.2 (#12658)
+- e2e: Bump Kubernetes version used for testing to v1.35.0-beta.0 (#13029)
+- e2e: Change RuntimeSDK e2e test ClusterClass to use GenerateUpgradePlan extension (#12955)
+- e2e: Implement e2e test for in-place updates (#12938)
+- KCP/CABPK/CI: Bump KAL to pick up latest requiredfields linter, add Min/MaxLength to BootstrapToken (#12563)
+- KCP/MachineSet: Refactor BootstrapConfig/InfraMachine managedFields for in-place (#12890)
+- KCP: Bump coredns/corefile-migration to v1.0.28 (#12748)
+- KCP: Bump coredns/corefile-migration to v1.0.29 (#12862)
+- KCP: Bump corefile-migration to v1.0.27 (#12636)
+- KCP: Compare ClusterConfiguration via KubeadmConfig instead of annotation on Machine (#12758)
+- KCP: Extend rollout logic for in-place updates (#12840)
+- KCP: Implement CanUpdateMachine (#12857)
+- KCP: Implement trigger in-place update (#12897)
+- Machine: Add in-place updates support for machine controller (#12831)
+- MachineDeployment: Add in-place to rollout planner (#12865)
+- MachineDeployment: Implement CanUpdateMachineSet (#12965)
+- MachineHealthCheck: Add support for checking Machine conditions in MachineHealthCheck (#12827)
+- Misc: Add inplace updates featuregate (#12755)
+- Misc: Improve logs, errors and conditions (#12992)
+- Misc: Introduce & use wait for cache utils (#12957)
+- Misc: Introduce reconciler rate-limiting and hook caching (#13006)
+- Runtime SDK/IPAM/MachinePool: Cleanup exp packages (#12651)
+- Runtime SDK: Add in-place update hooks to API (#12343)
+- Runtime SDK: Add lifecycle hooks for chained-upgrade (#12878)
+- Runtime SDK: Call new lifecycle hooks for chained-upgrades (#12891)
+- Runtime SDK: Ensure ExtensionConfig controller can be used outside of the core provider (#12754)
+- Runtime SDK: Implement GenerateUpgradePlan handler (#12927)
+
+## :bug: Bug Fixes
+- API: Only try to convert infraRefs if they are set (#12686)
+- API: Register conversion funcs in schemes (#12687)
+- CABPK: Always use latest apiVersion when getting owner of KubeadmConfig in CABPK (#12685)
+- CAPD: CAPD on rootless podman (#12941)
+- CAPD: Fix the format error of healthCheck in test templates (#12787)
+- CAPD: Remove finalizers during deletion if ownerRef was never set (#12675)
+- CAPD: Run CAPD conversion tests in CI (#12583)
+- CAPIM: Eliminate data race in DialContext (#12778)
+- ClusterClass/MachinePool: Fix MP error in desired state calculation during Cluster creation (#12607)
+- ClusterClass: Do not overwrite global http.DefaultClient TLSConfig (#13063)
+- ClusterClass: Ensure holder field path in GeneratePatchRequest is set based on contract (#12684)
+- ClusterClass: Fix field paths in ClusterClass compatibility validation errors (#12660)
+- ClusterClass: Fix wait for cache in reconcile_state.go (#13032)
+- ClusterClass: Stop adding conversion-data annotation to Cluster object (#12719)
+- ClusterClass: Stop writing zero values for spec.controlPlaneEndpoint to ControlPlane objects (#12958)
+- clusterctl: Removing Ready/Available prefix from STATUS Column (#12729)
+- clusterctl: Verify providers need upgrade before applying (#12753)
+- Devtools: Fix kube-state-metrics deployment (#13024)
+- e2e: Do not require kubetest configration if not needed (#12948)
+- e2e: Fix autoscaler e2e test flake (#12613)
+- e2e: Fix e2e test issues introduced by chained upgrades (#12766)
+- e2e: Fix objects with Changed Resource Versions flake (#12848)
+- e2e: Fix upgrade runtimesdk test (#12833)
+- e2e: Fix WaitForMachinesReady interval (#13051)
+- e2e: Increase reconcile timeout for DockerMachine (#13099)
+- e2e: Propagate clusterctl variables for cluster upgrades (#12949)
+- KCP: Fix ControlPlaneComponentHealthCheckSeconds validation in KubeadmConfigSpec.Validate (#12609)
+- KCP: Fix conversion issue in KubeadmControlPlaneTemplate with rolloutStrategy.type (#12608)
+- KCP: Fix KCP KubeadmConfig isJoin detection (#13035)
+- KCP: Grant `delete` permissions to Secrets. (#13097)
+- Machine/MachinePool: Fix MachinePool nodeRef UID mismatch after K8s upgrade (#12392)
+- Machine/MachineSet: Use MachineSet template values in completeMoveMachine for in-place updates (#13085)
+- MachineDeployment: Fix race conditions ScaleDownOldMS (#12812)
+- MachineDeployment: Fix race conditions ScaleDownOldMS OnDelete (#12830)
+- MachineDeployment: Fix rollout with unavailable machines (#13020)
+- Runtime SDK: Export ExtensionConfig webhook (#12598)
+- Testing/e2e: Fix unit test flakes, improve clusterctl download error in e2e tests (#13056)
+- Testing: Fix flaky TestFuzzyConversion (Cluster) test (#12618)
+- Testing: Fix flaky TestReconcileMachinePhases unit test (#12616)
+- Testing: Fix flaky TestReconcileState unit test (#12617)
+- Testing: Fix KubeadmConfig fuzz test flake (#12679)
+- util: Fix a panic in conditions.Delete method if the sources condition list is empty (#13053)
+
+## :seedling: Others
+- API: Relax validation for Machine .status.addresses to maximum of 128 instead of 32 items (#13090)
+- Autoscaling: Bump autoscaler in e2e tests to v1.33.1 (#12790)
+- CABPK: Migrate from Requeue to RequeueAfter in CABPK (#12988)
+- CAPD: Cleanup CAPD exp packages (#12672)
+- CAPD: Recreate container if we re-enter reconciliation and it exists but is not running (#12923)
+- CI: Add OpenAPI defaulting detection for KubeadmConfig by using forbiddenmarkers (#12851)
+- CI: Block FIXME comments (#12772)
+- CI: Bump KAL & add nodurations linter (#12743)
+- CI: Bump KAL & add nonullable and forbiddenmarkers linter (#12724)
+- CI: Bump KAL & drop schemaless excludes (#12646)
+- CI: Bump KAL, adjust excludes (#12650)
+- CI: Bump Kube API Linter version (#12974)
+- CI: Bump softprops/action-gh-release from 2.4.2 to 2.5.0 in the all-github-actions group (#13094)
+- CI: Bump to golangci-linter version to v2.4.0 (#12703)
+- CI: Update metrics configuration to v1beta2 (#12642)
+- Cluster: Allow >1 minor version upgrades if generateUpgradePlan extension is defined (#12979)
+- Cluster: Simplify Cluster webhook (#12895)
+- ClusterClass: Add input validations for desired state generator function (#12655)
+- ClusterClass: Improve topology reconciled condition (#13002)
+- clusterctl: Add metal-stack infrastructure provider (#12925)
+- clusterctl: Add Metal3 as an IPAMProvider (#12756)
+- clusterctl: Allow metadata.yaml's Kind to be empty (#12714)
+- clusterctl: Bump cert-manager to v1.19.0 (#12828)
+- clusterctl: Bump cert-manager to v1.19.1 (#12873)
+- clusterctl: Bumping tablewriter to v1.0.9 - latest (#12781)
+- clusterctl: Show Available condition for CP (#12759)
+- ClusterResourceSet: Remove deprecated ClusterResourceSet feature gate (#12950)
+- Dependency: Bump github.com/go-viper/mapstructure/v2 to fix CVE (#12677)
+- Dependency: Bump Go to v1.24.10 (#12962)
+- Dependency: Bump Go to v1.24.6 (#12611)
+- Dependency: Bump go to v1.24.7 (#12733)
+- Dependency: Bump Go to v1.24.8 (#12826)
+- Dependency: Bump Go to v1.24.9 (#12867)
+- Dependency: Bump golang.org/x/crypto to v0.45 to fix CVE (#13036)
+- Dependency: Bump to envtest v1.34.0 (#12702)
+- Devtools: Drop ALL groups in tilt (#13001)
+- Devtools: Extend CR dashboard to handle capi_reconcile metrics (#13040)
+- Devtools: Promtail to alloy migration (#11945)
+- Documentation/MachinePool: Add structure for area/machinepool ownership in OWNERS files (#13018)
+- e2e: Add quickstart e2e test with v1beta1 with ClusterClass and RuntimeSDK (#12577)
+- e2e: Bump autoscaler in e2e tests to v1.34.0 (#12806)
+- e2e: Bump pause image in e2e tests to 3.10.1 (default for Kubernetes v1.34) (#12731)
+- e2e: Bump to kind v0.30.0 (#12701)
+- e2e: Do not expect Machines for MachinePools not supporting Machines (#13077)
+- e2e: E2e coverage via md rollout test (#12966)
+- e2e: Enable IPv6 test again (#12597)
+- e2e: Fix autoscaler test (#12978)
+- e2e: Fix kind build git commit setting (#12858)
+- e2e: Fix md-rollout test to test in-place taint changes before doing the rollout change (#13031)
+- e2e: Fix self-hosted to actually read DOCKER_PRELOAD_IMAGES from the e2e config (#12907)
+- e2e: Get kind mgmt cluster logs in clusterctl upgrade test (#12676)
+- e2e: Improve check for Cluster Available condition in e2e tests (#12594)
+- e2e: Make clusterctl upgrade test to work when there are no machines (#13074)
+- e2e: Set startup taint for autoscaler in e2e tests (#12736)
+- e2e: Start testing against Kubernetes v1.35 (#12709)
+- e2e: Use wait-machine-upgrade timeout in ClusterClassChanges tests to wait for machines to be ready (#13013)
+- e2e: Wait for cluster deletion in runtime sdk test (#12956)
+- KCP/CABPK: Stop using unsafe for EnvVar conversion (#12619)
+- KCP/MachineSet/MachineDeployment: Remove unused CleanUpManagedFieldsForSSAAdoption code (#12788)
+- KCP: Add current/desired objects to NotUpToDateResult & refactor object creation (#12817)
+- KCP: Avoid KCP rollouts if only ControlPlaneComponentHealthCheckSeconds is changed (#13026)
+- KCP: Check for error before checking reconcile result (#12935)
+- KCP: Enable websocket dialer with fallback to spdy (#12902)
+- KCP: Fix race condition on KCP initialized condition (#12980)
+- KCP: Improve KCP etcd client crt/key caching (#12977)
+- KCP: Simplify cleanupConfigFields in KCP (#12776)
+- KCP: Simplify KCP matchesKubeadmConfig (#12813)
+- KCP: Variable/func renames, func order (#12793)
+- Logging: Reduce noisy logs (#12606)
+- Machine/MachineSet/MachineDeployment: Adjust UpToDate condition to consider Updating, move UpToDate condition to Machine ctrl for workers (#12959)
+- Machine: Add DisableCertPrivateKey function for clustercache for test flake (#12921)
+- Machine: Consider updating condition when computing Machine's ready condition (#12939)
+- Machine: Fix TestReconcileMachinePhases flake (#12818)
+- Machine: Implement Updating Machine phase (#12940)
+- Machine: Requeue for Machine Available condition (#12953)
+- Machine: Use apireader to directly talk to apiserver (#12819)
+- MachineDeployment: Add in-place to machineset controller (#12906)
+- MachineDeployment: Add more info to logs for rollout changes (#12997)
+- MachineDeployment: Add rollout planner (#12804)
+- MachineDeployment: Cleanup getMachinesSucceeded flag from MD controller (#12882)
+- MachineDeployment: Defer in-place updates for machines not yet provisioned (#13007)
+- MachineDeployment: Fix misleading log statements and optimize logic (#12871)
+- MachineDeployment: Move compute and create ms to rollout planner (#12841)
+- MachineDeployment: Refactor MachineTemplateUpToDate (#12811)
+- MachineDeployment: Rollout-planner improve checks for scalingOrInPlaceUpdateInProgress (#12954)
+- MachineDeployment: Simplify rollout planner (#12899)
+- MachineHealthCheck: Add reason to condition, add reason+message to log (#12987)
+- MachineHealthCheck: No longer requeue when remediation is not allowed (#12924)
+- MachinePool: Migrate from Requeue to RequeueAfter in MachinePool tests (#13027)
+- MachineSet: Fix flakes in syncMachines unit test (#12918)
+- MachineSet: Fix race conditions with global scheme in TestMachineSetReconciler_reconcileUnhealthyMachines (#12919)
+- MachineSet: Refactor BootstrapConfig/InfraMachine creation in MachineSet controller (#12881)
+- Misc: Add Proxy Support to Docker Build-Args (#12669)
+- Misc: Avoid using deprecated client.Patch method (#12737)
+- Misc: Cleanup TestReconcileMachinePhases (#12976)
+- Misc: Consistent webhook file/folder structure (#12791)
+- Misc: Improve mark hook utils (#12994)
+- Misc: Improve wait for cache (#12993)
+- Misc: Log version and git commit on controller start (#12694)
+- Misc: Stop setting and relying on TypeMeta in typed objects (#12533)
+- Misc: Use errors package of Go (#10875)
+- Release/clusterctl: Add CAPRKE2 to release toolβs issue-opening providers list (#12713)
+- Release/Testing: Added test cases for list.go and github.go (#11937)
+- Release: Clarify semantic of --previous-release-version (#12995)
+- Release: Prepare main branch for v1.12 development (#12723)
+- Release: Update release notes tool to handle multiples_areas and colons (#12738)
+- Runtime SDK: Add defensive response status checking in runtime client (#12898)
+- Runtime SDK: Add hint to look into controller logs to runtime client error response (#12849)
+- Runtime SDK: Add httpClientCache to runtime client (#13080)
+- Runtime SDK: Deduplicate extension filtering and response validation logic (#12905)
+- Runtime SDK: Migrate from Requeue to RequeueAfter in extensionconfig (#13000)
+- Testing: Add clusterapi crd groups to audit logs for envtest (#12883)
+- Testing: Enable audit logs for envtest-based unit tests if ARTIFACTS env var is set (#12847)
+- Testing: Implement unit-tests for desired state generator (#12656)
+- Testing: Update version matrix for GitHub workflows for release 1.11 (#12586)
+- util: Add check version against metadata utility (#12529)
+- util: Add items to cache immediately after apply (#12877)
+
+:book: Additionally, there have been 44 contributions to our documentation and book. (#12085, #12199, #12329, #12562, #12581, #12582, #12593, #12600, #12601, #12647, #12662, #12663, #12673, #12710, #12741, #12761, #12777, #12779, #12797, #12810, #12814, #12835, #12836, #12854, #12866, #12880, #12885, #12892, #12893, #12896, #12917, #12934, #12942, #12944, #12951, #12961, #12970, #12998, #13010, #13011, #13012, #13021, #13057, #13098)
+
+## Dependencies
+
+### Added
+- github.com/gkampitakis/ciinfo: [v0.3.2](https://github.com/gkampitakis/ciinfo/tree/v0.3.2)
+- github.com/gkampitakis/go-diff: [v1.3.2](https://github.com/gkampitakis/go-diff/tree/v1.3.2)
+- github.com/gkampitakis/go-snaps: [v0.5.15](https://github.com/gkampitakis/go-snaps/tree/v0.5.15)
+- github.com/go-jose/go-jose/v4: [v4.0.4](https://github.com/go-jose/go-jose/tree/v4.0.4)
+- github.com/goccy/go-yaml: [v1.18.0](https://github.com/goccy/go-yaml/tree/v1.18.0)
+- github.com/golang-jwt/jwt/v5: [v5.2.2](https://github.com/golang-jwt/jwt/tree/v5.2.2)
+- github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus: [v1.0.1](https://github.com/grpc-ecosystem/go-grpc-middleware/tree/providers/prometheus/v1.0.1)
+- github.com/grpc-ecosystem/go-grpc-middleware/v2: [v2.3.0](https://github.com/grpc-ecosystem/go-grpc-middleware/tree/v2.3.0)
+- github.com/joshdk/go-junit: [v1.0.0](https://github.com/joshdk/go-junit/tree/v1.0.0)
+- github.com/maruel/natural: [v1.1.1](https://github.com/maruel/natural/tree/v1.1.1)
+- github.com/mfridman/tparse: [v0.18.0](https://github.com/mfridman/tparse/tree/v0.18.0)
+- github.com/olekukonko/cat: [50322a0](https://github.com/olekukonko/cat/tree/50322a0)
+- github.com/olekukonko/errors: [v1.1.0](https://github.com/olekukonko/errors/tree/v1.1.0)
+- github.com/olekukonko/ll: [v0.1.1](https://github.com/olekukonko/ll/tree/v0.1.1)
+- github.com/olekukonko/ts: [78ecb04](https://github.com/olekukonko/ts/tree/78ecb04)
+- github.com/spiffe/go-spiffe/v2: [v2.5.0](https://github.com/spiffe/go-spiffe/tree/v2.5.0)
+- github.com/tidwall/gjson: [v1.18.0](https://github.com/tidwall/gjson/tree/v1.18.0)
+- github.com/tidwall/match: [v1.1.1](https://github.com/tidwall/match/tree/v1.1.1)
+- github.com/tidwall/pretty: [v1.2.1](https://github.com/tidwall/pretty/tree/v1.2.1)
+- github.com/tidwall/sjson: [v1.2.5](https://github.com/tidwall/sjson/tree/v1.2.5)
+- github.com/zeebo/errs: [v1.4.0](https://github.com/zeebo/errs/tree/v1.4.0)
+- go.etcd.io/raft/v3: v3.6.0
+- sigs.k8s.io/structured-merge-diff/v6: v6.3.0
+
+### Changed
+- cel.dev/expr: v0.19.1 β v0.24.0
+- cloud.google.com/go/storage: v1.49.0 β v1.5.0
+- cloud.google.com/go: v0.116.0 β v0.53.0
+- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: [v1.25.0 β v1.26.0](https://github.com/GoogleCloudPlatform/opentelemetry-operations-go/compare/detectors/gcp/v1.25.0...detectors/gcp/v1.26.0)
+- github.com/Masterminds/semver/v3: [v3.3.0 β v3.4.0](https://github.com/Masterminds/semver/compare/v3.3.0...v3.4.0)
+- github.com/census-instrumentation/opencensus-proto: [v0.4.1 β v0.2.1](https://github.com/census-instrumentation/opencensus-proto/compare/v0.4.1...v0.2.1)
+- github.com/cncf/xds/go: [cff3c89 β 2f00578](https://github.com/cncf/xds/compare/cff3c89...2f00578)
+- github.com/coredns/corefile-migration: [v1.0.27 β v1.0.29](https://github.com/coredns/corefile-migration/compare/v1.0.27...v1.0.29)
+- github.com/emicklei/go-restful/v3: [v3.12.2 β v3.13.0](https://github.com/emicklei/go-restful/compare/v3.12.2...v3.13.0)
+- github.com/fsnotify/fsnotify: [v1.8.0 β v1.9.0](https://github.com/fsnotify/fsnotify/compare/v1.8.0...v1.9.0)
+- github.com/fxamacker/cbor/v2: [v2.7.0 β v2.9.0](https://github.com/fxamacker/cbor/compare/v2.7.0...v2.9.0)
+- github.com/go-viper/mapstructure/v2: [v2.3.0 β v2.4.0](https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0)
+- github.com/golang/groupcache: [41bb18b β 8c9f03a](https://github.com/golang/groupcache/compare/41bb18b...8c9f03a)
+- github.com/google/cel-go: [v0.23.2 β v0.26.0](https://github.com/google/cel-go/compare/v0.23.2...v0.26.0)
+- github.com/google/gnostic-models: [v0.6.9 β v0.7.0](https://github.com/google/gnostic-models/compare/v0.6.9...v0.7.0)
+- github.com/google/pprof: [27863c8 β f64d9cf](https://github.com/google/pprof/compare/27863c8...f64d9cf)
+- github.com/googleapis/gax-go/v2: [v2.14.1 β v2.0.5](https://github.com/googleapis/gax-go/compare/v2.14.1...v2.0.5)
+- github.com/grpc-ecosystem/grpc-gateway/v2: [v2.24.0 β v2.26.3](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.24.0...v2.26.3)
+- github.com/ianlancetaylor/demangle: [bd984b5 β f615e6b](https://github.com/ianlancetaylor/demangle/compare/bd984b5...f615e6b)
+- github.com/jonboulle/clockwork: [v0.4.0 β v0.5.0](https://github.com/jonboulle/clockwork/compare/v0.4.0...v0.5.0)
+- github.com/mattn/go-colorable: [v0.1.13 β v0.1.14](https://github.com/mattn/go-colorable/compare/v0.1.13...v0.1.14)
+- github.com/mattn/go-runewidth: [v0.0.14 β v0.0.16](https://github.com/mattn/go-runewidth/compare/v0.0.14...v0.0.16)
+- github.com/modern-go/reflect2: [v1.0.2 β 35a7c28](https://github.com/modern-go/reflect2/compare/v1.0.2...35a7c28)
+- github.com/olekukonko/tablewriter: [v0.0.5 β v1.0.9](https://github.com/olekukonko/tablewriter/compare/v0.0.5...v1.0.9)
+- github.com/onsi/ginkgo/v2: [v2.23.4 β v2.27.2](https://github.com/onsi/ginkgo/compare/v2.23.4...v2.27.2)
+- github.com/onsi/gomega: [v1.38.0 β v1.38.2](https://github.com/onsi/gomega/compare/v1.38.0...v1.38.2)
+- github.com/pelletier/go-toml/v2: [v2.2.3 β v2.2.4](https://github.com/pelletier/go-toml/compare/v2.2.3...v2.2.4)
+- github.com/prometheus/client_model: [v0.6.1 β v0.6.2](https://github.com/prometheus/client_model/compare/v0.6.1...v0.6.2)
+- github.com/rivo/uniseg: [v0.4.2 β v0.4.7](https://github.com/rivo/uniseg/compare/v0.4.2...v0.4.7)
+- github.com/rogpeppe/go-internal: [v1.13.1 β v1.14.1](https://github.com/rogpeppe/go-internal/compare/v1.13.1...v1.14.1)
+- github.com/sagikazarmark/locafero: [v0.7.0 β v0.11.0](https://github.com/sagikazarmark/locafero/compare/v0.7.0...v0.11.0)
+- github.com/sourcegraph/conc: [v0.3.0 β 5f936ab](https://github.com/sourcegraph/conc/compare/v0.3.0...5f936ab)
+- github.com/spf13/afero: [v1.12.0 β v1.15.0](https://github.com/spf13/afero/compare/v1.12.0...v1.15.0)
+- github.com/spf13/cast: [v1.7.1 β v1.10.0](https://github.com/spf13/cast/compare/v1.7.1...v1.10.0)
+- github.com/spf13/cobra: [v1.9.1 β v1.10.1](https://github.com/spf13/cobra/compare/v1.9.1...v1.10.1)
+- github.com/spf13/pflag: [v1.0.7 β v1.0.10](https://github.com/spf13/pflag/compare/v1.0.7...v1.0.10)
+- github.com/spf13/viper: [v1.20.1 β v1.21.0](https://github.com/spf13/viper/compare/v1.20.1...v1.21.0)
+- github.com/stretchr/testify: [v1.10.0 β v1.11.1](https://github.com/stretchr/testify/compare/v1.10.0...v1.11.1)
+- go.etcd.io/bbolt: v1.3.11 β v1.4.2
+- go.etcd.io/etcd/api/v3: v3.5.22 β v3.6.6
+- go.etcd.io/etcd/client/pkg/v3: v3.5.22 β v3.6.6
+- go.etcd.io/etcd/client/v3: v3.5.22 β v3.6.6
+- go.etcd.io/etcd/pkg/v3: v3.5.21 β v3.6.4
+- go.etcd.io/etcd/server/v3: v3.5.21 β v3.6.4
+- go.opencensus.io: v0.24.0 β v0.22.3
+- go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: v0.58.0 β v0.60.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.33.0 β v1.34.0
+- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.33.0 β v1.34.0
+- go.opentelemetry.io/otel/metric: v1.34.0 β v1.35.0
+- go.opentelemetry.io/otel/trace: v1.34.0 β v1.35.0
+- go.opentelemetry.io/otel: v1.34.0 β v1.35.0
+- go.opentelemetry.io/proto/otlp: v1.4.0 β v1.5.0
+- go.uber.org/zap: v1.27.0 β v1.27.1
+- go.yaml.in/yaml/v3: v3.0.3 β v3.0.4
+- golang.org/x/crypto: v0.40.0 β v0.45.0
+- golang.org/x/mod: v0.25.0 β v0.29.0
+- golang.org/x/net: v0.42.0 β v0.47.0
+- golang.org/x/oauth2: v0.30.0 β v0.33.0
+- golang.org/x/sync: v0.16.0 β v0.18.0
+- golang.org/x/sys: v0.34.0 β v0.38.0
+- golang.org/x/telemetry: bda5523 β 078029d
+- golang.org/x/term: v0.33.0 β v0.37.0
+- golang.org/x/text: v0.27.0 β v0.31.0
+- golang.org/x/tools: v0.34.0 β v0.38.0
+- google.golang.org/api: v0.215.0 β v0.17.0
+- google.golang.org/genproto/googleapis/api: 5f5ef82 β a0af3ef
+- google.golang.org/genproto/googleapis/rpc: 1a7da9e β a0af3ef
+- google.golang.org/genproto: e639e21 β 66ed5ce
+- google.golang.org/grpc: v1.71.3 β v1.72.3
+- google.golang.org/protobuf: v1.36.6 β v1.36.7
+- k8s.io/api: v0.33.3 β v0.34.2
+- k8s.io/apiextensions-apiserver: v0.33.3 β v0.34.2
+- k8s.io/apimachinery: v0.33.3 β v0.34.2
+- k8s.io/apiserver: v0.33.3 β v0.34.2
+- k8s.io/client-go: v0.33.3 β v0.34.2
+- k8s.io/cluster-bootstrap: v0.33.3 β v0.34.2
+- k8s.io/code-generator: v0.33.3 β v0.34.2
+- k8s.io/component-base: v0.33.3 β v0.34.2
+- k8s.io/gengo/v2: 1244d31 β 85fd79d
+- k8s.io/kms: v0.33.3 β v0.34.2
+- k8s.io/kube-openapi: c8a335a β f3f2b99
+- k8s.io/utils: 3ea5e8c β 4c0f3b2
+- sigs.k8s.io/controller-runtime: v0.21.0 β v0.22.4
+- sigs.k8s.io/json: 9aa6b5e β cfa47c3
+
+### Removed
+- cloud.google.com/go/auth/oauth2adapt: v0.2.6
+- cloud.google.com/go/auth: v0.13.0
+- cloud.google.com/go/iam: v1.2.2
+- cloud.google.com/go/monitoring: v1.21.2
+- github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric: [v0.48.1](https://github.com/GoogleCloudPlatform/opentelemetry-operations-go/tree/exporter/metric/v0.48.1)
+- github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping: [v0.48.1](https://github.com/GoogleCloudPlatform/opentelemetry-operations-go/tree/internal/resourcemapping/v0.48.1)
+- github.com/golang-jwt/jwt/v4: [v4.5.2](https://github.com/golang-jwt/jwt/tree/v4.5.2)
+- github.com/google/s2a-go: [v0.1.8](https://github.com/google/s2a-go/tree/v0.1.8)
+- github.com/googleapis/enterprise-certificate-proxy: [v0.3.4](https://github.com/googleapis/enterprise-certificate-proxy/tree/v0.3.4)
+- github.com/grpc-ecosystem/go-grpc-middleware: [v1.3.0](https://github.com/grpc-ecosystem/go-grpc-middleware/tree/v1.3.0)
+- github.com/grpc-ecosystem/grpc-gateway: [v1.16.0](https://github.com/grpc-ecosystem/grpc-gateway/tree/v1.16.0)
+- github.com/kr/fs: [v0.1.0](https://github.com/kr/fs/tree/v0.1.0)
+- github.com/pkg/sftp: [v1.13.7](https://github.com/pkg/sftp/tree/v1.13.7)
+- github.com/prashantv/gostub: [v1.1.0](https://github.com/prashantv/gostub/tree/v1.1.0)
+- go.etcd.io/etcd/client/v2: v2.305.21
+- go.etcd.io/etcd/raft/v3: v3.5.21
+- go.uber.org/atomic: v1.9.0
+- sigs.k8s.io/structured-merge-diff/v4: v4.6.0
+
+
+
+_Thanks to all our contributors!_ π