What's Changed

• [release-1.35] fix: restore azfilesrefresh resources and raise memory default by @andyzhangx in #3451
• [release-1.35] fix: use canonical SMB server for private endpoint kerberos auth by @k8s-infra-cherrypick-robot in #3455
• [release-1.35] fix: classify inline clientID-only volumes as workload identity by @rnhan in #3465
• [release-1.35] fix: CVE-2026-78659 by @andyzhangx in #3468
• doc: cut v1.35.11 release by @rnhan in #3467

Full Changelog: 1.35.10...v1.35.11

What's Changed

• [release-1.34] fix: classify inline clientID-only volumes as workload identity by @rnhan in #3464
• [release-1.34] fix: CVE-2026-78659 by @andyzhangx in #3469
• doc: cut v1.34.11 release by @rnhan in #3466

Full Changelog: 1.34.10...v1.34.11

What's Changed

• [release-1.35] fix: remount disconnected SMB mapping on Windows by @k8s-infra-cherrypick-robot in #3422
• fix: re-relax inline nfs volume restrictions for future deprecation by @rnhan in #3428
• fix: re-relax server FQDN requirements for inline volumes for future deprecation by @rnhan in #3436
• doc: cut v1.35.10 release by @rnhan in #3443

Full Changelog: v1.35.9...1.35.10

What's Changed

• [release-1.34] chore: update azfilesauthmanager package to fix CVEs by @andyzhangx in #3412
• fix: re-relax inline volume restrictions for future deprecation by @rnhan in #3429
• [release-1.34] fix: CVE-2026-81870 by @andyzhangx in #3433
• fix: re-relax server FQDN requirements for inline volumes for future deprecation by @rnhan in #3437
• doc: cut v1.34.10 release by @rnhan in #3444

Full Changelog: v1.34.9...1.34.10

What's Changed

• [release-1.35] fix: avoid refreshing account key cache on cache hit by @andyzhangx in #3408
• [release-1.35] chore: update azfilesauthmanager package to fix CVEs by @k8s-infra-cherrypick-robot in #3411
• Merge pull request #3096 from laozc/remove-ms-wmi by @mittachaitu in #3413
• doc: cut v1.35.9 release by @andyzhangx in #3414

Full Changelog: v1.35.8...v1.35.9

What's Changed

• [release-1.35] chore: add aznfs flag for NFS-configured mounts by @andyzhangx in #3325
• [release-1.35] fix: default DRIVER_NAME in azurefile-proxy install script by @k8s-infra-cherrypick-robot in #3327
• [release-1.35] chore: enable node.useAZNFSForNFSMounts by default in e2e; wire driver.name into azurefile-proxy by @andyzhangx in #3328
• [release-1.35] test: enable restore for oauth standard smb snapshot case by @k8s-infra-cherrypick-robot in #3331
• [release-1.35] chore: update csi-resizer to v2.2.1 by @andyzhangx in #3334
• [release-1.35] chore: bump Go to 1.26.6 and update .trivyignore by @k8s-infra-cherrypick-robot in #3340
• feat: support snapshot metadata in CreateSnapshot (cherry-pick #3337) by @andyzhangx in #3342
• [release-1.35] test(e2e): add metadata parameter to snapshot storage class by @k8s-infra-cherrypick-robot in #3346
• [release-1.35] cleanup: reduce log noise for ephemeral (CSI inline) volume NodePublishVolume path by @k8s-infra-cherrypick-robot in #3350
• [release-1.35] chore: upgrade azcopy to v10.32.7 to fix CVEs by @k8s-infra-cherrypick-robot in #3352
• [release-1.35] chore: upgrade Azure cloud provider lib by @andyzhangx in #3355
• [release-1.35] feat: support per-protocol encryption in transit for NFS by @andyzhangx in #3359
• [release-1.35] fix: validate inline volume request before performing cifs mount by @k8s-infra-cherrypick-robot in #3362
• [release-1.35] fix: keep HTTPS-only match for plaintext NFS + make NFS EiT test assertions reachable by @k8s-infra-cherrypick-robot in #3363
• [release-1.35] fix: CVE-2026-56854 by @andyzhangx in #3368
• [release-1.35] fix: mount azure.json read-only in CSI controller and node pods by @andyzhangx in #3371
• [release-1.35] test: add workload identity account-key mode e2e test by @k8s-infra-cherrypick-robot in #3374
• [release-1.35] chore: upgrade Azure cloud provider lib by @andyzhangx in #3376
• [release-1.35] chore: ignore CVE-2026-84304 in trivy scan by @k8s-infra-cherrypick-robot in #3385
• [release-1.35] feat: add mount_operations_total metric to track per-share mount fail… by @k8s-infra-cherrypick-robot in #3395
• [release-1.35] fix: validate SMB authentication parameters by @k8s-infra-cherrypick-robot in #3388
• [release-1.35] chore: upgrade azcopy to v10.32.8 to fix CVEs by @k8s-infra-cherrypick-robot in #3399
• [release-1.35] fix: CVE-2026-56855 by @andyzhangx in #3401
• doc: cut v1.35.8 release by @rnhan in #3398

Full Changelog: v1.35.7...v1.35.8

What's Changed

• [release-1.34] chore: bump Go to 1.26.6 and update .trivyignore by @k8s-infra-cherrypick-robot in #3341
• chore: upgrade azcopy to v10.32.7 to fix CVEs (cherry-pick #3351 to release-1.34) by @andyzhangx in #3353
• cherry-pick #3347 into release-1.34: validate inline volume request before performing cifs mount by @andyzhangx in #3364
• [release-1.34] fix: CVE-2026-56854 by @andyzhangx in #3369
• [release-1.34] chore: ignore CVE-2026-84304 in trivy scan by @k8s-infra-cherrypick-robot in #3386
• [release-1.34] fix: CVE-2026-84304 by @andyzhangx in #3391
• [release-1.34] chore: refactor metrics pkg by @k8s-infra-cherrypick-robot in #3396
• [release-1.34] fix: validate SMB authentication parameters by @andyzhangx in #3389
• [release-1.34] chore: upgrade azcopy to v10.32.8 to fix CVEs by @landreasyan in #3404
• [release-1.34] feat: add mount_operations_total metric to track per-share mount failures by @landreasyan in #3400
• [release-1.34] fix: CVE-2026-56855 by @andyzhangx in #3402
• doc: cut v1.34.9 release by @rnhan in #3397

New Contributors

• @landreasyan made their first contribution in #3404

Full Changelog: v1.34.8...v1.34.9

What's Changed

• [release-1.35] chore: upgrade azcopy to v10.32.6 to fix CVEs by @k8s-infra-cherrypick-robot in #3291
• [release-1.35] feat: support networkEndpointType: serviceEndpoint for SMB by @k8s-infra-cherrypick-robot in #3306
• Cherry pick of #3296 on release-1.35 by @rnhan in #3308
• [release-1.35] test: set networkEndpointType=serviceEndpoint on smb readOnly e2e by @k8s-infra-cherrypick-robot in #3309
• [release-1.35] fix: fail fast on account limit for fixed storage account by @k8s-infra-cherrypick-robot in #3315
• [release-1.35] fix: update workload identity token and dedupe during nodestage by @k8s-infra-cherrypick-robot in #3319
• doc: cut v1.35.7 release by @andyzhangx in #3322

Full Changelog: v1.35.6...v1.35.7

What's Changed

• [release-1.34] chore: add CVE-2026-46600 and CVE-2026-56852 to .trivyignore by @k8s-infra-cherrypick-robot in #3271
• [release-1.34] fix: GHSA-hrxh-6v49-42gf by @andyzhangx in #3286
• [release-1.34] chore: upgrade azcopy to v10.32.6 to fix CVEs and reset .trivyignore by @andyzhangx in #3292
• Cherry pick of #3296 on release-1.34 by @andyzhangx in #3305
• [release-1.34] fix: fail fast on account limit for fixed storage account by @k8s-infra-cherrypick-robot in #3316
• doc: cut v1.34.8 release by @andyzhangx in #3321

Full Changelog: v1.34.7...v1.34.8

What's Changed

• [release-1.35] chore: bump Go version to 1.25.12 in trivy workflow by @k8s-infra-cherrypick-robot in #3250
• [release-1.35] chore: upgrade azcopy to v10.32.5 to fix CVEs by @k8s-infra-cherrypick-robot in #3259
• [release-1.35] fix: managed identity mount fails when using private endpoint by @k8s-infra-cherrypick-robot in #3262
• [release-1.35] fix: clean up orphaned file share on CreateVolume failure by @k8s-infra-cherrypick-robot in #3254
• [release-1.35] fix: handle short snapshot IDs in GetInfoFromSnapshotID by @k8s-infra-cherrypick-robot in #3264
• [release-1.35] chore: add CVE-2026-46600 and CVE-2026-56852 to .trivyignore by @k8s-infra-cherrypick-robot in #3270
• cherry-pick #3274 to release-1.35: prevent ARM ListKeys throttling on kubelet requiresRepublish by @andyzhangx in #3279
• [release-1.35] fix: GHSA-hrxh-6v49-42gf by @andyzhangx in #3280
• doc: cut v1.35.6 release by @andyzhangx in #3285

Full Changelog: v1.35.5...v1.35.6