18 Sep 2025

#### Bug fixes

- eBPF: Fix race between loading kubernetes services and conntrack cleanup.  If conntrack cleanup ran before services were loaded, all service entries would look stale and get cleaned up. [calico 10725](https://github.com/projectcalico/calico/pull/10725) (@fasaxc)
- Add validation to guard against catch-all CIDRs (e.g. 0.0.0.0/0) on negated (notnets) policy rules, as those would effectively disallow all addresses. [calico 10687](https://github.com/projectcalico/calico/pull/10687) (@dzacball)

#### Other changes

- Calico is now built with go 1.24.7 [calico 10959](https://github.com/projectcalico/calico/pull/10959) (@MichalFupso)
- Remove manual Windows Kubernetes service installation [calico 10917](https://github.com/projectcalico/calico/pull/10917) (@song-jiang)
