22 Jan 2026

#### Bug fixes

- OpenStack: make periodic compaction loop independent of resync [calico 11574](https://github.com/projectcalico/calico/pull/11574) (@nelljerram)

#### Other changes

- Updated tigera-operator RBAC: create mutatingwebhooks, and update mutatingwebhooks. update restricted to specific resourceNames: envoy-gateway-topology-injector.tigera-gateway [calico 11688](https://github.com/projectcalico/calico/pull/11688) (@nelljerram)
- Upgrade Envoy Gateway 1.3.2 -> 1.5.7 [calico 11673](https://github.com/projectcalico/calico/pull/11673) (@skoryk-oleksandr)
- Add configurable field `resync_max_interval_secs` that defines the max time allowed between successful periodic resyncs. Log an error message if the interval exceeds the threshold. [calico 11647](https://github.com/projectcalico/calico/pull/11647) (@nelljerram)
- Re-create and swap out Calico ipsets that are not possible to list due to different failures like user-space/kernel incompatibility. Performance: After failures to program IP sets, the dataplane now does a partial resync of only the affected IP sets. This should reduce the overhead of dealing with a transient failure. [calico 11472](https://github.com/projectcalico/calico/pull/11472) (@mazdakn)
