---
title: pipeline-control-gateway-26-07-28
source: https://docs.newrelic.com/docs/release-notes/pipeline-control-gateway-release-notes/pipeline-control-gateway-26-07-28
---

## New features and improvements

-   Upgraded the embedded OpenTelemetry Collector from `v0.139.0` to `v0.156.0`, incorporating the latest upstream components and resolving several CVEs flagged by vulnerability scanning.
-   Migrated the gateway runtime to a hardened distroless/Alpine base image, with Docker base images now pinned by digest for reproducible, tamper-resistant builds.
-   Upgraded to Go `1.25` and refreshed the `golang.org/x/crypto` dependency.
-   Updated metering to retain the first data point in each series.

## Fixes

-   Added nil-safety checks to prevent potential panics.
-   Prevented an unintended overwrite of the `trace_id` string value.

## Security updates

-   The gateway container now runs as a non-root user (UID `65532`) by default, reducing its privilege footprint.
-   The gateway now listens on the unprivileged port `8080` instead of `80`. The Kubernetes `Service`, ingress, and Gloo upstream definitions are all updated to match. If you reference the gateway service port directly, update it to `8080`.
-   The gateway now masks sensitive values, such as license keys and API keys, in the logs it emits.
-   The gateway now fails fast when the license key is missing or invalid.
-   Applied additional security hardening and dependency fixes.