02 Oct 2023

#### Bug fixes

 - Update Typha Deployment tolerations to helm charts so that it can be scheduled on any node. [calico #8065](https://github.com/projectcalico/calico/pull/8065) (@coutinhop)
 - Correct policy for OpenStack sec group with no remote_ip_prefix [calico #8034](https://github.com/projectcalico/calico/pull/8034) (@nelljerram)
 - move Felix TLS handshake to per-connection goroutine [calico #7994](https://github.com/projectcalico/calico/pull/7994) (@fasaxc)
 - Fix panic when running 'calicoctl get nodes' when ASNumber was not present in the default BGPConfiguration. [calico #7860](https://github.com/projectcalico/calico/pull/7860) (@coutinhop)
 - When running Calico in policy-only mode, do not write the IP annotations to the node. (@skmatti) [calico #7824](https://github.com/projectcalico/calico/pull/7824) (@tobiasgiese)
 - Don't write AS number to node if running with CALICO_NETWORKING_BACKEND=none. [calico #7824](https://github.com/projectcalico/calico/pull/7824) (@tobiasgiese)

#### Other changes

 - kube controllers run as a non-root user in s390x builds by default [calico #7956](https://github.com/projectcalico/calico/pull/7956) (@liudalibj)
