What's Changed

• [release-1.35] chore: add aznfs flag for NFS-configured mounts by @andyzhangx in #3325
• [release-1.35] fix: default DRIVER_NAME in azurefile-proxy install script by @k8s-infra-cherrypick-robot in #3327
• [release-1.35] chore: enable node.useAZNFSForNFSMounts by default in e2e; wire driver.name into azurefile-proxy by @andyzhangx in #3328
• [release-1.35] test: enable restore for oauth standard smb snapshot case by @k8s-infra-cherrypick-robot in #3331
• [release-1.35] chore: update csi-resizer to v2.2.1 by @andyzhangx in #3334
• [release-1.35] chore: bump Go to 1.26.6 and update .trivyignore by @k8s-infra-cherrypick-robot in #3340
• feat: support snapshot metadata in CreateSnapshot (cherry-pick #3337) by @andyzhangx in #3342
• [release-1.35] test(e2e): add metadata parameter to snapshot storage class by @k8s-infra-cherrypick-robot in #3346
• [release-1.35] cleanup: reduce log noise for ephemeral (CSI inline) volume NodePublishVolume path by @k8s-infra-cherrypick-robot in #3350
• [release-1.35] chore: upgrade azcopy to v10.32.7 to fix CVEs by @k8s-infra-cherrypick-robot in #3352
• [release-1.35] chore: upgrade Azure cloud provider lib by @andyzhangx in #3355
• [release-1.35] feat: support per-protocol encryption in transit for NFS by @andyzhangx in #3359
• [release-1.35] fix: validate inline volume request before performing cifs mount by @k8s-infra-cherrypick-robot in #3362
• [release-1.35] fix: keep HTTPS-only match for plaintext NFS + make NFS EiT test assertions reachable by @k8s-infra-cherrypick-robot in #3363
• [release-1.35] fix: CVE-2026-56854 by @andyzhangx in #3368
• [release-1.35] fix: mount azure.json read-only in CSI controller and node pods by @andyzhangx in #3371
• [release-1.35] test: add workload identity account-key mode e2e test by @k8s-infra-cherrypick-robot in #3374
• [release-1.35] chore: upgrade Azure cloud provider lib by @andyzhangx in #3376
• [release-1.35] chore: ignore CVE-2026-84304 in trivy scan by @k8s-infra-cherrypick-robot in #3385
• [release-1.35] feat: add mount_operations_total metric to track per-share mount fail… by @k8s-infra-cherrypick-robot in #3395
• [release-1.35] fix: validate SMB authentication parameters by @k8s-infra-cherrypick-robot in #3388
• [release-1.35] chore: upgrade azcopy to v10.32.8 to fix CVEs by @k8s-infra-cherrypick-robot in #3399
• [release-1.35] fix: CVE-2026-56855 by @andyzhangx in #3401
• doc: cut v1.35.8 release by @rnhan in #3398

Full Changelog: v1.35.7...v1.35.8