Hedgehog's latest update just dropped. Find out what's new.

Hedgehog 26.03 is out now (Aug 2026), moving us further down the path we're on with you: making an AI-ready network fabric that behaves like cloud software — declarative, automated, and safe to hand to a small team running very big infrastructure.

Two themes drove this release. First, control: as more of you run multiple tenants and teams on one fabric, "peered or not peered" isn't enough — you need a firewall between peered VPCs that says exactly which traffic crosses. So we built one in. Second, doing more with the frontend network: RoCE has traditionally been confined to the backend fabric — with 26.03, you can run RoCE applications on the frontend too, like NVMe storage and other RDMA workloads.

What We Shipped

A firewall for VPC peering, built into the fabric. This is the first release of firewalling on GatewayPeerings: ACLs with standard 5-tuple matching — source/destination IPs and ports, plus protocol. Rules are stateful (flow) by default, like any firewall should be — return traffic is handled for you, no mirror rules to maintain. If you need stateless (packet) filtering, it's one field away. The practical upshot: least-privilege connectivity between VPCs, enforced right where the traffic flows — expose a single service to a peer instead of your whole VPC, and meet tenant-isolation requirements without buying, racking, and hairpinning traffic through a separate firewall appliance. We will continue developing these capabilities in future releases. Docs →

RoCEv2 and NCCL on the frontend network. HostBGP now lets hosts advertise extra prefixes — per-interface rail IPs alongside the main VIP. That gives your multi-NIC servers proper per-rail reachability over the frontend fabric, so you can now run RoCE applications there too — NVMe storage, other RDMA workloads, and NCCL traffic that belongs on the frontend. Your backend fabric keeps doing what it does best; the frontend just became more capable. Docs →

Broadcom SONiC 4.5.2 support. Latest NOS fixes and hardware support, with upgrade instructions in the release notes — keeping your switches current stays a config change, not a project.

Port locator LEDs, from your keyboard. Blink the locator LED on any switch port via API or CLI (timers included) and point remote hands at exactly the right port. Fewer mis-pulls, and faster fixes.

And of course, bug fixes — especially in the gateway, which got a serious hardening pass this cycle. Kudos to everyone who reported issues; keep them coming.

Full details, including upgrade notes (26.01.x and 26.02.x upgrade paths are supported), are in the release notes.

Before You Go

Two housekeeping items from the release notes worth flagging: remote VPC peering and MCLAG were removed in this release following their earlier deprecation — if you're still on either, the upgrade notes cover the path forward. And if a flapping link has ever paged you at 3am, check out the new automatic link-shutdown feature with configurable thresholds and recovery.