08 November 2018

#### Bug fixes

 - For iptables versions that force use of the xtables lock, Felix now tells iptables-restore to wait for the lock.  This prevents errors and Felix restarts caused by failing to acquire the lock on the first try.  [felix #1907](https://github.com/projectcalico/felix/pull/1907) (@fasaxc)
 - For iptables versions that support it, Felix enables the --random-fully flag on SNAT and MASQUERADE rules.  This works around a race in conntrack set-up that causes occasional DNS timeouts for DNS packets that are NATted. [felix #1907](https://github.com/projectcalico/felix/pull/1907) (@fasaxc)
 - Fix an issue where Typha sometimes does not handle apiserver restart gracefully. [typha #213](https://github.com/projectcalico/typha/pull/213) (@briansan)
