build: Envoy now uses Bazel 8. Because Envoy still uses WORKSPACE mode, --enableworkspace and --noenablebzlmod are required and have been added to .bazelrc; external-repository runfiles now appear directly under the runfiles root.
build: the Intel DLB connection balancer (envoy.network.connectionbalance.dlb) is disabled for all builds due to a broken source archive.
TLS: enforcersakeyusage is deprecated and ignored; Envoy now always enforces the certificate keyUsage extension.
Today in Envoy, simple load balancing decisions can be made by taking into account local or global knowledge of a backend’s load, for example CPU. More sophisticated load balancing decisions are possible with application specific knowledge, e.g. queue depth, or by combining multiple metrics. This is useful for services that may be resource constrained along
Currently clang-tidy is not working very well and need some attention I am gradually picking off various bits of ci for shifting azp -> gh This one seems like quite a good candidate to start on the checks with.
*Title*: *One line description* *Description*: >Describe the desired behavior, what scenario it enables and how it would be used. Envoy Proxy supports JA3 and JA4 Fingerprint Hashes today https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/listener/tls_inspector/v3/tls_inspector.proto.html#extensions-filters-listener-tls-inspector-v3-tlsins
As agreed in https://github.com/envoyproxy/envoy/pull/28982 we first introduce extension point for queue policy to support more algorithms in future (e.g. codel, adaptive lifo). This PR introduces fifo queue extension currently used in core code. Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Featu
*Title*: *Hot restart lead to the abnormal exit of the new process* *Description*: During the hot restart, the new Envoy process will start a timer to send `sendParentTerminateRequest` messages after taking over the traffic. but if the parent process quits early, can lead to ` sendParentTerminateRequest ` trigger RELEASE_ASSERT send failure, this kind of beh
I want to package the official Envoy binary from GitHub releases (e.g., envoy-1.38.3-linux-x86_64) into an RPM for Rocky Linux 9 VM. A few questions: 1. What is the recommended package name when redistributing the official binary as an RPM ? 2. What files should be included for license compliance? Is LICENSE + NOTICE from the repo sufficient? 3. Is there a p
Commit Message: c-ares: make qcache_max_ttl configurable Additional Description: expose the qcache_max_ttl setting and share DNSResolver if cares config is the same so the qcache can be shared. runtime guard "envoy.restart_features.shared_cares_dns_resolver" is set to true by default to enable sharing DNSResolver if cares config of the clusters are the same.
**Commit Message:** hot restart: propagate programmatic stat tags across restart **Additional Description:** Stats created with programmatic tags (via `Scope::*FromStatNameWithTags` / the tag-aware `*FromTaggedName` API) embed their tag *values* into the flat stat name while keeping a clean `tagExtractedName` and a set of tags. This works on a fresh process,
Commit Message: add ratelimit descriptor extension to use jwt claims as descriptors Additional Description: Adds a new rate limit descriptor extension that extracts jwt claims and uses it to rate limit. This is useful in cases where the actual JWT validation is done by the application but we want to apply rate limits based on jwt claims Risk Level: Low Testi
*Description*: In `envoy/geoip/geoip_provider_driver.h`, the type `LookupResult` is defined as an alias to `const absl::flat_hash_map<std::string, std::string>`. The type is usually passed around by rvalue-reference: ``` // from source/extensions/filters/http/geoip/geoip_filter.cc driver_->lookup( Geolocation::LookupRequest{std::move(remote_address)}, [self,
### Summary For one specific upstream cluster, `envoy_cluster_upstream_rq_timeout` (and the equivalent `/clusters?format=json` admin stat `rq_timeout`) increments on requests that also complete successfully. On the same host, in the same admin snapshot, `rq_success` equals `rq_total` exactly, while `rq_timeout` is simultaneously non-zero — i.e. Envoy is coun
*Title*: *health check probes blocked indefinitely when EDS initialFetchTimeout is 0s* *Description*: After I set EDS initialFetchTimeout as 0s, all envoy gateway conformance and e2e test cases failed in waiting for health check activity to appear. *Repro steps*: 1. set initialFetchTimeout: 0s 2. rerun all envoy gateway e2e test cases *Logs*: > === RUN TestE
Commit Message: Manage on-call rotation and ical generation in code Additional Description: Our dependency on opsgenie appears to have run its course - our notifications keep drifting out of sync, the calendar isn't working very well, and we don't have enough seats to even have the scheduling be correct. These scripts should make it fairly easy to manage the
*Title*: http2: allow configuring upstream headers as HPACK never indexed *Description*: Envoy should allow operators to configure HTTP/2 request headers to use HPACK's "Literal Header Field Never Indexed" representation when forwarding requests to an upstream. This is useful for high-cardinality values such as request IDs, trace IDs, or per-request tokens.
## Description The OpenSSL compat layer does not implement the `ssl_compliance_policy_cnsa1_202603` case in `SSL_CTX_set_compliance_policy`. When a user configures CNSA1 on an Envoy build using OpenSSL, the TLS context creation fails and Envoy refuses to start. BoringSSL implements CNSA1 natively via `SSL_CTX_set_compliance_policy(ssl_compliance_policy_cnsa1
## Title tls: share parsed CA trust store (`X509_STORE`) across contexts built from identical CA material ## Problem Envoy builds a parsed CA trust store (`X509_STORE`) once per `Ssl::ContextImpl`, and a `ContextImpl` is created once per transport-socket factory — i.e. once per cluster, and again on every SDS rotation. When many clusters validate against the
*Title*: http1: unsafe ctype usage and size_t to int narrowing in the HTTP/1 parser *Description*: Two type-safety defects in the HTTP/1 parser, found while working on #46496. Neither appears to be a security issue. There's no crash, no memory-safety consequence on supported platforms, and no reachable trigger for (2), so I'm raising publicly. Happy to move
## Summary Envoy currently uses WORKSPACE mode with bzlmod explicitly disabled (`.bazelrc`: `--noenable_bzlmod`, `--enable_workspace`), despite using Bazel 8.7.0 where bzlmod is the default. A minimal `MODULE.bazel` exists with 12 `bazel_dep` entries but is inactive. The [toolshed registry](https://github.com/envoyproxy/toolshed/tree/main/bazel-registry/modu
*Title*: reverse_tunnel: Implement proactive pings from the downstream_socket_interface *Description*: Currently the downstream_socket_interface does not proactive ping the upstream side using the RPING mechanism -> it only responds to pings this makes the downstream side invisible to reachability. Worse if the network falls through the downstream never dete
*Title*: *One line description* Support QUIC when Envoy is compiled with OpenSSL support enabled. *Description*: Desired Behaviour: Envoy when compiled with OpenSSL, should be able to serve quic based requests.
Commit Message: stats: migrate rds/scope rds to use new stats API Additional Description: Parts of #20289. This migrate the previous stats creation to use new tags-friendly API. But note, before we merge https://github.com/envoyproxy/envoy/pull/45846 and enable it explicitly. This won't bring any changes to the final behavior because the legacy mode will ign
Commit Message: stats: migrate almost all HTTP to new API Additional Description: Parts of https://github.com/envoyproxy/envoy/issues/20289. This migrate the previous stats creation to use new tags-friendly API. But note, before we merge https://github.com/envoyproxy/envoy/pull/45846 and enable it explicitly. This won't bring any changes to the final behavio
## Commit Message composite: fail over to the next sub-cluster when a sub-cluster has no hosts The composite cluster failed a request with 503 no_healthy_upstream when the sub-cluster mapped to the current attempt had no host available, for example because DNS resolution returned an empty endpoint list or because all of its hosts had been ejected. Host selec
Commit Message: add utilities to define and validate JSON schema. add the first schema - OpenAI chat completion schema This allows us to structurally define a JSON payload schema for AI requests. It is useful for validation, and later transcoding. This is part of #44681. I used AI to generate this PR. I have read and fully understand this PR. Additional Desc
Commit Message: Allow multiple TLS certificates in the upstream tls context when using a custom TLS certificate selector. The single cert check is kept if one is not defined. Additional Description: We are working on an internal TLS certificate selector for UpstreamTLSContext that can select between multiple client certificate. By default only one is allowed
Commit Message: udp: Support hot restart handoff for connectionless UDP flows Additional Description: The parent instance keeps serving established UDP flows while draining and forwards packets of unknown flows to the child over the hot restart RPC, instead of going dark between drain start and parent shutdown. Risk Level: Medium Testing: Added unit and inte
Commit Message: mcp_transcoder: Fix Unbounded Recursion DoS Additional Description: This PR limits the maximum nesting depth for JSON query parameter processing in constructQueryParams to 100, which mitigates a stack overflow condition caused by maliciously crafted, deeply nested query parameters. Risk Level: Low Testing: Unit tests. Docs Changes: N/A Releas
Commit Message: ext_proc: document session affinity configuration Additional Description: Documents the existing configuration path for keeping requests with the same session key on one external processor endpoint. The downstream key is copied into Envoy gRPC initial metadata and used by a matching cluster-level hash policy. Adds integration coverage for hea
Commit Message: c-ares: disable shared resolver by default Additional Description: DnsFilter would call createDnsResolver() from a workerthread that would cause a race when sharing dns resolvers. Turn off this feature until the race is fixed. Relates to https://github.com/envoyproxy/envoy/pull/46577 and https://github.com/envoyproxy/envoy/pull/45073 Risk Lev
Description: The hot restart IPC protocol reads a uint64_t message length from the first 8 bytes of an incoming datagram and uses it to compute the required receive buffer size. When expected_proto_length_ is close to UINT64_MAX, adding sizeof(uint64_t) may wrap around due to unsigned integer overflow, producing an invalid buffer size value. Add an explicit
Commit Message: dfp: fix a bug when cluster is removed before async lb be completed Additional Description: In the previous implementation, both the router/DFP cluster may access invalid pointer if a cluster is removed then the request is pending and waiting the async load balancing result. Risk Level: Testing: Docs Changes: Release Notes: Platform Specific
## Commit Message Adds support for the `QUERY` request method registered by `RFC 10008`. Before this change, an `HTTP/1` request using the `QUERY` method was rejected by the codec with a `400` and `HPE_INVALID_METHOD`, because the method token is matched against a fixed list of known methods that predates the RFC. `HTTP/2` and `HTTP/3` have no equivalent met
**Commit Message:** support building an SRDS scope key from filter state **Additional Description:** Scope keys could only be built from a request header. This adds a `filter_state` fragment type so a scope key can be built from a filter state object instead. This matters when the value selecting the route table is known at connection time: a network filter
The FMT_UNICODE is a Windows MSVC specific option. It has not effect on Linux build. Risk Level: none Testing: unit tests Docs Changes: no Release Notes: no Platform Specific Features: Windows specific
Commit Message: formatter: add formatValueTo to reduce allocation of protobuf value Additional Description: Similar to https://github.com/envoyproxy/envoy/pull/46593, but support the typed value. ``` Baseline — HEAD BM_AccessLogFormatter_mean 131 ns 131 ns 5 BM_AccessLogFormatterTextMockJson_mean 131 ns 131 ns 5 BM_JsonAccessLogFormatter_mean 242 ns 242 ns 5
Commit Message: rds: make the init manager for rds works for filter_chain and oauth2 Additional Description: Now, all configuration on the route could optionally add an async warming target to the route level init manager. The change of oauth2 showed how it works. Risk Level: n/a. Testing: unit. Docs Changes: n/a. Release Notes: added. Platform Specific Feat
Commit Message: implement out-of-band ORCA reporting for load_aware_locality Additional Description: Follow-up to https://github.com/envoyproxy/envoy/pull/45725 to wire up ORCA out-of-band reporting with the additional below changes: - Adds oob_reporting_config proto field - Graduates envoy.load_balancing_policies.load_aware_locality from `wip` to `alpha` in
Commit Message: Fix flaky order-dependent stats_test failures via physical test file separation Additional Description: The tests `NonNumberValueFormatted` and `GaugeNonNumberValueFormatted` both trigger identical error logs emitted via `ENVOY_LOG_PERIODIC_MISC` in `stats.cc`. Because this macro rate-limits logging to prevent log spam, running these tests co
this provides some of the compatibility required for bzlmod, without breaking workspace mode will follow up to fully enable bzlmod (as non-default in subsequent pr)
For Number token, there are two cases, this cap is only applicable to the case 2 (1) Huge Number token that arrive complete with their terminator in the same chunk: This is not subject to attack vector here, hence the limit in this PR here is not applicable, as it is bounded by the max_body_bytes limit in the upper layer (2) Huge Number token is split and se
`XdsFailoverAdsIntegrationTest.StartupPrimaryNotResponding/15` (IPv6, GoogleGrpc, UnifiedDelta) fails intermittently under ASAN due to a race between gRPC's real-time channel backoff and Envoy's simulated-time retry timer. ## Root cause After the first `primaryConnectionFailure()` closes the TCP connection, the gRPC channel enters `TRANSIENT_FAILURE` with a
Introduces ParserConfig to bound the parsing and capture and control streaming JSON field extraction on top of WuffsJsonCursor. The use of ParserConfig are shown in the test handler, agentic(MCP/A2A) and LLM(openAI/Gemini) handler will be implemented in the next PRs. Capture limitation, (TODO define good defaults) - max_body_bytes: pre-feed cap on raw bytes
Commit Message: redis: fix use-after-free and connection leak on cluster removal Additional Description: Each discovery client holds a shared_ptr back to the `RedisDiscoverySession` (as its client `Config`), so `~RedisCluster()` dropping its reference does not destroy the session while a discovery connection is open — the common steady state. The session the
Commit Message: dfp: fix a bug when cluster is removed before async lb be completed Additional Description: In the previous implementation, both the router/DFP cluster may access invalid pointer if a cluster is removed then the request is pending and waiting the async load balancing result. Risk Level: Testing: Docs Changes: Release Notes: Platform Specific
Commit Message: mcp_json_rest_bridge: track request status stats across filter code paths Additional Description: This change instruments the `mcp_json_rest_bridge` filter to track request status statistics across all request and response processing code paths. Key details: - Added `incRequestCount()` helper to `McpJsonRestBridgeFilterConfig` using `scope_.c