build: Envoy now uses Bazel 8. Because Envoy still uses WORKSPACE mode, --enableworkspace and --noenablebzlmod are required and have been added to .bazelrc; external-repository runfiles now appear directly under the runfiles root.
build: the Intel DLB connection balancer (envoy.network.connectionbalance.dlb) is disabled for all builds due to a broken source archive.
TLS: enforcersakeyusage is deprecated and ignored; Envoy now always enforces the certificate keyUsage extension.
<!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email envoy-security@googlegroups.com. Thank you in advance for helping to keep Envoy secur
Also add test to avoid regression Change-Id: I93d401aad43ea51a853725a8939f5b5524b3f8e1 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may emai
Adds response-side (encode-path) handling to the AI Protocol Manager filter: 2xx SSE and JSON responses in the OpenAI (Chat Completions + Responses API), Anthropic (Messages), and Gemini (`generateContent`/`streamGenerateContent`) dialects are observed as they stream through, and normalized token usage is published as dynamic metadata at a clean end of strea
Preserve empty datagrams across all UDP send paths. Justification: RFC 768 permits UDP datagrams with an empty payload: the minimum UDP Length is 8 octets, corresponding to the UDP header alone. Envoy currently treats these valid datagrams as no-op writes and silently drops them. This change ensures they reach the socket send operation for connected and unco
## Commit Message reverse_tunnel: add tunnel setup latency stats ## Description Adds max_tunnel_setup_time on the downstream reverse-tunnel initiator and emits tunnel_setup_time (histogram) / tunnel_setup_time_exceeded (counter) for how long it takes a host to reach its configured connection count. Attempts continue after the deadline; late completions are n
QUIC/HTTP3 is well-supported both internally and externally in Envoy. CVEs in it are treated with the highest priority. It's long-overdue to take it out of alpha. Changes: - Remove 'QUIC upstream support is currently not ready for internet use' warnings from http_protocol_options.proto (ExplicitHttpConfig, UseDownstreamHttpConfig, AutoHttpConfig). - Remove s
Additional Description: Refactors the Win32 filesystem watcher (`WatcherImpl`): - Replaces `<concurrent_queue.h>` (`concurrency::concurrent_queue`) with a thread-safe `ThreadSafeQueue` using `absl::Mutex`. This eliminates duplicate symbol link conflicts between `libc++` and MSVC `libconcrt.lib`. - Changes `DirectoryWatch` buffer type from `std::vector<uint8_
This avoids the race condition where watcher_target.yaml is not present Change-Id: I7f8c67023ac31f3a9cac294caca5c0d18c30ee1d <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (p
Commit Message: c-ares: move dns shared resolver logic to upstream cluster Additional Description: In #45073 I added qcache_max_ttl for the c-ares resolver and shared the resolver across clusters with identical c-ares configs so the query cache is shared. However, I didn't realize the UDP DNS filter also calls CaresDnsResolverFactory::createDnsResolver() dir
Commit Message: This patch adds support in HTTP/1.1 Proxy for HTTP proxy authorization. The HTTP/1.1 Proxy looks up the encoded credentials in its host's typed filter metadata and sends it with the Proxy-Authorization HTTP header in the CONNECT request to the proxy. Proxy authorization is still unsupported when filter state metadata is used. Additional Descr
https://github.com/envoyproxy/envoy/pull/45755 allowed the socket state to transition to `ShutdownSent` before cert selection is complete (as intended). However, this could cause `ENVOY_BUG` to be thrown when `SslSocket::onAsynchronousCertificateSelectionComplete()` is invoked. This patch updates `SslSocket::onAsynchronousCertificateSelectionComplete` to all
<!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email envoy-security@googlegroups.com. Thank you in advance for helping to keep Envoy secur
... so that it runs only on Envoy gRPC Change-Id: If3ff45c3ee9db39b14ed506a7ef85ae00ec7db24 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may
... before asserting new traffic patterns in test <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email envoy-security@googlegroups.com. Th
The stats_.load_success_ counter is incremented before the Snapshot of runtime metrics is taken. This leads to a small window where a client can request runtime metrics after load_success_ counter indicates a successful load but before the latest runtime metrics are available. Change-Id: Iac433fdf7637eec59186cfa44f2e065d367fc73f <!-- !!!ATTENTION!!! If you a
<!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email envoy-security@googlegroups.com. Thank you in advance for helping to keep Envoy secur
## Summary The JA4 fingerprint's third component hashes the ClientHello's extension list joined to its `signature_algorithms` list. Per the [JA4 spec](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md), GREASE codepoints must be excluded everywhere they appear — including in `signature_algorithms`. `getJA4ExtensionHash` already applies `isN
Enable the `readability-container-contains` clang-tidy check so that `count(k)`/`find(k) != end()` membership tests are flagged going forward, and apply the `.contains()` conversion across the non-extensions code (the extensions tree was cleaned up separately). Readability cleanup with no behavior change.
### Description Replace the traditional erase-remove idiom with the more concise `std::erase_if` and `absl::erase_if` APIs where applicable. This improves readability by expressing the intent to remove elements matching a predicate directly, while preserving the existing behavior. ### Changes Replace `std::remove_if` followed by `erase` with `std::erase_if`
_Commit Message:_ when a cluster is configured with EDS and initialFetchTimeout: 0s, the cluster stays in warming state indefinitely until EDS delivers its first response, no timeout fires to unblock it. _Additional Description:_ added a bypass in ClusterImplBase::setHealthChecker(). when health_check_after_cluster_warming is enabled, health checks are still
The main change is in the source/common/common/base_logger.h, moving the Levels enum out of the Logger class into the outer Logger namespace. This is intermediate step to using this enum in Envoy's interfaces in the envoy/ directory. This will prevent leaking of the spdlog dependency to proprietary components that need to manipulate Envoy's log level program
<!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email envoy-security@googlegroups.com. Thank you in advance for helping to keep Envoy secur
Commit Message: ExtProc: clarify docs on end_of_stream_without_message field Additional Description: Clarify description of the field, and mark it as not-implemented-hide to exclude from Envoy docs. Risk Level: Low Testing: N/A Docs Changes: Included in PR Release Notes: N/A Platform Specific Features: N/A CC @yanjunxiang-google
<!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email envoy-security@googlegroups.com. Thank you in advance for helping to keep Envoy secur
● Problem When multiple Envoy worker threads simultaneously call createWasm() for a remote wasm plugin, Thread A starts the HTTP fetch and marks the cache entry in_progress = true. Threads B–N find the entry in_progress, call cb(nullptr) to signal failure, then fall through (missing return) to the code.empty() block. There, they write a negative cache entry
Commit Message: These are the macros that mirror directly `RETURN_IF_ERROR` and `ASSIGN_OR_RETURN` but for `Envoy::Coroutine::Task<absl::Status>` and `Envoy::Coroutine::Task<absl::StatusOr<T>>` coroutines. Additional Description: Risk Level: low Testing: unit test Docs Changes: N/A Release Notes: no - internal helper utilities Platform Specific Features: N/A
Commit Message: support `serverNameOverride` in ALTS and add `ServerNameDecoratingTransportSocketOptions` Additional Description: These two changes are in pursuit of eventually being able to pass the original target name to the TransportSocket 1) Create `ServerNameDecoratingTransportSocketOptions` as a `TransportSocketOptions` wrapper class that populates th