Starstruk Logo MarkStarstruk

v1.33.0

envoyproxy/envoyv1.33.0Jan 14, 2025by publish-envoy[bot]

AI Summary

This major release introduces new Wasm capabilities like Go plugin support and VM reloading, along with OAuth2 security enhancements. It also removes deprecated tracing and xDS attributes while enabling UDP GRO for QUIC by default.

Key Highlights

  • Wasm: Added support for Go plugins and VM reloading
  • OAuth2: Signed Double-Submit Cookie pattern and default refresh token use
  • QUIC: Enabled UDP GRO by default
  • HTTP: Shadow requests streamed in parallel
  • Tracing: Removed deprecated Opencensus support

Breaking Changes

  • RFC1918 addresses are no longer considered internal by default
  • Removed support for Opencensus tracing extension
  • Removed previously deprecated xDS attributes from get_property

New Features

  • Go plugin support for Wasm
  • Wasm VM reload support
  • UDP GRO for QUIC client connections
  • Signed Double-Submit Cookie for OAuth2
  • Nameserver rotation and query timeouts for c-ares
  • P-384 and P-521 curves for server certificates
  • New JSON formatter for access logs enabled by default

Full Release Notes

**Summary of changes**:

* c-ares:
  - [CVE-2024-25629](https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q) Out of bounds read in c-ares (DNS)
* HTTP:
  - RFC1918 addresses are no longer considered to be internal addresses by default. This addresses a security issue for Envoys in multi-tenant mesh environments.
  - Shadow requests are now streamed in parallel with the original request.
  - Local replies now traverse the filter chain if 1xx headers have been sent to the client.
* Tracing:
  - Removed support for (long deprecated) Opencensus tracing extension.
* Wasm:
  - The route cache will *not* be cleared by default if a Wasm extension modifies the request headers and the ABI version of wasm extension is larger than 0.2.1.
  - Remove previously deprecated xDS attributes from `get_property`, use `xds` attributes instead.
  - Added Wasm VM reload support and support for plugins writtin in Go.
* Access log:
  - New implementation of the JSON formatter is enabled by default.
* CSRF:
  - Increase the statistics counter `missing_source_origin` only for requests with a missing source origin.
* DNS:
  - Added nameserver rotation and query timeouts/retries to the c-ares resolver.
* Formatter:
  - `NaN` and `Infinity` values of float will be serialized to `null` and `inf` respectively in the metadata (`DYNAMIC_METADATA`, `CLUSTER_METADATA`, etc.) formatters.
* OAuth2:
  - `use_refresh_token` is now enabled by default.
  - Implement the Signed Double-Submit Cookie pattern.
* QUIC:
  - Enable UDP GRO in QUIC client connections by default.
* SDS:
  - Relaxed the backing cluster validation for Secret Discovery Service (SDS).
* TLS:
  - Added support for P-384 and P-521 curves for server certificates, improved upstream SNI and SAN validation support.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.33.0
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.33.0/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.33.0/version_history/v1.33/v1.33.0
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.32.0...v1.33.0