v1.34.0
envoyproxy/envoyv1.34.0Apr 15, 2025by publish-envoy[bot]
AI Summary
A major release featuring security fixes for ext_proc and c-ares, new async load balancing capabilities, support for dynamic modules and io_uring, and enhanced OAuth2 and compression features.
Key Highlights
- Security fixes for ext_proc local replies and updated c-ares library.
- Added support for async load balancing and dynamic modules.
- Introduced io_uring support and QUIC-LB draft standard.
- Enhanced OAuth2 with PKCE support and ext_proc with gRPC side stream closing.
New Features
- Async load balancing support.
- Dynamic module loading (shared libraries at runtime).
- io_uring support in default socket interface.
- QUIC-LB draft standard support for connection ID generation.
- Enhanced ext_proc with FULL_DUPLEX_STREAMED body mode.
- PKCE support for OAuth2 authorization code flow.
- Container CPU utilization monitoring in Kubernetes.
- Enhanced Proxy Protocol TLV support.
- New formatter attributes (QUERY_PARAM, CUSTOM_FLAGS, PATH).
Full Release Notes
**Summary of changes**:
* Security:
- [CVE-2025-30157](https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9): Fixed a bug where local replies were incorrectly sent to the ext_proc server.
- [CVE-2025-31498](https://github.com/c-ares/c-ares/security/advisories/GHSA-6hxc-62jh-p29v): Updated c-ares to version 1.34.5 to address a security vulnerability.
* HTTP:
- Added support for async load balancing, allowing endpoints to respond with their ability to handle requests.
- Improved HTTP/1 parser to handle newlines between requests correctly per RFC 9112.
- Added option to ignore specific HTTP/1.1 upgrade values using configurable matchers.
- Implemented TCP proxy option to read from downstream connections before establishing upstream connections.
* Performance:
- Improved performance for HTTP/1 ignored upgrades.
- Enhanced TCP proxy retries to run in a different event loop iteration to avoid connection issues.
- Added fixed value option for minimum RTT in adaptive concurrency filter.
- Enhanced dynamic forward proxy with async lookups for null hosts.
* Reliability:
- Fixed a bug in preconnecting logic that could lead to excessive connection establishment.
- Fixed port exhaustion issues in the original_src filter by setting the `IP_BIND_ADDRESS_NO_PORT` socket option.
- Fixed socket option application for additional listener addresses.
- Fixed crash when creating an EDS cluster with invalid configuration.
* Features:
- Added support for loading shared libraries at runtime through dynamic modules.
- Added support for io_uring in the default socket interface.
- Extended the compression filter with the ability to skip compression for specific response codes.
- Added support for QUIC-LB draft standard for connection ID generation.
- Enhanced ext_proc with graceful gRPC side stream closing and added a new `FULL_DUPLEX_STREAMED` body mode.
- Introduced PKCE support for OAuth2 authorization code flow and SameSite cookie attribute configuration.
- Added support for monitoring container CPU utilization in Linux Kubernetes environments.
- Enhanced proxy protocol TLV support to enable more flexible and customizable usage between downstream and upstream connections.
- Added multiple formatter attributes improvements, e.g., `QUERY_PARAM`, `CUSTOM_FLAGS`, and `PATH`
* Observability:
- Enhanced Transport Tap with connection information output per event.
- Added support for directing LRS to report loads when requests are issued.
**Docker images**:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.34.0
**Docs**:
https://www.envoyproxy.io/docs/envoy/v1.34.0/
**Release notes**:
https://www.envoyproxy.io/docs/envoy/v1.34.0/version_history/v1.34/v1.34.0
**Full changelog**:
https://github.com/envoyproxy/envoy/compare/v1.33.0...v1.34.0
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: Boteng Yao <boteng@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>