Starstruk Logo MarkStarstruk

v1.35.0

envoyproxy/envoyv1.35.0Jul 23, 2025by publish-envoy[bot]

AI Summary

This is a major release featuring a C++20 upgrade and numerous new features including OAuth2 encryption, API key authentication, and enhanced load balancing policies. It also introduces breaking changes by removing the AWS IAM credentials extension and contrib squash filter.

Key Highlights

  • Upgraded to C++20
  • Added OAuth2 token encryption and API key auth
  • Removed grpc_credentials/aws_iam extension and contrib squash filter
  • Added override host load balancing policy
  • Enhanced TLS inspector with JA4 fingerprinting

Breaking Changes

  • Removed grpc_credentials/aws_iam extension
  • Removed contrib squash filter

New Features

  • OAuth2 token encryption and configurable token expiration
  • OIDC logout support
  • API key auth filter with forwarding configuration
  • Override host load balancing policy
  • Hash policy configuration for ring hash and maglev
  • Matcher-based cluster specifier plugin
  • FULL_DUPLEX_STREAMED body mode for external processing
  • Graceful gRPC side stream closing with timeout
  • TLS certificate expiration metrics
  • Transport tap with streaming trace capability
  • JA4 fingerprinting for TLS inspector
  • Dynamic modules support for LocalityLbEndpoints
  • Stateful session cookie attributes and envelope mode
  • Redis proxy AWS IAM authentication and scan/info command support
  • Lua filter access to filter context and typed metadata
  • ServerNameMatcher for trie-based domain matching

Full Release Notes

**Summary of changes**:

* Security:
  - Fixed TLS inspector handling of client hello messages larger than 16KB.
  - Fixed bug where empty trusted CA files were accepted, causing validation of any certificate chain.

* Build:
  - **Major**: Upgraded to C++20, enabling modern C++ features throughout the codebase.
  - Consolidated clang/gcc toolchains using ``--config=clang`` or ``--config=gcc``.
  - **Breaking**: Removed ``grpc_credentials/aws_iam`` extension and contrib squash filter.

* HTTP:
  - Added ``x-envoy-original-host`` header to record original host values before mutation.
  - Added HTTP/3 pseudo header validation (disable via ``envoy.restart_features.validate_http3_pseudo_headers``).
  - Fixed HTTP/1 parser to properly handle newlines between requests per RFC 9112.
  - Added request/response trailer mutations support in header mutation filter.

* Load balancing:
  - Added override host load balancing policy.
  - Added hash policy configuration directly to ring hash and maglev load balancers.
  - Added matcher-based cluster specifier plugin for dynamic cluster selection.

* External processing:
  - Added ``FULL_DUPLEX_STREAMED`` body mode for bidirectional streaming.
  - Implemented graceful gRPC side stream closing with timeout.
  - Added per-route ``failure_mode_allow`` override support.

* Wasm:
  - Update v8 and wasmtime dependencies to resolve multiple CVEs

* Authentication:
  - Added OAuth2 token encryption, configurable token expiration, and OIDC logout support.
  - Added API key auth filter with forwarding configuration.
  - Added AWS IAM Roles Anywhere support.

* Observability:
  - Added TLS certificate expiration metrics.
  - Enhanced transport tap with streaming trace capability.
  - Added JA4 fingerprinting to TLS inspector.
  - Added TCP tunneling access log substitution strings.

* New features:
  - Dynamic modules: Added support for ``LocalityLbEndpoints`` metadata and SSL connection info attributes.
  - Stateful session cookie attributes and envelope mode support.
  - Redis proxy AWS IAM authentication and ``scan``/``info`` command support.
  - Lua filter access to filter context and typed metadata.
  - ``ServerNameMatcher`` for trie-based domain matching.

* Notable fixes:
  - Fixed Wasm hang after VM crash in request callbacks.
  - Fixed Lua filter crash when removing status header.
  - Fixed connection pool capacity calculation issues.
  - Improved TCP proxy retry logic to avoid connection issues.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.35.0
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.35.0/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.35.0/version_history/v1.35/v1.35.0
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.34.0...v1.35.0

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>