- Build system upgraded to Bazel 8 (breaking) with workspace mode changes and Intel DLB balancer disabled; new dynamic module extension points and Rust SDK enhancements added.
- Extensive security hardening with dozens of CVE fixes across HTTP/2, HTTP/3, ext authz/proc, gRPC, OAuth2 (AES‑256‑GCM encryption), DNS, JSON parsing, and more.
- New features include weighted bandwidth HTTP filters, MCP streaming JSON parser, improved routing and dynamic forward‑proxy CIDR filtering, Linux sockmap BPF balancer, io_uring enhancements, and richer observability logs.
v1.39.0
Official Envoy changelog summary with source attribution, release tags, and community reactions.
Track this Envoy release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Envoy release note into a weekly digest for the tools you actually use.
Create digestMore Envoy changelog updates
Patched numerous CVEs affecting authz, gRPC, OAuth2, TLS, HTTP/3, and other components, addressing crashes, memory safety, and certificate handling bugs.
Multiple security fixes targeting a range of CVEs, including authz crashes, OAuth2 vulnerabilities, TLS SAN bypass, and HTTP/3 denial‑of‑service issues.
Applied upstream security patches for numerous CVEs covering authz crashes, OAuth2 padding oracle, TLS SAN bypass, HTTP/3 QPACK DoS, and other vulnerabilities.