- Migrates the build system to Bazel bzlmod (removing WORKSPACE) and bumps the hermetic LLVM/Clang toolchain to version 22, breaking existing build configurations and wasm runtime flags.
- Stabilizes HTTP/3 and QUIC, introduces post‑quantum TLS defaults (X25519‑MLKEM768) and ships a large batch of security fixes covering multiple CVEs across TLS, auth, and protocol handling.
- Adds extensive extensibility (new route, cluster, header, TLS handshaker, and transport socket specifiers), new load‑balancing policies, observability enhancements, and deprecates legacy factories and APIs.