Merge branch 'main' into jbohanon/remove-response-code-to-downstream-…

…guard

.azure-pipelines/stage/publish.yml

@@ -10,12 +10,12 @@ parameters:
 - name: timeoutDockerPublish
   displayName: "Timout Docker publish"
   type: number
-  # in seconds
-  default: 15
+  # in minutes
+  default: 18
 - name: timeoutDockerBuild
   displayName: "Timout Docker build"
   type: number
-  default: 400
+  default: 500
 
 # Auth
 - name: authGCP

.github/workflows/_precheck_deps.yml

@@ -50,7 +50,7 @@ jobs:
     if: ${{ inputs.dependency-review }}
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+      uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
       with:
         ref: ${{ fromJSON(inputs.request).request.sha }}
         persist-credentials: false

.github/workflows/codeql-daily.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+      uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
 
     - name: Free disk space
       uses: envoyproxy/toolshed/gh-actions/[email protected]

.github/workflows/codeql-push.yml

@@ -32,7 +32,7 @@ jobs:
     if: github.repository == 'envoyproxy/envoy'
     steps:
     - name: Checkout repository
-      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+      uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
       with:
         fetch-depth: 2
 

.github/workflows/envoy-dependency.yml

@@ -143,7 +143,7 @@ jobs:
           path: envoy
           fetch-depth: 0
         token: ${{ steps.appauth.outputs.token }}
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
       name: Checkout Envoy build tools repository
       with:
         repository: envoyproxy/envoy-build-tools
@@ -235,7 +235,7 @@ jobs:
       issues: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+      uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
     - name: Run dependency checker
       run: |
         TODAY_DATE=$(date -u -I"date")

.github/workflows/mobile-release.yml

@@ -94,12 +94,12 @@ jobs:
         - output: envoy
         - output: envoy_xds
     steps:
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
       with:
         fetch-depth: 0
     - name: Add safe directory
       run: git config --global --add safe.directory /__w/envoy/envoy
-    - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427  # v4.1.4
+    - uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395  # v4.1.6
       with:
         name: ${{ matrix.output }}_android_aar_sources
         path: .

.github/workflows/mobile-traffic_director.yml

@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 120
     steps:
     - name: Checkout repository
-      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+      uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
     - name: Add safe directory
       run: git config --global --add safe.directory /__w/envoy/envoy
     - name: 'Run GcpTrafficDirectorIntegrationTest'

.github/workflows/pr_notifier.yml

@@ -22,7 +22,7 @@ jobs:
               || !contains(github.actor, '[bot]'))
       }}
     steps:
-    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+    - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
     - name: Notify about PRs
       run: |
         ARGS=()

.github/workflows/scorecard.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633  # v4.1.2
+      uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f  # v4.1.3
       with:
         persist-credentials: false
 
@@ -33,7 +33,7 @@ jobs:
         publish_results: true
 
     - name: "Upload artifact"
-      uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8  # v3.1.0
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
       with:
         name: SARIF file
         path: results.sarif

api/bazel/api_build_system.bzl

@@ -154,8 +154,8 @@ def api_proto_package(
         [_go_proto_mapping(dep) for dep in deps] +
         [
             "@com_envoyproxy_protoc_gen_validate//validate:go_default_library",
-            "@go_googleapis//google/api:annotations_go_proto",
-            "@go_googleapis//google/rpc:status_go_proto",
+            "@org_golang_google_genproto_googleapis_api//annotations:annotations",
+            "@org_golang_google_genproto_googleapis_rpc//status:status",
             "@org_golang_google_protobuf//types/known/anypb:go_default_library",
             "@org_golang_google_protobuf//types/known/durationpb:go_default_library",
             "@org_golang_google_protobuf//types/known/structpb:go_default_library",

api/bazel/external_proto_deps.bzl

@@ -28,8 +28,8 @@ EXTERNAL_PROTO_GO_BAZEL_DEP_MAP = {
     # TODO(https://github.com/bazelbuild/rules_go/issues/1986): update to
     #    @com_google_googleapis when the bug is resolved. Also see the note to
     #    go_googleapis in https://github.com/bazelbuild/rules_go/blob/master/go/dependencies.rst#overriding-dependencies
-    "@com_google_googleapis//google/api/expr/v1alpha1:checked_proto": "@go_googleapis//google/api/expr/v1alpha1:expr_go_proto",
-    "@com_google_googleapis//google/api/expr/v1alpha1:syntax_proto": "@go_googleapis//google/api/expr/v1alpha1:expr_go_proto",
+    "@com_google_googleapis//google/api/expr/v1alpha1:checked_proto": "@org_golang_google_genproto_googleapis_api//expr/v1alpha1",
+    "@com_google_googleapis//google/api/expr/v1alpha1:syntax_proto": "@org_golang_google_genproto_googleapis_api//expr/v1alpha1",
     "@opencensus_proto//opencensus/proto/trace/v1:trace_proto": "@opencensus_proto//opencensus/proto/trace/v1:trace_proto_go",
     "@opencensus_proto//opencensus/proto/trace/v1:trace_config_proto": "@opencensus_proto//opencensus/proto/trace/v1:trace_and_config_proto_go",
     "@opentelemetry_proto//:trace": "@opentelemetry_proto//:trace_go_proto",

api/bazel/repository_locations.bzl

@@ -39,9 +39,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_desc = "xDS API Working Group (xDS-WG)",
         project_url = "https://github.com/cncf/xds",
         # During the UDPA -> xDS migration, we aren't working with releases.
-        version = "0c46c01016dc5c9aeddf6c745a230c32bf62841d",
-        sha256 = "bc1626f5afe5313bac279aeca5761e276abb60c9a1ec9c187c35bfd259f4c40c",
-        release_date = "2024-03-29",
+        version = "7e7c9eab8450ac0babc38d713e4256e0a26765cb",
+        sha256 = "e274268d435358421a7133c7ba23b5ae413412f63eca471ae048c4e4db4ee91b",
+        release_date = "2024-04-19",
         strip_prefix = "xds-{version}",
         urls = ["https://github.com/cncf/xds/archive/{version}.tar.gz"],
         use_category = ["api"],
@@ -118,9 +118,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "OpenTelemetry Proto",
         project_desc = "Language Independent Interface Types For OpenTelemetry",
         project_url = "https://github.com/open-telemetry/opentelemetry-proto",
-        version = "1.1.0",
-        sha256 = "df491a05f3fcbf86cc5ba5c9de81f6a624d74d4773d7009d573e37d6e2b6af64",
-        release_date = "2024-01-11",
+        version = "1.2.0",
+        sha256 = "516dc94685dbaa14fb792788f31d2ef2b0c3ad08dfa8a9a8164e3cf60c1ab6f7",
+        release_date = "2024-04-05",
         strip_prefix = "opentelemetry-proto-{version}",
         urls = ["https://github.com/open-telemetry/opentelemetry-proto/archive/v{version}.tar.gz"],
         use_category = ["api"],
@@ -166,12 +166,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "rules_proto_grpc",
         project_desc = "Bazel rules for building Protobuf and gRPC code and libraries from proto_library targets ",
         project_url = "https://github.com/rules-proto-grpc/rules_proto_grpc",
-        version = "4.4.0",
-        sha256 = "928e4205f701b7798ce32f3d2171c1918b363e9a600390a25c876f075f1efc0a",
+        version = "4.6.0",
+        sha256 = "2a0860a336ae836b54671cbbe0710eec17c64ef70c4c5a88ccfd47ea6e3739bd",
         strip_prefix = "rules_proto_grpc-{version}",
         urls = ["https://github.com/rules-proto-grpc/rules_proto_grpc/releases/download/{version}/rules_proto_grpc-{version}.tar.gz"],
         use_category = ["build"],
-        release_date = "2023-05-03",
+        release_date = "2023-12-14",
     ),
     envoy_toolshed = dict(
         project_name = "envoy_toolshed",

api/contrib/envoy/extensions/filters/network/generic_proxy/action/v3/action.proto

@@ -6,6 +6,7 @@ import "envoy/config/core/v3/base.proto";
 import "envoy/config/route/v3/route_components.proto";
 
 import "google/protobuf/any.proto";
+import "google/protobuf/duration.proto";
 
 import "xds/annotations/v3/status.proto";
 
@@ -22,7 +23,7 @@ option (xds.annotations.v3.file_status).work_in_progress = true;
 // [#protodoc-title: Generic Proxy Route Action Configuration]
 
 // Configuration for the route match action.
-// [#next-free-field: 6]
+// [#next-free-field: 7]
 message RouteAction {
   // The name of the route action. This should be unique across all route actions.
   string name = 5;
@@ -47,4 +48,11 @@ message RouteAction {
   // <envoy_v3_api_field_config.core.v3.TypedExtensionConfig.name>` in the :ref:`generic filters
   // <envoy_v3_api_field_extensions.filters.network.generic_proxy.v3.GenericProxy.filters>`.
   map<string, google.protobuf.Any> per_filter_config = 4;
+
+  // Specifies the upstream timeout for the route. If not specified, the default is 15s. This
+  // spans between the point at which the entire downstream request (i.e. end-of-stream) has been
+  // processed and when the upstream response has been completely processed. A value of 0 will
+  // disable the route's timeout.
+  // [#not-implemented-hide:]
+  google.protobuf.Duration timeout = 6;
 }

api/envoy/service/ext_proc/v3/external_processor.proto

@@ -339,7 +339,7 @@ message ImmediateResponse {
 
   // The message body to return with the response which is sent using the
   // text/plain content type, or encoded in the grpc-message header.
-  string body = 3;
+  bytes body = 3;
 
   // If set, then include a gRPC status trailer.
   GrpcStatus grpc_status = 4;

bazel/dependency_imports.bzl

@@ -101,6 +101,20 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
         # use_category = ["api"],
         # source = "https://github.com/bufbuild/protoc-gen-validate/blob/v0.6.1/dependencies.bzl#L148-L153"
     )
+    go_repository(
+        name = "org_golang_google_genproto_googleapis_api",
+        importpath = "google.golang.org/genproto/googleapis/api",
+        sum = "h1:DoPTO70H+bcDXcd39vOqb2viZxgqeBeSGtZ55yZU4/Q=",
+        version = "v0.0.0-20230822172742-b8732ec3820d",
+        build_external = "external",
+    )
+    go_repository(
+        name = "org_golang_google_genproto_googleapis_rpc",
+        importpath = "google.golang.org/genproto/googleapis/rpc",
+        sum = "h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=",
+        version = "v0.0.0-20230822172742-b8732ec3820d",
+        build_external = "external",
+    )
     go_repository(
         name = "org_golang_google_protobuf",
         importpath = "google.golang.org/protobuf",

bazel/repositories.bzl

@@ -1471,7 +1471,3 @@ def _com_github_maxmind_libmaxminddb():
         name = "com_github_maxmind_libmaxminddb",
         build_file_content = BUILD_ALL_CONTENT,
     )
-    native.bind(
-        name = "maxmind",
-        actual = "@envoy//bazel/foreign_cc:maxmind_linux_darwin",
-    )

bazel/repository_locations.bzl

@@ -33,10 +33,10 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Gazelle",
         project_desc = "Bazel BUILD file generator for Go projects",
         project_url = "https://github.com/bazelbuild/bazel-gazelle",
-        version = "0.31.1",
-        sha256 = "b8b6d75de6e4bf7c41b7737b183523085f56283f6db929b86c5e7e1f09cf59c9",
+        version = "0.36.0",
+        sha256 = "75df288c4b31c81eb50f51e2e14f4763cb7548daae126817247064637fd9ea62",
         urls = ["https://github.com/bazelbuild/bazel-gazelle/releases/download/v{version}/bazel-gazelle-v{version}.tar.gz"],
-        release_date = "2023-06-13",
+        release_date = "2024-04-03",
         use_category = ["build"],
         license = "Apache-2.0",
         license_url = "https://github.com/bazelbuild/bazel-gazelle/blob/v{version}/LICENSE",
@@ -72,9 +72,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Bazel build tools",
         project_desc = "Developer tools for working with Google's bazel buildtool.",
         project_url = "https://github.com/bazelbuild/buildtools",
-        version = "7.1.0",
-        sha256 = "061472b3e8b589fb42233f0b48798d00cf9dee203bd39502bd294e6b050bc6c2",
-        release_date = "2024-03-26",
+        version = "7.1.1",
+        sha256 = "60a9025072ae237f325d0e7b661e1685f34922c29883888c2d06f5789462b939",
+        release_date = "2024-04-17",
         strip_prefix = "buildtools-{version}",
         urls = ["https://github.com/bazelbuild/buildtools/archive/v{version}.tar.gz"],
         use_category = ["test_only"],
@@ -148,12 +148,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Aspect Bazel helpers",
         project_desc = "Base Starlark libraries and basic Bazel rules which are useful for constructing rulesets and BUILD files",
         project_url = "https://github.com/aspect-build/bazel-lib",
-        version = "2.7.0",
-        sha256 = "357dad9d212327c35d9244190ef010aad315e73ffa1bed1a29e20c372f9ca346",
+        version = "2.7.1",
+        sha256 = "b554eb7942a5ab44c90077df6a0c76fc67c5874c9446a007e9ba68be82bd4796",
         strip_prefix = "bazel-lib-{version}",
         urls = ["https://github.com/aspect-build/bazel-lib/archive/v{version}.tar.gz"],
         use_category = ["build"],
-        release_date = "2024-04-03",
+        release_date = "2024-04-20",
         cpe = "N/A",
         license = "Apache-2.0",
         license_url = "https://github.com/aspect-build/bazel-lib/blob/v{version}/LICENSE",
@@ -204,12 +204,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Perfetto",
         project_desc = "Perfetto Tracing SDK",
         project_url = "https://perfetto.dev/",
-        version = "43.1",
-        sha256 = "0f23ba39520c9ec629c48dc36a3a4bb92ed9653ac6694445be22985205a3f4ce",
+        version = "44.0",
+        sha256 = "db4162ee6495b1fcc13ba7aca77d67f9fd1766d184743137a04af8b1e3906b9d",
         strip_prefix = "perfetto-{version}/sdk",
         urls = ["https://github.com/google/perfetto/archive/v{version}.tar.gz"],
         use_category = ["dataplane_core", "controlplane"],
-        release_date = "2024-03-05",
+        release_date = "2024-04-10",
         cpe = "N/A",
         license = "Apache-2.0",
         license_url = "https://github.com/google/perfetto/blob/v{version}/LICENSE",
@@ -1007,11 +1007,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Go rules for Bazel",
         project_desc = "Bazel rules for the Go language",
         project_url = "https://github.com/bazelbuild/rules_go",
-        version = "0.39.1",
-        sha256 = "6dc2da7ab4cf5d7bfc7c949776b1b7c733f05e56edc4bcd9022bb249d2e2a996",
+        version = "0.46.0",
+        sha256 = "80a98277ad1311dacd837f9b16db62887702e9f1d1c4c9f796d0121a46c8e184",
         urls = ["https://github.com/bazelbuild/rules_go/releases/download/v{version}/rules_go-v{version}.zip"],
         use_category = ["build", "api"],
-        release_date = "2023-04-20",
+        release_date = "2024-02-10",
         implied_untracked_deps = [
             "com_github_golang_protobuf",
             "io_bazel_rules_nogo",
@@ -1192,12 +1192,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "QUICHE",
         project_desc = "QUICHE (QUIC, HTTP/2, Etc) is Google‘s implementation of QUIC and related protocols",
         project_url = "https://github.com/google/quiche",
-        version = "4191e8be1c83f6e55b47d65593561807133dc83a",
-        sha256 = "27fee1b8b67e0013dc219e8db28e090e14cb3dbd51a8dc973b32d0bf8a7f1826",
+        version = "62f5f6c9caabe019240b2a4377090bb657012c3f",
+        sha256 = "d4d976917b173167a8d600b87f01a4b9c169d15b92625894bfce2802362c76ad",
         urls = ["https://github.com/google/quiche/archive/{version}.tar.gz"],
         strip_prefix = "quiche-{version}",
         use_category = ["controlplane", "dataplane_core"],
-        release_date = "2024-04-11",
+        release_date = "2024-04-19",
         cpe = "N/A",
         license = "BSD-3-Clause",
         license_url = "https://github.com/google/quiche/blob/{version}/LICENSE",

changelogs/1.27.5.yaml

@@ -0,0 +1,7 @@
+date: April 18, 2024
+
+bug_fixes:
+- area: tls
+  change: |
+    Fix a RELEASE_ASSERT when using :ref:`auto_sni <envoy_v3_api_field_config.core.v3.UpstreamHttpProtocolOptions.auto_sni>`
+    if the downstream request ``:authority`` was longer than 255 characters.

changelogs/1.28.3.yaml

@@ -0,0 +1,7 @@
+date: April 18, 2024
+
+bug_fixes:
+- area: tls
+  change: |
+    Fix a RELEASE_ASSERT when using :ref:`auto_sni <envoy_v3_api_field_config.core.v3.UpstreamHttpProtocolOptions.auto_sni>`
+    if the downstream request ``:authority`` was longer than 255 characters.

changelogs/1.29.4.yaml

@@ -0,0 +1,11 @@
+date: April 18, 2024
+
+bug_fixes:
+- area: tls
+  change: |
+    Fix a RELEASE_ASSERT when using :ref:`auto_sni <envoy_v3_api_field_config.core.v3.UpstreamHttpProtocolOptions.auto_sni>`
+    if the downstream request ``:authority`` was longer than 255 characters.
+- area: admin
+  change: |
+    Fixed a bug where the config_dump & init_dump admin endpoint would return an empty response when called with empty
+    query parameters (e.g. ``/config_dump?resource=&mask=&name_regex=``).

changelogs/1.30.1.yaml

@@ -0,0 +1,7 @@
+date: April 18, 2024
+
+bug_fixes:
+- area: tls
+  change: |
+    Fix a RELEASE_ASSERT when using :ref:`auto_sni <envoy_v3_api_field_config.core.v3.UpstreamHttpProtocolOptions.auto_sni>`
+    if the downstream request ``:authority`` was longer than 255 characters.