v1.38.0

Official Envoy changelog summary with source attribution, release tags, and community reactions.

Track this Envoy release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

Envoy·4 months ago · Apr 23, 2026, 11:53 PMFixMay break your integrationAI-assisted summary

Summary

Breaking: TCP proxy now requires max early data bytes for non‑IMMEDIATE upstream connect modes; BoringSSL/FIPS flag removed; RSA key‑usage enforcement defaults to true and will be removed in a future release.
Feature: Added extensive dynamic module extension points, unified Rust SDK init macro, new HTTP filters (SSE‑to‑metadata, file server), TLS certificate compression (brotli/zlib) with OpenSSL support, and many observability enhancements i...
Security & Bugfix: Introduced SPIFFE trust‑domain selection, ext‑authz shadow mode, stricter RBAC header matching, OpenSSL alternative, plus numerous stability fixes (hot‑restart listeners, HTTP/1 zombie stream leaks, ext‑proc chain hand...

featurebreakingsecuritybugfixsource healthy

Official source Last checked 14 hours ago

Loading follow options…

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked 14 hours ago

related channels

Turn this Envoy release note into a weekly digest for the tools you actually use.