[dependabot]

Bumps the examples-golang-http group with 1 update in the /golang-http/simple directory: github.com/envoyproxy/envoy.

Updates github.com/envoyproxy/envoy from 1.39.3 to 1.40.1

Release notes

Sourced from github.com/envoyproxy/envoy's releases.

v1.40.1

Summary of changes:

• Upstream security fixes:

  • eMudhra intermediate CA compromise: the private keys of several eMudhra intermediate CA certificates were compromised.
    • release: updated the Envoy docker images so they no longer trust the compromised eMudhra CAs.
    • mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots from the root certificate bundle built into Envoy Mobile. Servers whose certificate chains only lead to these roots are no longer trusted by Envoy Mobile when it uses its built-in bundle.
    • dns_resolver: updated the webpki-roots and rustls-webpki crates used by the built-in Hickory DNS resolver, so DNS-over-TLS and DNS-over-HTTPS upstreams no longer trust the compromised eMudhra intermediate CAs.

• Behavior changes:

  • contrib/istio: peer metadata conversion takes a peer's app name and version from the app and version labels again, falling back to app.kubernetes.io/name and app.kubernetes.io/version only when those are absent or empty. This makes peer-reported source_app, destination_app, source_version and destination_version match the values a workload reports for itself.

Docker images: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.40.1 Docs: https://www.envoyproxy.io/docs/envoy/v1.40.1/ Release notes: https://www.envoyproxy.io/docs/envoy/v1.40.1/version_history/v1.40/v1.40.1 Full changelog: envoyproxy/envoy@v1.40.0...v1.40.1

Signed-off-by: Jonh Wendell jwendell@redhat.com Signed-off-by: Ryan Northey ryan@synca.io

v1.40.0

Summary of changes

Breaking changes

• build: Envoy has switched from WORKSPACE to bzlmod. The WORKSPACE file is removed; Envoy, the API and the docs are published as Bazel modules (envoy, envoy_api, envoy-docs). Downstreams must migrate to MODULE.bazel and must add Envoy's custom registry (https://raw.githubusercontent.com/envoyproxy/bazel-registry) alongside the BCR — many of Envoy's dependencies and patched modules are only published there.
• build: the hermetic LLVM/Clang toolchain is bumped from 18 to 22. --config=clang and clang-local are removed — Clang/libc++ is now the default and needs no flag; GCC remains via --config=gcc. The --@envoy//bazel:libc++/libstdc++ flags and force_libcpp define are gone. Downstreams needing a host LLVM toolchain should follow bazel/tests/codeql.
• build: the Wasm runtime is now selected with --@proxy-wasm-cpp-host//bazel:engine=<engine>; the old --define wasm=/--define engine= flags fail the build.
• tls: AWS-LC is removed as a selectable SSL library (including --config=aws-lc-fips). ppc64le builds should use --config=openssl.
• mcp_router: downstream request headers are no longer forwarded to backends by default — notably authorization. Use the new per-backend header_forwarding (forward_all: true restores the old behavior).
• dynamic modules (Rust SDK): HttpFilter hooks now take &self rather than &mut self; per-stream mutable state must move behind interior mutability. This closes a use-after-free on synchronous filter-chain teardown.

Major changes

• HTTP/3 and QUIC are now stable, including upstream HTTP/3 and all QUIC extensions. QUIC listeners gain client-certificate (mTLS) support, upstream QUIC gains client certificates, and P-384/P-521 ECDSA curves are supported.

... (truncated)

Commits

• 86af01f repo: Release v1.40.1
• d9a0951 Add summary for 1.40.1 (#48601)
• 4a638d5 [bp/1.40] contrib/istio: prefer app over app.kubernetes.io/name in workload m...
• 2d04a15 ci/cves: Fix scanner handling of pre versions (#48537)
• 04eec30 deps: distrust compromised eMudhra intermediate CAs (#48515) (#48526)
• cd1563c bazel: Enable prebuilt wee8 (#48505) (#48525)
• b823b3b deps: Bump build images -> v0.2.5 (#48513) (#48522)
• e74f473 release: Bump bazel module versions in create-release and reopen-branch (#48326)
• e71b965 ci: Remove mobile config (#48301)
• a4b1ab0 repo: Remove mobile ci for release branch
• Additional commits viewable in compare view

[dependabot]

Looks like github.com/envoyproxy/envoy is no longer updatable, so this is no longer needed.