repo: Release v1.38.2

**Summary of changes**:

* Bug fixes:
  - runtime: fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value.

* New features:
  - http2: added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled ``cookie`` header length, and individual ``cookie`` header count. Enable with ``envoy.reloadable_features.http2_record_histograms``; the histograms and runtime guard will be removed in a future Envoy release.
  - http2: added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` to limit the size of the reassembled ``cookie`` header. By default, no cookie-size limit is enforced.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.2
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.38.2/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.38.2/version_history/v1.38/v1.38.2
**Full changelog**:
    envoyproxy/envoy@v1.38.1...v1.38.2

Author: publish-envoy[bot]

VERSION.txt

@@ -1 +1 @@
-1.38.2-dev
+1.38.2

changelogs/1.35.12.yaml

@@ -0,0 +1,21 @@
+date: June 10, 2026
+
+bug_fixes:
+- area: runtime
+  change: |
+    Fixed a bug where removing an RTDS override for an ``envoy.reloadable_features`` runtime guard
+    updated the admin runtime view but left the process-wide runtime guard set to the previous
+    overridden value.
+
+new_features:
+- area: http2
+  change: |
+    Added histograms for HTTP/2 header stats, tracking total count of header entries received (including
+    individual ``cookie`` headers), total byte size of header map entries, total length of the re-assebled ``cookie``
+    header and total count of individual ``cookie`` headers. Histograms are disabled by default and can be enabled by
+    setting the runtime guard ``envoy.reloadable_features.http2_record_histograms`` to ``true``.
+    The histograms and the runtime guard will be removed in a future release of Envoy.
+- area: http2
+  change: |
+    Added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` runtime value to set the limit on the contents
+    of the re-assembled ``cookie`` header. By default there is no limit on the cookie size.

changelogs/1.36.8.yaml

@@ -0,0 +1,21 @@
+date: June 10, 2026
+
+bug_fixes:
+- area: runtime
+  change: |
+    Fixed a bug where removing an RTDS override for an ``envoy.reloadable_features`` runtime guard
+    updated the admin runtime view but left the process-wide runtime guard set to the previous
+    overridden value.
+
+new_features:
+- area: http2
+  change: |
+    Added histograms for HTTP/2 header stats, tracking total count of header entries received (including
+    individual ``cookie`` headers), total byte size of header map entries, total length of the re-assebled ``cookie``
+    header and total count of individual ``cookie`` headers. Histograms are disabled by default and can be enabled by
+    setting the runtime guard ``envoy.reloadable_features.http2_record_histograms`` to ``true``.
+    The histograms and the runtime guard will be removed in a future release of Envoy.
+- area: http2
+  change: |
+    Added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` runtime value to set the limit on the contents
+    of the re-assembled ``cookie`` header. By default there is no limit on the cookie size.

changelogs/1.37.4.yaml

@@ -0,0 +1,21 @@
+date: June 10, 2026
+
+bug_fixes:
+- area: runtime
+  change: |
+    Fixed a bug where removing an RTDS override for an ``envoy.reloadable_features`` runtime guard
+    updated the admin runtime view but left the process-wide runtime guard set to the previous
+    overridden value.
+
+new_features:
+- area: http2
+  change: |
+    Added histograms for HTTP/2 header stats, tracking total count of header entries received (including
+    individual ``cookie`` headers), total byte size of header map entries, total length of the re-assebled ``cookie``
+    header and total count of individual ``cookie`` headers. Histograms are disabled by default and can be enabled by
+    setting the runtime guard ``envoy.reloadable_features.http2_record_histograms`` to ``true``.
+    The histograms and the runtime guard will be removed in a future release of Envoy.
+- area: http2
+  change: |
+    Added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` runtime value to set the limit on the contents
+    of the re-assembled ``cookie`` header. By default there is no limit on the cookie size.

docs/inventories/v1.35/objects.inv

@@ -28,7 +28,7 @@
 "1.32": 1.32.13
 "1.33": 1.33.14
 "1.34": 1.34.14
-"1.35": 1.35.11
-"1.36": 1.36.7
-"1.37": 1.37.3
-"1.38": 1.38.0
+"1.35": 1.35.12
+"1.36": 1.36.8
+"1.37": 1.37.4
+"1.38": 1.38.1