Merge branch 'main' into lb-context-host-stat

# Conflicts:
#	changelogs/current.yaml

Author: basundhara-c

api/envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto

@@ -125,4 +125,11 @@ message McpRouter {
   // If set, extracts a request "subject" and binds it into the MCP session.
   // If not set, sessions are created without identity binding.
   SessionIdentity session_identity = 2;
+
+  // If true, backend initialization is deferred until the first request that targets each backend.
+  // The ``initialize`` response is returned immediately with gateway capabilities and an empty
+  // backend session map. Each backend is initialized on-demand when a request first routes to it.
+  // This avoids blocking the client ``initialize`` on slow or misbehaving backends.
+  // Default is false (eager initialization of all backends during ``initialize``).
+  bool lazy_initialization = 3;
 }

bazel/deps.yaml

@@ -296,7 +296,7 @@ quiche:
   project_name: "QUICHE"
   project_desc: "QUICHE (QUIC, HTTP/2, Etc) is Google‘s implementation of QUIC and related protocols"
   project_url: "https://github.com/google/quiche"
-  release_date: "2026-05-14"
+  release_date: "2026-05-18"
   use_category:
   - controlplane
   - dataplane_core

bazel/repository_locations.bzl

@@ -553,8 +553,8 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         urls = ["https://github.com/simdutf/simdutf/releases/download/v{version}/singleheader.zip"],
     ),
     quiche = dict(
-        version = "f129e801d183fd095620d3bd68f8119ca9d5c0ea",
-        sha256 = "f70ab89a950bb46f239c29e7e9757b3ce3082403a65e9e1920ccd2cf3fcedbeb",
+        version = "6460010e28a23919ce1f6db92d9fa125ce41fab6",
+        sha256 = "807c62410050395fc8d26eac6454e206490b12ac2e0a98b808a5250e303174d3",
         urls = ["https://github.com/google/quiche/archive/{version}.tar.gz"],
         strip_prefix = "quiche-{version}",
     ),

changelogs/BUILD

@@ -1,12 +1,18 @@
 licenses(["notice"])  # Apache 2
 
 exports_files([
-    "sections.yaml",
+    "changelogs.yaml",
 ])
 
 filegroup(
     name = "changelogs",
-    srcs = glob(["*.*.*.yaml"]) + ["current.yaml"],
+    srcs = glob([
+        "*.*.*.yaml",
+        "current/**/*.rst",
+    ]) + [
+        "changelogs.yaml",
+        "current.yaml",
+    ],
     visibility = ["//visibility:public"],
 )
 

changelogs/changelogs.yaml

@@ -0,0 +1,96 @@
+# `sections:` lists the valid top-level changelog sections (e.g.
+#     `bug_fixes`, `new_features`).
+#     NB: Do not change sections without prior agreement from maintainers
+#     TODO(phlax): move current config to tool defaults
+#
+# `areas:` lists the canonical set of areas accepted by per-entry
+#     changelog filenames in changelogs/current/<section>/<area>__<slug>.rst.
+#     In filenames, '/' MUST be encoded as '~'.
+#     Adding a new area requires a PR updating this file.
+
+sections:
+  changes:
+    title: Changes
+  behavior_changes:
+    title: Incompatible behavior changes
+    description: |
+      *Changes that are expected to cause an incompatibility if applicable;
+      deployment changes are likely required*
+
+  minor_behavior_changes:
+    title: Minor behavior changes
+    description: |
+      *Changes that may cause incompatibilities for some users, but should
+      not for most*
+
+  bug_fixes:
+    title: Bug fixes
+    description: |
+      *Changes expected to improve the state of the world and are unlikely
+      to have negative effects*
+
+  removed_config_or_runtime:
+    title: Removed config or runtime
+    description: |
+      *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
+
+  new_features:
+    title: New features
+  deprecated:
+    title: Deprecated
+
+areas:
+  access_log:
+    title: access_log
+  attributes:
+    title: attributes
+  build:
+    title: build
+  composite:
+    title: composite
+  dns_resolver:
+    title: dns_resolver
+  dynamic_modules:
+    title: dynamic_modules
+  golang:
+    title: golang
+  http:
+    title: http
+  http2:
+    title: http2
+  http_inspector:
+    title: http_inspector
+  jwt_authn:
+    title: jwt_authn
+  load_report:
+    title: load_report
+  logging:
+    title: logging
+  mysql_proxy:
+    title: mysql_proxy
+  oauth2:
+    title: oauth2
+  quic:
+    title: quic
+  ratelimit:
+    title: ratelimit
+  rbac:
+    title: rbac
+  resource_monitors:
+    title: resource_monitors
+  router:
+    title: router
+  set_metadata_filter:
+    title: set_metadata_filter
+  spiffe_validator:
+    title: spiffe_validator
+  stat_sinks:
+    title: stat_sinks
+  stats:
+    title: stats
+  tcp_proxy:
+    title: tcp_proxy
+  tls:
+    title: tls
+  wasm:
+    title: wasm