Skip to content

Commit dd26121

Browse files
jukiejukie
authored
Merge branch 'main' into rebase-8361
2 parents 3c5e532 + cbb4337 commit dd26121

14 files changed

Lines changed: 1393 additions & 111 deletions

File tree

‎examples/envoy-ext-auth/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ require (
1414
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
1515
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
1616
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
17-
golang.org/x/net v0.51.0 // indirect
18-
golang.org/x/sys v0.42.0 // indirect
19-
golang.org/x/text v0.34.0 // indirect
17+
golang.org/x/net v0.53.0 // indirect
18+
golang.org/x/sys v0.43.0 // indirect
19+
golang.org/x/text v0.36.0 // indirect
2020
)

‎examples/envoy-ext-auth/go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,12 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC
3030
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
3131
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
3232
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
33-
golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
34-
golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
35-
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
36-
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
37-
golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
38-
golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
33+
golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
34+
golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
35+
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
36+
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
37+
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
38+
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
3939
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
4040
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
4141
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=

‎examples/grpc-ext-proc/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ require (
1212
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
1313
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
1414
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
15-
golang.org/x/net v0.51.0 // indirect
16-
golang.org/x/sys v0.42.0 // indirect
17-
golang.org/x/text v0.34.0 // indirect
15+
golang.org/x/net v0.53.0 // indirect
16+
golang.org/x/sys v0.43.0 // indirect
17+
golang.org/x/text v0.36.0 // indirect
1818
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
1919
)

‎examples/grpc-ext-proc/go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,12 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC
3030
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
3131
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
3232
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
33-
golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
34-
golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
35-
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
36-
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
37-
golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
38-
golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
33+
golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
34+
golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
35+
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
36+
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
37+
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
38+
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
3939
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
4040
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
4141
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=

‎examples/simple-extension-server/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ require (
1717
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
1818
github.com/russross/blackfriday/v2 v2.1.0 // indirect
1919
github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
20-
golang.org/x/net v0.51.0 // indirect
21-
golang.org/x/sys v0.42.0 // indirect
22-
golang.org/x/text v0.34.0 // indirect
20+
golang.org/x/net v0.53.0 // indirect
21+
golang.org/x/sys v0.43.0 // indirect
22+
golang.org/x/text v0.36.0 // indirect
2323
google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
2424
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
2525
google.golang.org/protobuf v1.36.11 // indirect

‎examples/simple-extension-server/go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,12 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC
4242
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
4343
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
4444
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
45-
golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
46-
golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
47-
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
48-
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
49-
golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
50-
golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
45+
golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
46+
golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
47+
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
48+
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
49+
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
50+
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
5151
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
5252
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
5353
google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4=

‎internal/cmd/server_runner_race_test.go‎

Lines changed: 18 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -20,40 +20,41 @@ import (
2020
"github.com/envoyproxy/gateway/internal/logging"
2121
)
2222

23-
// TestRunnerGoroutineRace specifically reproduces the data race from CI by
24-
// simulating the exact condition: goroutines logging while test cleanup closes t.Output()
23+
// TestRunnerGoroutineRace tests that background goroutines can safely log after context cancellation.
24+
// This test previously exposed a data race when using t.Output() - the test would complete and
25+
// close t.Output() while background goroutines were still logging. The fix is to use os.Stdout
26+
// instead, which is thread-safe and remains valid after the test completes.
2527
//
26-
// The race happens because runner.Close() is a no-op - it returns immediately
27-
// without waiting for goroutines to finish. When the test ends, cleanup closes
28-
// t.Output() while goroutines are still active.
28+
// Note: In production, certGen is called with cmd.OutOrStdout() which resolves to os.Stdout
29+
// in most cases, so using os.Stdout in tests mirrors real-world behavior.
2930
//
3031
// Run with: go test -race -run TestRunnerGoroutineRace -count=100 ./internal/cmd/
3132
func TestRunnerGoroutineRace(t *testing.T) {
3233
// Skip if not running with race detector
33-
// This test is specifically designed to catch the race
3434
if !testing.Short() {
35-
t.Skip("Run with -race flag to detect the race")
35+
t.Skip("Run with -race flag to verify no race conditions")
3636
}
3737

3838
configHome := t.TempDir()
3939
cfgFileContent := strings.ReplaceAll(fileProviderGatewayConfig, "[CONFIG_HOME_PLACE_HODLER]", configHome)
4040
configPath := path.Join(t.TempDir(), "envoy-gateway.yaml")
4141
require.NoError(t, os.WriteFile(configPath, []byte(cfgFileContent), 0o600))
4242

43-
require.NoError(t, certGen(t.Context(), t.Output(), true, configHome))
43+
require.NoError(t, certGen(t.Context(), os.Stdout, true, configHome))
4444

4545
// Use a context WITHOUT defer cancel to keep goroutines alive longer
4646
ctx, cancel := context.WithCancel(context.Background())
4747

4848
hook := func(c context.Context, cfg *config.Server) error {
49-
cfg.Logger = logging.DefaultLogger(t.Output(), egv1a1.LogLevelInfo)
49+
// Use os.Stdout instead of t.Output() - it's thread-safe and won't cause races
50+
cfg.Logger = logging.DefaultLogger(os.Stdout, egv1a1.LogLevelInfo)
5051
return startRunners(c, cfg, nil)
5152
}
5253

5354
errCh := make(chan error, 1)
5455

5556
go func() {
56-
errCh <- server(ctx, t.Output(), t.Output(), configPath, hook, nil)
57+
errCh <- server(ctx, os.Stdout, os.Stdout, configPath, hook, nil)
5758
}()
5859

5960
// Let runners start and become active
@@ -62,19 +63,13 @@ func TestRunnerGoroutineRace(t *testing.T) {
6263
// Cancel context - triggers shutdown but goroutines may still be logging
6364
cancel()
6465

65-
// Don't wait for server to complete - this creates the race!
66-
// Test will end, cleanup will close t.Output(), while goroutines
67-
// are still running and trying to log
66+
// Wait briefly to see if server completes or if goroutines are still running
6867
select {
6968
case <-errCh:
70-
// Server finished
69+
// Server finished cleanly
7170
case <-time.After(20 * time.Millisecond):
72-
// Timeout - goroutines likely still running
73-
// Test ends here, cleanup starts -> RACE!
71+
// Server still running - this is fine with os.Stdout (no race)
7472
}
75-
76-
// Test ends immediately - race window is NOW
77-
// Without fix: goroutines still running, trying to log to closed t.Output()
7873
}
7974

8075
// TestRunnerGoroutineRaceStress runs multiple quick cycles to maximize
@@ -87,20 +82,21 @@ func TestRunnerGoroutineRaceStress(t *testing.T) {
8782
configPath := path.Join(t.TempDir(), "envoy-gateway.yaml")
8883
require.NoError(t, os.WriteFile(configPath, []byte(cfgFileContent), 0o600))
8984

90-
require.NoError(t, certGen(t.Context(), t.Output(), true, configHome))
85+
require.NoError(t, certGen(t.Context(), os.Stdout, true, configHome))
9186

9287
ctx, cancel := context.WithCancel(context.Background())
9388
defer cancel()
9489

9590
hook := func(c context.Context, cfg *config.Server) error {
96-
cfg.Logger = logging.DefaultLogger(t.Output(), egv1a1.LogLevelInfo)
91+
// Use os.Stdout instead of t.Output() - it's thread-safe and won't cause races
92+
cfg.Logger = logging.DefaultLogger(os.Stdout, egv1a1.LogLevelInfo)
9793
return startRunners(c, cfg, nil)
9894
}
9995

10096
errCh := make(chan error, 1)
10197

10298
go func() {
103-
errCh <- server(ctx, t.Output(), t.Output(), configPath, hook, nil)
99+
errCh <- server(ctx, os.Stdout, os.Stdout, configPath, hook, nil)
104100
}()
105101

106102
// Vary timing to hit different race windows
@@ -111,8 +107,6 @@ func TestRunnerGoroutineRaceStress(t *testing.T) {
111107

112108
err := <-errCh
113109
require.NoError(t, err)
114-
115-
// Race window: goroutines may still be logging
116110
})
117111
}
118112
}

‎release-notes/v1.7.3.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
date: May 9, 2026
2+
3+
# Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs.
4+
breaking changes: |
5+
6+
# Updates addressing vulnerabilities, security flaws, or compliance requirements.
7+
security updates: |
8+
Bumped golang to `1.25.10` for including latest security fixes.
9+
Bumped `google.golang.org/grpc` to v1.79.3 to address CVE-2026-33186 (Critical, gRPC-Go authorization bypass via non-canonical HTTP/2 `:path` header).
10+
Bumped `go.opentelemetry.io/otel/sdk` to v1.40.0 to address CVE-2026-24051 (High, OpenTelemetry Go SDK path hijacking on macOS/Darwin).
11+
12+
# New features or capabilities added in this release.
13+
new features: |
14+
15+
16+
bug fixes: |
17+
Fixed a control plane panic caused by concurrent Status mutation racing with the watchable Map coalesce goroutine.
18+
Fixed `ws` and `wss` Backend appProtocols to force HTTP/1.1 upstream connections instead of negotiating HTTP/2, avoiding compatibility issues with WebSocket backends that do not support RFC 8441 extended CONNECT.
19+
Fixed status conditions not being updated when a route is rejected due to multiple errors.
20+
Fixed benchmark JSON report emitting `0` for p99 and p999 percentiles by using the nearest Nighthawk histogram percentiles.
21+
Fixed active HTTP health checks to use Backend endpoint hostnames before falling back to the effective Route hostname.
22+
23+
# Enhancements that improve performance.
24+
performance improvements: |
25+
26+
27+
# Deprecated features or APIs.
28+
deprecations: |
29+
30+
# Other notable changes not covered by the above sections.
31+
Other changes: |

‎site/content/en/news/releases/notes/v1.7.3.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
title: "v1.7.3"
3+
publishdate: 2026-05-09
4+
---
5+
6+
Date: May 9, 2026
7+
8+
## Breaking changes
9+
-
10+
11+
## Security updates
12+
- Bumped golang to `1.25.10` for including latest security fixes.
13+
- Bumped `google.golang.org/grpc` to v1.79.3 to address CVE-2026-33186 (Critical, gRPC-Go authorization bypass via non-canonical HTTP/2 `:path` header).
14+
- Bumped `go.opentelemetry.io/otel/sdk` to v1.40.0 to address CVE-2026-24051 (High, OpenTelemetry Go SDK path hijacking on macOS/Darwin).
15+
16+
## New features
17+
-
18+
19+
## Bug fixes
20+
- Fixed a control plane panic caused by concurrent Status mutation racing with the watchable Map coalesce goroutine.
21+
- Fixed `ws` and `wss` Backend appProtocols to force HTTP/1.1 upstream connections instead of negotiating HTTP/2, avoiding compatibility issues with WebSocket backends that do not support RFC 8441 extended CONNECT.
22+
- Fixed status conditions not being updated when a route is rejected due to multiple errors.
23+
- Fixed benchmark JSON report emitting `0` for p99 and p999 percentiles by using the nearest Nighthawk histogram percentiles.
24+
- Fixed active HTTP health checks to use Backend endpoint hostnames before falling back to the effective Route hostname.
25+
26+
## Performance improvements
27+
28+
-
29+
30+
## Other changes
31+
-

‎site/layouts/shortcodes/helm-version.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@
2121
{{- "v1.6.7" -}}
2222
{{- end -}}
2323
{{- with (strings.HasPrefix $pagePrefix "v1.7") -}}
24-
{{- "v1.7.2" -}}
24+
{{- "v1.7.3" -}}
2525
{{- end -}}
2626
{{- with (strings.HasPrefix $pagePrefix "docs") -}}
27-
{{- "v1.7.2" -}}
27+
{{- "v1.7.3" -}}
2828
{{- end -}}

0 commit comments

Comments
 (0)