build(deps): bump github.com/envoyproxy/envoy from 1.38.1 to 1.39.0 in /golang-network/simple in the examples-golang-network group across 1 directory

[dependabot]

Bumps the examples-golang-network group with 1 update in the /golang-network/simple directory: github.com/envoyproxy/envoy.

Updates github.com/envoyproxy/envoy from 1.38.1 to 1.39.0

Release notes

Sourced from github.com/envoyproxy/envoy's releases.

v1.39.0

Summary of changes

Breaking changes

• build: Envoy now uses Bazel 8. Because Envoy still uses WORKSPACE mode, --enable_workspace and --noenable_bzlmod are required and have been added to .bazelrc; external-repository runfiles now appear directly under the runfiles root.
• build: the Intel DLB connection balancer (envoy.network.connection_balance.dlb) is disabled for all builds due to a broken source archive.
• TLS: enforce_rsa_key_usage is deprecated and ignored; Envoy now always enforces the certificate keyUsage extension.
• TLS inspector: client TLS versions are validated and must be between TLS 1.0 and TLS 1.3 (revertible via envoy.reloadable_features.tls_inspector_enforce_client_tls_version).
• OpenTelemetry tracing: the tracer now honors Envoy's request-entry sampling decision, including overall_sampling, even when propagated trace context or the configured sampler requests sampling. This may reduce exported spans.

Security

• HTTP/2 now counts uncompressed cookies toward header-size and header-count limits (CVE-2026-47774), strengthens PRIORITY/WINDOW_UPDATE flood protection, and adds configurable nghttp2 RST_STREAM rate limits.
• HTTP/3 fixes cover QPACK blocked-decoding denial of service (GHSA-p7c7-7c47-pwch) and inconsistent headers-only content-length handling (CVE-2026-48743).
• Security fixes were added for ext_authz (CVE-2026-47205), ext_proc (CVE-2026-47207), gRPC stats (CVE-2026-47204), internal redirects (CVE-2026-47221), and OAuth2 lifecycle handling (CVE-2026-48090).
• OAuth2 adds AES-256-GCM cookie encryption to address CVE-2026-47775. Migration is opt-in: enable oauth2_use_gcm_encryption, monitor oauth_legacy_cbc_decrypt, then disable oauth2_legacy_cbc_decrypt_compat.
• Additional fixes cover DNS query validation (CVE-2026-48497), JSON nesting limits (CVE-2026-48042), PROXY protocol TLV smuggling (CVE-2026-47692), formatter crashes (CVE-2026-47220), TCP StatsD overflow (CVE-2026-48706), TLS SAN NUL handling (CVE-2026-47778), and Zstd decompression memory exhaustion (CVE-2026-48044).
• New upstream RBAC and dynamic-forward-proxy resolved-address filtering provide CIDR-based protection against SSRF after DNS resolution and host selection.

Dynamic modules

• New extension points: access-log/header formatters, downstream and upstream transport sockets, active health checkers, and stats sinks.
• Cluster load balancers can read host stats, read and write dynamic metadata and filter state, and publish main-thread state to worker-local slots.
• Modules can emit metrics from configuration and background contexts; loading and initialization failures now expose server-wide counters tagged by extension instance.
• Added validation-mode detection, network/listener attribute access, batched header and metadata APIs, effective log-level access, and zero-copy borrowed buffers in the Rust SDK.
• Fixed listener HTTP-callout crashes, watermark initialization, streaming-response re-entry, independent decode/encode continuation, CatchUnwind re-entry, Struct configuration handling, and HTTP/TCP bridge buffer overflow with more than 64 slices.

MCP (Model Context Protocol) and AI protocols

• Added a Wuffs-backed streaming JSON parser for MCP, A2A, OpenAI, Anthropic, and related protocols, with bounded field capture, incremental parsing, no DOM allocation, and duplicate-key detection.
• MCP filtering now exposes processing status, supports configurable duplicate-key rejection, and improves oversized-body behavior for pass-through and rejection modes.
• MCP router adds elicitation and server-to-client request routing, plus lazy per-backend initialization.
• MCP JSON REST Bridge adds per-route tool configuration and locally generated tools/list responses.

HTTP, routing and protocol

• New HTTP filters provide weighted bandwidth sharing and selectable sub-filter chains with per-route configuration.
• HeaderMatcher now evaluates separately supplied header values individually instead of matching only their comma-joined representation (revertible via envoy.reloadable_features.match_headers_individually).
• HTTP inspector uses Balsa by default and now fast-fails invalid non-HTTP method bytes instead of buffering up to 64 KiB.
• Added drain-timeout and maximum-connection-duration jitter to reduce synchronized reconnect spikes.
• Routing gains cluster refresh on retries, weighted-cluster reselection, formatter/CEL-based redirect paths, and mixed literal/variable URI-template segments.
• Fixed connection-pool re-entrancy, connectivity-grid teardown and duplicate-attempt bugs, stale on-demand cluster information, and handling of HTTP/2 or HTTP/3 RST_STREAM(NO_ERROR) after complete responses.

TLS, authentication and authorization

• Added CNSA 1.0/2.0 compliance policies, TLS group formatters for identifying post-quantum key exchange, and suppression of oversized client CA lists.
• QUIC supports opt-in TLS key logging and session-ticket resumption.
• TLS certificate compression via the brotli runtime guard is disabled by default; TLS sockets also gain improved connection-reset reporting.
• OAuth2 adds PRIVATE_KEY_JWT, ID-token forwarding, configurable post-logout redirects, access-token-based cookie lifetime, and safe original-request URI formatting with redirect-domain allowlists.
• BasicAuth supports missing-credential pass-through and authenticated-username metadata; JWT extraction can mark forwarded claims whose signatures were not verified.

DNS, load balancing and upstream

• The unified DNS cluster implementation is enabled by default; equivalent c-ares resolvers can be shared across clusters to support shared qcache.
• DNS clusters gain a minimum TTL refresh floor, while dynamic forward proxy sub-clusters can use DnsCluster configuration and resolved-address CIDR filtering.

... (truncated)

Changelog

Sourced from github.com/envoyproxy/envoy's changelog.

Release Process

Active development

Active development is happening on the main branch, and a new version is released from it.

Stable releases

Stable releases of Envoy include:

• Major releases in which a new version a created directly from the main branch.
• Minor releases for versions covered by the extended maintenance window (any version released in the last 12 months).
  • Security fixes backported from the main branch (including those deemed not worthy of creating a CVE).
  • Stability fixes backported from the main branch (anything that can result in a crash, including crashes triggered by a trusted control plane).
  • Bugfixes, deemed worthwhile by the maintainers of stable releases.

Major releases happen quartely and follow the schedule below. Security fixes typically happen quarterly as well, but this depends on the number and severity of security bugs. Other releases are ad-hoc and best-effort.

Security releases

Critical security fixes are owned by the Envoy security team, which provides fixes for the main branch. Once those fixes are ready, the maintainers of stable releases backport them to the remaining supported stable releases.

Backports

All other security and reliability fixes can be nominated for backporting to stable releases by adding the backport/review label (this can be done using [repokitteh]'s /backport command on PRs).

Only security and reliability fixes are backported, so please consider this before proposing a backport.

Envoy release maintainers will try to review and include any pending proposed backports prior to patch releases. Backports can also be proposed directly, by raising a PR against the relevant release branch, eg release/v1.37.

When raising a backport, please raise against all supported branches, that are affected.

Backport PRs should pick specific commits from the main branch, and should be kept as specific commits while tracking the upstream release branch, before landing.

For this reason, change should be managed using rebase rather than merge, and if adjustments are required they should be squashed into the relevant commit.

Release branches are published as part of the security schedule described below, and immediately

... (truncated)

Commits

• 8eea328 [release/main] repo: Release v1.39.0 (#46121)
• ed81150 changelogs: Add summary for release v1.39.0 (#46119)
• 2156809 changelog: add missing entry for Bazel 8 bump (#46118)
• 7eb28b1 Split tls:context_impl_test to prevent bazel timeouts (#46099)
• 9de9db6 fix expired link in all the MD (#46107)
• 1311e4f Update CODEOWNERS for Redis extensions (#46106)
• b43c258 router_check: add timeout route assertion to router_check_tool (#46019)
• cde54ec Use mcp prefix and lower case in mcp filter status (#46079)
• 41b47b0 dynamic_modules: add set_filter_state callbacks to cluster LB context (#46084)
• d4cbcd6 http: migrate local_ratelimit/mcp/... to exception free (#46038)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[phlax]

@dependabot rebase

[dependabot]

Looks like github.com/envoyproxy/envoy is no longer updatable, so this is no longer needed.