current.yaml

date: Pending

behavior_changes:
# *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
- area: wasm
  change: |
    Remove previously deprecated xDS attributes from ``get_property``, use ``xds`` attributes instead.

minor_behavior_changes:
# *Changes that may cause incompatibilities for some users, but should not for most*
- area: access_log
  change: |
    New implementation of the JSON formatter will be enabled by default.
    The :ref:`sort_properties <envoy_v3_api_field_config.core.v3.JsonFormatOptions.sort_properties>` field will
    be ignored in the new implementation because the new implementation always sorts properties. And the new implementation
    will always keep the value type in the JSON output. For example, the duration field will always be rendered as a number
    instead of a string.
    This behavior change could be disabled temporarily by setting the runtime
    ``envoy.reloadable_features.logging_with_fast_json_formatter`` to false.
- area: formatter
  change: |
    The NaN and Infinity values of float will be serialized to ``null`` and ``"inf"`` respectively in the
    metadata (``DYNAMIC_METADATA``, ``CLUSTER_METADATA``, etc.) formatter.
- area: http
  change: |
    If the :ref:`pack_trace_reason <envoy_v3_api_field_extensions.request_id.uuid.v3.UuidRequestIdConfig.pack_trace_reason>`
    is set to false, Envoy will not parse the trace reason from the ``x-request-id`` header to ensure reads and writes of
    trace reason be consistant.
    If the :ref:`pack_trace_reason <envoy_v3_api_field_extensions.request_id.uuid.v3.UuidRequestIdConfig.pack_trace_reason>`
    is set to true and external ``x-request-id`` value is used, the trace reason in the external request id will not
    be trusted and will be cleared.
- area: oauth2
  change: |
    :ref:`use_refresh_token <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.use_refresh_token>`
    is now enabled by default. This behavioral change can be temporarily reverted by setting runtime guard
    ``envoy.reloadable_features.oauth2_use_refresh_token`` to false.

bug_fixes:
# *Changes expected to improve the state of the world and are unlikely to have negative effects*
- area: tls
  change: |
    Support operations on IP SANs when the IP version is not supported by the host operating system, for example
    an IPv6 SAN can now be used on a host not supporting IPv6 addresses.

removed_config_or_runtime:
# *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
- area: router
  change: |
    Removed runtime guard ``envoy_reloadable_features_send_local_reply_when_no_buffer_and_upstream_request``.
- area: load balancing
  change: |
    Removed runtime guard ``envoy.reloadable_features.edf_lb_host_scheduler_init_fix`` and legacy code paths.
- area: grpc
  change: |
    Removed runtime guard ``envoy.reloadable_features.validate_grpc_header_before_log_grpc_status``.
- area: http
  change: |
    Removed runtime flag ``envoy.reloadable_features.http_route_connect_proxy_by_default`` and legacy code paths.
- area: dns
  change: |
    Removed runtime flag ``envoy.reloadable_features.dns_reresolve_on_eai_again`` and legacy code paths.
- area: quic
  change: |
    Removed runtime flag ``envoy.restart_features.quic_handle_certs_with_shared_tls_code`` and legacy code paths.
- area: upstream
  change: |
    Removed runtime flag ``envoy.restart_features.allow_client_socket_creation_failure`` and legacy code paths.

new_features:
- area: wasm
  change: |
    Added the wasm vm reload support to reload wasm vm when the wasm vm is failed with runtime errors. See
    :ref:`failure_policy <envoy_v3_api_field_extensions.wasm.v3.PluginConfig.failure_policy>` for more details.
    The ``FAIL_RELOAD`` reload policy will be used by default.
- area: aws_request_signing
  change: |
    Added an optional field :ref:`credential_provider
    <envoy_v3_api_field_extensions.filters.http.aws_request_signing.v3.AwsRequestSigning.credential_provider>`
    to the AWS request signing filter to explicitly specify a source for AWS credentials.
- area: tls
  change: |
    Added support for P-384 and P-521 curves for TLS server certificates.
- area: access_log
  change: |
    Added %DOWNSTREAM_LOCAL_EMAIL_SAN%, %DOWNSTREAM_PEER_EMAIL_SAN%, %DOWNSTREAM_LOCAL_OTHERNAME_SAN% and
    %DOWNSTREAM_PEER_OTHERNAME_SAN% substitution formatters.
- area: http_inspector
  change: |
    Added default-false ``envoy.reloadable_features.http_inspector_use_balsa_parser`` for HttpInspector to use BalsaParser.
- area: tracers
  change: |
    Set resource ``telemetry.sdk.*`` and scope ``otel.scope.name|version`` attributes for the OpenTelemetry tracer.

deprecated: