FOSSWire
Search/
Cloud Native & eBPF

Envoy v1.40.0: Post-quantum TLS, stable HTTP/3, and Bazel bzlmod migration

Brief written by the FOSSWire AI editor from Envoy How we write

1 min read 40 reads

Key Takeaway

Envoy 1.40.0 introduces post-quantum hybrid key exchange by default and stabilizes HTTP/3 and QUIC support.

Summary

Envoy proxy has released version 1.40.0, featuring a major build system migration from WORKSPACE to bzlmod. The release stabilizes HTTP/3 and QUIC, adds X25519MLKEM768 hybrid key exchange for post-quantum security, and introduces alpha support for an AI Protocol Manager filter. It also includes significant security hardening and several CVE fixes.

Technical changes in Envoy 1.40.0

  • Build System: Migration to bzlmod requires downstreams to use MODULE.bazel and Envoy's custom registry.
  • Security: Default ECDH curves now include X25519MLKEM768 hybrid key exchange; HTTP/3 and QUIC are now stable.
  • Networking: QUIC listeners now support mTLS (client certificates), and UDP hot restarts preserve established sessions during drain.
  • AI/MCP: New AI Protocol Manager (alpha) filter extracts LLM token usage for OpenAI, Anthropic, and Gemini.
  • Breaking Changes: Removal of AWS-LC as a selectable SSL library and changes to the Rust SDK HttpFilter hooks.

Why it matters

The migration to bzlmod and the shift to post-quantum TLS defaults represent significant changes for users managing large-scale deployments and security compliance.

Original reference: github.com →