Updating Envoy version to ee9df7b (2025-11-16T17:51:21Z)

.bazelrc

@@ -2,8 +2,9 @@
 # This is necessary since this needs to be available before we can access                   # unique
 # the Envoy repository contents via Bazel.                                                  # unique
                                                                                             # unique
-build:asan --test_timeout=900                                                               # unique
-build:tsan --test_timeout=3600                                                              # unique
+build:asan --test_timeout=4800                                                               # unique
+build:tsan --test_timeout=4800                                                              # unique
+build:test_gcc --test_timeout=4800                                                          # unique
 # See https://github.com/envoyproxy/nighthawk/issues/405                                    # unique
 build:macos --copt -UDEBUG                                                                  # unique
                                                                                             # unique
@@ -18,6 +19,7 @@ build:macos --copt -UDEBUG
 # The number 3G is chosen heuristically to both support large VM and small VM with RBE.
 # Startup options cannot be selected via config.
 # TODO: Adding just to test android
+startup --host_jvm_args=-Xmx3g
 startup --host_jvm_args="-DBAZEL_TRACK_SOURCE_DIRECTORIES=1"
 
 common --noenable_bzlmod
@@ -109,15 +111,15 @@ build:sanitizer --linkopt -ldl
 test:sanitizer --build_tests_only
 
 # Common flags for Clang (shared between all clang variants)
-build:clang-common --action_env=BAZEL_COMPILER=clang
-build:clang-common --linkopt=-fuse-ld=lld
-build:clang-common --action_env=CC=clang --host_action_env=CC=clang
-build:clang-common --action_env=CXX=clang++ --host_action_env=CXX=clang++
-build:clang-common --incompatible_enable_cc_toolchain_resolution=false
+common:clang-common --action_env=BAZEL_COMPILER=clang
+common:clang-common --linkopt=-fuse-ld=lld
+common:clang-common --action_env=CC=clang --host_action_env=CC=clang
+common:clang-common --action_env=CXX=clang++ --host_action_env=CXX=clang++
+common:clang-common --incompatible_enable_cc_toolchain_resolution=false
 
 # Clang with libc++ (default)
-build:clang --config=clang-common
-build:clang --config=libc++
+common:clang --config=clang-common
+common:clang --config=libc++
 
 build:arm64-clang --config=clang
 
@@ -239,13 +241,13 @@ build:msan --test_env=MSAN_SYMBOLIZER_PATH
 build:msan --copt -O1
 build:msan --copt -fno-optimize-sibling-calls
 
-build:libc++ --action_env=CXXFLAGS=-stdlib=libc++
-build:libc++ --action_env=LDFLAGS=-stdlib=libc++
-build:libc++ --action_env=BAZEL_CXXOPTS=-stdlib=libc++
-build:libc++ --action_env=BAZEL_LINKLIBS=-l%:libc++.a:-l%:libc++abi.a
-build:libc++ --action_env=BAZEL_LINKOPTS=-lm:-pthread
-build:libc++ --define force_libcpp=enabled
-build:libc++ --@envoy//bazel:libc++=true
+common:libc++ --action_env=CXXFLAGS=-stdlib=libc++
+common:libc++ --action_env=LDFLAGS=-stdlib=libc++
+common:libc++ --action_env=BAZEL_CXXOPTS=-stdlib=libc++
+common:libc++ --action_env=BAZEL_LINKLIBS=-l%:libc++.a:-l%:libc++abi.a
+common:libc++ --action_env=BAZEL_LINKOPTS=-lm:-pthread
+common:libc++ --define force_libcpp=enabled
+common:libc++ --@envoy//bazel:libc++=true
 
 
 
@@ -402,7 +404,7 @@ build:compile-time-options --@envoy//source/extensions/filters/http/kill_request
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=docker.io/envoyproxy/envoy-build-ubuntu:014410eea358648b3493283e0a4cf6db263bb8e2@sha256:007d4c1814628375b5e6e7e030a2d9ff132f5a0deace98c39d32182c7a72899f
+build:docker-sandbox --experimental_docker_image=docker.io/envoyproxy/envoy-build-ubuntu:4ce0cb04f941fb89d475597a640176ae64070bb1@sha256:de54e91a8d27623ffbd3fb9bd1aba8241567e41c0fb82b167128e3629c2ede18
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker
@@ -575,7 +577,7 @@ common:bes-envoy-engflow --bes_timeout=3600s
 common:bes-envoy-engflow --bes_upload_mode=fully_async
 common:bes-envoy-engflow --nolegacy_important_outputs
 common:rbe-envoy-engflow --remote_executor=grpcs://mordenite.cluster.engflow.com
-common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:007d4c1814628375b5e6e7e030a2d9ff132f5a0deace98c39d32182c7a72899f
+common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:de54e91a8d27623ffbd3fb9bd1aba8241567e41c0fb82b167128e3629c2ede18
 common:rbe-envoy-engflow --jobs=200
 common:rbe-envoy-engflow --define=engflow_rbe=true
 

.bazelversion

@@ -1 +1 @@
-7.6.2
+7.7.1

bazel/repositories.bzl

@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "ad4ddf25a621373b08bef6a3623d365ede89bd9d"
-ENVOY_SHA = "feab0b191867ffc4876618adb552291912a800e0c6d7534a6e4cc953fd9184bf"
+ENVOY_COMMIT = "ee9df7b308de9f7e998619d1c86bc87b9058d0c9"
+ENVOY_SHA = "583d91fb5c87e1c92b1a75ad1e259fe9e1164515cd714e887eed01c6cb5ec953"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.8"  # June 18th, 2025
 HDR_HISTOGRAM_C_SHA = "bb95351a6a8b242dc9be1f28562761a84d4cf0a874ffc90a9b630770a6468e94"

ci/docker-compose.yml

@@ -1,6 +1,6 @@
 x-envoy-build-base: &envoy-build-base
   image: >-
-    ${ENVOY_BUILD_IMAGE:-docker.io/envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8@sha256:b10346fe2eee41733dbab0e02322c47a538bf3938d093a5daebad9699860b814}
+    ${ENVOY_BUILD_IMAGE:-docker.io/envoyproxy/envoy-build-ubuntu:4ce0cb04f941fb89d475597a640176ae64070bb1@sha256:de54e91a8d27623ffbd3fb9bd1aba8241567e41c0fb82b167128e3629c2ede18}
   cpus: ${ENVOY_DOCKER_CPUS:-0}
   user: root:root
   working_dir: ${ENVOY_DOCKER_SOURCE_DIR:-/source}

ci/run_envoy_docker.sh

@@ -4,13 +4,8 @@ set -e
 
 # TODO(phlax): Add a check that a usable version of docker compose is available
 
-
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-# Source build SHA information
-# shellcheck source=ci/envoy_build_sha.sh
-source "${SCRIPT_DIR}/envoy_build_sha.sh"
-
 # User/group IDs
 USER_UID="$(id -u)"
 USER_GID="$(id -g)"
@@ -45,10 +40,24 @@ export DOCKER_COMMAND="${*:-bash}"
 COMPOSE_SERVICE="envoy-build"
 if [[ -n "$MOUNT_GPG_HOME" ]]; then
     COMPOSE_SERVICE="envoy-build-gpg"
+    ENVOY_BUILD_VARIANT=devtools
 elif [[ -n "$ENVOY_DOCKER_IN_DOCKER" ]]; then
+    ENVOY_BUILD_VARIANT=docker
     COMPOSE_SERVICE="envoy-build-dind"
+elif [[ -n "$ENVOY_DOCKER_CI" ]]; then
+    ENVOY_BUILD_VARIANT=ci
+else
+    ENVOY_BUILD_VARIANT=devtools
 fi
 
+# Source build SHA information
+# shellcheck source=ci/envoy_build_sha.sh
+source "${SCRIPT_DIR}/envoy_build_sha.sh"
+
+ENVOY_BUILD_IMAGE="${ENVOY_BUILD_IMAGE:-${BUILD_CONTAINER}}"
+
+export ENVOY_BUILD_IMAGE
+
 exec docker compose \
     -f "${SCRIPT_DIR}/docker-compose.yml" \
     ${ENVOY_DOCKER_PLATFORM:+-p "$ENVOY_DOCKER_PLATFORM"} \

tools/code_format/config.yaml

@@ -229,6 +229,7 @@ paths:
     - source/extensions/transport_sockets/internal_upstream
     - source/extensions/transport_sockets/tls/cert_validator
     - source/extensions/transport_sockets/tcp_stats/config.cc
+    - source/common/tracing/custom_tag_impl.cc
 
   # Only one C++ file should instantiate grpc_init
   grpc_init:
@@ -335,6 +336,8 @@ paths:
   # Files in these paths can use std::regex
   std_regex:
     include:
+    - contrib/squash/filters/http/source/squash_filter.h
+    - contrib/squash/filters/http/source/squash_filter.cc
     - source/common/common/regex.h
     - source/common/common/regex.cc
     - source/common/common/utility.cc