repo: Release v1.33.1

[CVE-2025-30157](GHSA-cf3q-gqg7-3fm9): Fix a bug where local replies were incorrectly sent to the ext_proc server

**Summary of changes**:

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.33.1
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.33.1/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.33.1/version_history/v1.33/v1.33.1
**Full changelog**:
    v1.33.0...v1.33.1

Signed-off-by: Ryan Northey <[email protected]>

Author: phlax

VERSION.txt

@@ -1 +1 @@
-1.33.1-dev
+1.33.1

changelogs/1.30.10.yaml

@@ -0,0 +1,26 @@
+date: March 20, 2025
+
+minor_behavior_changes:
+- area: rds
+  change: |
+    When a new RDS provider config is pushed via xDS and the only difference is change to
+    :ref:`initial_fetch_timeout <envoy_v3_api_field_config.core.v3.ConfigSource.initial_fetch_timeout>`,
+    the already existing provider will be reused. Envoy will not ask RDS server for routes
+    config because existing provider already has up to date routes config.
+    This behavioral change can be enabled by setting runtime guard
+    ``envoy.reloadable_features.normalize_rds_provider_config`` to true.
+
+bug_fixes:
+- area: lrs
+  change: |
+    Fixes errors stat being incremented and warning log spamming for LoadStatsReporting graceful stream close.
+- area: ext_proc
+  change: |
+    Fixes a bug where local replies were incorrectly sent to the ext_proc server for external processing.
+    This change can be temporarily reverted by setting runtime guard ``envoy_reloadable_features_skip_ext_proc_on_local_reply``
+    to ``false``.
+- area: router
+  change: |
+    Fixes an Envoy crash issue when a local reply is sent.
+    This change can be temporarily reverted by setting runtime guard
+    ``envoy_reloadable_features_router_filter_resetall_on_local_reply`` to ``false``.

changelogs/1.31.6.yaml

@@ -0,0 +1,26 @@
+date: March 20, 2025
+
+minor_behavior_changes:
+- area: rds
+  change: |
+    When a new RDS provider config is pushed via xDS and the only difference is change to
+    :ref:`initial_fetch_timeout <envoy_v3_api_field_config.core.v3.ConfigSource.initial_fetch_timeout>`,
+    the already existing provider will be reused. Envoy will not ask RDS server for routes
+    config because existing provider already has up to date routes config.
+    This behavioral change can be enabled by setting runtime guard
+    ``envoy.reloadable_features.normalize_rds_provider_config`` to true.
+
+bug_fixes:
+- area: lrs
+  change: |
+    Fixes errors stat being incremented and warning log spamming for LoadStatsReporting graceful stream close.
+- area: ext_proc
+  change: |
+    Fixes a bug where local replies were incorrectly sent to the ext_proc server for external processing.
+    This change can be temporarily reverted by setting runtime guard ``envoy_reloadable_features_skip_ext_proc_on_local_reply``
+    to ``false``.
+- area: router
+  change: |
+    Fixes an Envoy crash issue when a local reply is sent.
+    This change can be temporarily reverted by setting runtime guard
+    ``envoy_reloadable_features_router_filter_resetall_on_local_reply`` to ``false``.

changelogs/1.32.4.yaml

@@ -0,0 +1,26 @@
+date: March 20, 2025
+
+minor_behavior_changes:
+- area: rds
+  change: |
+    When a new RDS provider config is pushed via xDS and the only difference is change to
+    :ref:`initial_fetch_timeout <envoy_v3_api_field_config.core.v3.ConfigSource.initial_fetch_timeout>`,
+    the already existing provider will be reused. Envoy will not ask RDS server for routes
+    config because existing provider already has up to date routes config.
+    This behavioral change can be enabled by setting runtime guard
+    ``envoy.reloadable_features.normalize_rds_provider_config`` to true.
+
+bug_fixes:
+- area: lrs
+  change: |
+    Fixes errors stat being incremented and warning log spamming for LoadStatsReporting graceful stream close.
+- area: ext_proc
+  change: |
+    Fixes a bug where local replies were incorrectly sent to the ext_proc server for external processing.
+    This change can be temporarily reverted by setting runtime guard ``envoy_reloadable_features_skip_ext_proc_on_local_reply``
+    to ``false``.
+- area: router
+  change: |
+    Fixes an Envoy crash issue when a local reply is sent.
+    This change can be temporarily reverted by setting runtime guard
+    ``envoy_reloadable_features_router_filter_resetall_on_local_reply`` to ``false``.

changelogs/current.yaml

@@ -1,13 +1,6 @@
-date: Pending
-
-behavior_changes:
-# *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
-
-minor_behavior_changes:
-# *Changes that may cause incompatibilities for some users, but should not for most*
+date: March 21, 2025
 
 bug_fixes:
-# *Changes expected to improve the state of the world and are unlikely to have negative effects*
 - area: connection pool
   change: |
     Fixed a bug in :ref:`preconnecting <envoy_v3_api_msg_config.cluster.v3.Cluster.PreconnectPolicy>` where established connection
@@ -24,10 +17,3 @@ bug_fixes:
     Fixes an Envoy crash issue when a local reply is sent.
     This change can be temporarily reverted by setting runtime guard
     ``envoy_reloadable_features_router_filter_resetall_on_local_reply`` to ``false``.
-
-removed_config_or_runtime:
-# *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
-
-new_features:
-
-deprecated:

docs/inventories/v1.30/objects.inv

@@ -23,6 +23,7 @@
 "1.27": 1.27.7
 "1.28": 1.28.7
 "1.29": 1.29.12
-"1.30": 1.30.9
-"1.31": 1.31.5
-"1.32": 1.32.3
+"1.30": 1.30.10
+"1.31": 1.31.6
+"1.32": 1.32.4
+"1.33": 1.33.0