[1.30] bazel: bump 1309 (#389)

* bazel: bump 1309 * changelog fix
solo-io · Dec 19, 2024 · 39daa25 · 39daa25
1 parent b368ab2
commit 39daa25
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 2 deletions.
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
@@ -2,8 +2,8 @@ REPOSITORY_LOCATIONS = dict(
     # can't have more than one comment between envoy line and commit line in 
     # order to accommodate `check_extensions_build_config.sh`
     envoy = dict(
-        # envoy v1.30.6++ b8ac22252ecf39de8d8eb45f442a42883f97e86f
-        commit = "b8ac22252ecf39de8d8eb45f442a42883f97e86f",
+        # envoy v1.30.9
+        commit = "e409e0a2cedef46b5229f1a603125dccf779e540",
         remote = "https://github.com/envoyproxy/envoy",
     ),
     inja = dict(

diff --git a/changelog/v1.30.9-patch1/bump-envoy.yaml b/changelog/v1.30.9-patch1/bump-envoy.yaml
@@ -0,0 +1,11 @@
+changelog:
+- type: DEPENDENCY_BUMP
+  issueLink:  https://github.com/solo-io/envoy-gloo-ee/issues/843
+  dependencyOwner: envoyproxy
+  dependencyRepo: envoy
+  dependencyTag: v1.30.9
+  resolvesIssue: false
+  description: >-
+    Update Envoy to latest 1.30.9 release for cves.
+    CVE-2024-53269: Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting.
+    CVE-2024-53270: HTTP/1: sending overload crashes when the request is reset beforehand
diff --git a/.../v1.30.6-patch6/bump-upload-artifact.yaml → .../v1.30.9-patch1/bump-upload-artifact.yaml b/.../v1.30.6-patch6/bump-upload-artifact.yaml → .../v1.30.9-patch1/bump-upload-artifact.yaml