1.39.4 (October 12, 2026)

Bug fixes

Changes expected to improve the state of the world and are unlikely to have negative effects

  • aws: Fixed a race where the route level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration.

  • composite: Fixed a race where the route level configuration of the composite filter could be destroyed on a worker thread when an RDS update replaced the route configuration. The match tree, and the delegated filter configurations its actions own, are now released on the main thread.

  • dynamic_modules: Fixed a bug where the envoy_dynamic_module_on_http_filter_per_route_config_destroy hook of a dynamic module could run on a worker thread, and the module could be unloaded there, when an RDS update replaced the route configuration.

  • filter_chain: Fixed a race where the route level configuration of the filter chain filter could be destroyed on a worker thread when an RDS update replaced the route configuration. The embedded filter chain, and the filter configuration providers it owns, are now released on the main thread.

  • local_ratelimit: Fixed a race where the share provider manager owned by a local rate limit route level configuration could be destroyed on a worker thread. The manager is an unpinned singleton that owns a cluster membership callback handle, so a route level configuration may own the last reference to it and release it when an RDS update replaces the route configuration. It is now handed to the main dispatcher alongside the rate limiter, which was already posted there.

  • sds: Fixed a race where a generic secret provider shared with worker threads could be destroyed on a worker thread.

  • stats: Fixed a bug introduced in 1.38.0 that exported Prometheus native histogram bucket indices one bucket too low, causing consumers to decode observations into lower value ranges and underreport quantiles.