Automator: update envoy@ in istio/proxy@master (#6470)

* Automator: update envoy@ in istio/proxy@master

* fix build

---------

Co-authored-by: istio-testing <istio-testing-bot@google.com>

.bazelversion

@@ -1 +1 @@
-7.6.0
+7.6.1

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools-proxy:master-9a50b34135f1aa16b04d56dcb89c5b91101a28aa",
+  "image": "gcr.io/istio-testing/build-tools-proxy:master-39b2905e5cc51d50b21c97ae5ee3d1b26d518353",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

WORKSPACE

@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2025-07-05
-ENVOY_SHA = "61d4f64a770fcc5bd613a16ff15854167c752f25"
+# Commit date: 2025-08-06
+ENVOY_SHA = "3e3cfd2cd96bd27259bc4eb12113cf7d89e421f8"
 
-ENVOY_SHA256 = "b127ca8d736ba2d72de6fca59f23b4f44bca3508498613265b3b6367fb51e6fa"
+ENVOY_SHA256 = "1976a7a281d4670a2f72a970f505f8579b2d68b46833ab061f6f15997f8f6e91"
 
 ENVOY_ORG = "envoyproxy"
 

bazel/extension_config/extensions_build_config.bzl

@@ -400,7 +400,7 @@ ENVOY_EXTENSIONS = {
     # Custom matchers
     #
 
-    "envoy.matching.custom_matchers.trie_matcher":     "//source/extensions/common/matcher:trie_matcher_lib",
+    "envoy.matching.custom_matchers.ip_range_matcher":     "//source/extensions/common/matcher:ip_range_matcher_lib",
 
     #
     # Header Validators

common/.commonfiles.sha

@@ -1 +1 @@
-73315b91eb0bb247476b5b03911ec7f2cb6b5176
+58eba46f166eeaa0c97c8ffb739b28815961a6cf

common/config/.golangci.yml

@@ -184,6 +184,10 @@ linters:
       - linters:
           - staticcheck
         text: 'S1007'
+      # TODO: remove once we have updated package names
+      - linters:
+        - revive
+        text: "var-naming: avoid meaningless package names"
     paths:
       - .*\.pb\.go
       - .*\.gen\.go

common/scripts/setup_env.sh

@@ -75,7 +75,7 @@ fi
 TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
 PROJECT_ID=${PROJECT_ID:-istio-testing}
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=master-9a50b34135f1aa16b04d56dcb89c5b91101a28aa
+  IMAGE_VERSION=master-39b2905e5cc51d50b21c97ae5ee3d1b26d518353
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools

envoy.bazelrc

@@ -539,6 +539,7 @@ common:common-envoy-engflow --google_default_credentials=false
 common:common-envoy-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
 common:common-envoy-engflow --grpc_keepalive_time=60s
 common:common-envoy-engflow --grpc_keepalive_timeout=30s
+common:common-envoy-engflow --remote_cache_compression
 
 common:cache-envoy-engflow --remote_cache=grpcs://mordenite.cluster.engflow.com
 common:cache-envoy-engflow --remote_timeout=3600s

go.mod

@@ -4,7 +4,7 @@ go 1.24
 
 require (
 	github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f
-	github.com/envoyproxy/go-control-plane v0.13.5-0.20250705082150-f8f2cd45490a
+	github.com/envoyproxy/go-control-plane v0.13.5-0.20250730150711-3e244ce327ba
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4
 	github.com/golang/protobuf v1.5.4
 	github.com/google/go-cmp v0.7.0

go.sum

@@ -5,8 +5,8 @@ github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f/go.mod h1:W+zGtBO5Y1Ig
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.13.5-0.20250705082150-f8f2cd45490a h1:k0yPxzI8NWvWx9TKX3ysJabi1XEkrKmutgfIe27WX7M=
-github.com/envoyproxy/go-control-plane v0.13.5-0.20250705082150-f8f2cd45490a/go.mod h1:whHrEUXbTAzBJlzd3Gz4us5zEFP1gL6o3LbfA+a/xbg=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20250730150711-3e244ce327ba h1:gccvV7rWHBnJh7RHTCOGvb5ZjqRNc4eK4yTMpyue37I=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20250730150711-3e244ce327ba/go.mod h1:whHrEUXbTAzBJlzd3Gz4us5zEFP1gL6o3LbfA+a/xbg=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
 github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=

source/extensions/filters/http/istio_stats/istio_stats.cc

@@ -420,7 +420,10 @@ struct MetricOverrides : public Logger::Loggable<Logger::Id::filter> {
             absl::StrCat("failed to register built-in functions: ", register_status.message()));
       }
     }
-    parsed_exprs_.push_back(parse_status.value().expr());
+    const auto& parsed_expr = parse_status.value();
+    const cel::expr::Expr& cel_expr = parsed_expr.expr();
+
+    parsed_exprs_.push_back(cel_expr);
     compiled_exprs_.push_back(std::make_pair(
         Extensions::Filters::Common::Expr::createExpression(*expr_builder_, parsed_exprs_.back()),
         int_expr));
@@ -429,7 +432,7 @@ struct MetricOverrides : public Logger::Loggable<Logger::Id::filter> {
     return {id};
   }
   Filters::Common::Expr::BuilderPtr expr_builder_;
-  std::vector<google::api::expr::v1alpha1::Expr> parsed_exprs_;
+  std::vector<cel::expr::Expr> parsed_exprs_;
   std::vector<std::pair<Filters::Common::Expr::ExpressionPtr, bool>> compiled_exprs_;
   absl::flat_hash_map<std::string, uint32_t> expression_ids_;
 };