wangfakang · wangfakang · Oct 11, 2021 · Sep 13, 2021 · Sep 13, 2021 · Sep 13, 2021
diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
@@ -244,8 +244,9 @@ stages:
       matrix:
         api:
           CI_TARGET: "bazel.api"
-        api_compat:
-          CI_TARGET: "bazel.api_compat"
+        # Disabled due to https://github.com/envoyproxy/envoy/pull/18218
+        # api_compat:
+        #  CI_TARGET: "bazel.api_compat"
         gcc:
           CI_TARGET: "bazel.gcc"
         clang_tidy:
@@ -381,6 +382,15 @@ stages:
         GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
       displayName: "Generate docs"
 
+    - script: |
+        ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
+      displayName: "Upload Docs to GCS"
+      env:
+        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+        GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
+      condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')
+
     - task: InstallSSHKey@0
       inputs:
         hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
@@ -393,6 +403,7 @@ stages:
       workingDirectory: $(Build.SourcesDirectory)
       env:
         AZP_BRANCH: $(Build.SourceBranch)
+        NETLIFY_TRIGGER_URL: $(NetlifyTriggerURL)
 
 - stage: verify
   dependsOn: ["docker"]
@@ -454,7 +465,7 @@ stages:
         testRunTitle: "macOS"
       condition: always()
 
-    - script: ./ci/flaky_test/run_process_xml.sh
+    - script: bazel run //ci/flaky_test:process_xml
       displayName: "Process Test Results"
       env:
         TEST_TMPDIR: $(Build.SourcesDirectory)
@@ -501,46 +512,23 @@ stages:
         artifactName: windows.release
       condition: always()
 
-  - job: clang_cl
-    timeoutInMinutes: 120
-    pool:
-      vmImage: "windows-latest"
-    steps:
-    - task: Cache@2
-      inputs:
-        key: '"windows.release" | ./WORKSPACE | **/*.bzl'
-        path: $(Build.StagingDirectory)/repository_cache
-      continueOnError: true
-    - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
-      displayName: "Run Windows clang-cl CI"
-      env:
-        CI_TARGET: "windows"
-        ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
-        SLACK_TOKEN: $(SLACK_TOKEN)
-        REPO_URI: $(Build.Repository.Uri)
-        BUILD_URI: $(Build.BuildUri)
-        ENVOY_RBE: "true"
-        BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-clang-cl --jobs=$(RbeJobs) --flaky_test_attempts=2"
-        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-    - task: PublishTestResults@2
-      inputs:
-        testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
-        testRunTitle: "clang-cl"
-        searchFolder: $(Build.StagingDirectory)/tmp
-      condition: always()
-    - task: PublishBuildArtifacts@1
-      inputs:
-        pathtoPublish: "$(Build.StagingDirectory)/envoy"
-        artifactName: windows.clang-cl
-      condition: always()
-
   - job: docker
+    strategy:
+      matrix:
+        windows2019:
+          imageName: 'windows-latest'
+          windowsBuildType: "windows"
+          windowsImageBase: "mcr.microsoft.com/windows/servercore"
+          windowsImageTag: "ltsc2019"
+        windows2022:
+          imageName: 'windows-2022'
+          windowsBuildType: "windows-ltsc2022"
+          windowsImageBase: "mcr.microsoft.com/windows/nanoserver"
+          windowsImageTag: "ltsc2022"
     dependsOn: ["release"]
     timeoutInMinutes: 120
     pool:
-      vmImage: "windows-latest"
+      vmImage: $(imageName)
     steps:
     - task: DownloadBuildArtifacts@0
       inputs:
@@ -561,6 +549,9 @@ stages:
         AZP_SHA1: $(Build.SourceVersion)
         DOCKERHUB_USERNAME: $(DockerUsername)
         DOCKERHUB_PASSWORD: $(DockerPassword)
+        WINDOWS_BUILD_TYPE: $(windowsBuildType)
+        WINDOWS_IMAGE_BASE: $(windowsImageBase)
+        WINDOWS_IMAGE_TAG: $(windowsImageTag)
     - task: PublishBuildArtifacts@1
       inputs:
         pathtoPublish: "$(Build.StagingDirectory)/build_images"

diff --git a/.bazelrc b/.bazelrc
@@ -167,17 +167,17 @@ build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
 build:rbe-toolchain --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 build:rbe-toolchain-clang --config=rbe-toolchain
-build:rbe-toolchain-clang --platforms=@rbe_ubuntu_clang//config:platform
-build:rbe-toolchain-clang --host_platform=@rbe_ubuntu_clang//config:platform
-build:rbe-toolchain-clang --crosstool_top=@rbe_ubuntu_clang//cc:toolchain
-build:rbe-toolchain-clang --extra_toolchains=@rbe_ubuntu_clang//config:cc-toolchain
+build:rbe-toolchain-clang --platforms=@envoy_build_tools//toolchains:rbe_linux_clang_platform
+build:rbe-toolchain-clang --host_platform=@envoy_build_tools//toolchains:rbe_linux_clang_platform
+build:rbe-toolchain-clang --crosstool_top=@envoy_build_tools//toolchains/configs/linux/clang/cc:toolchain
+build:rbe-toolchain-clang --extra_toolchains=@envoy_build_tools//toolchains/configs/linux/clang/config:cc-toolchain
 build:rbe-toolchain-clang --action_env=CC=clang --action_env=CXX=clang++ --action_env=PATH=/usr/sbin:/usr/bin:/sbin:/bin:/opt/llvm/bin
 
 build:rbe-toolchain-clang-libc++ --config=rbe-toolchain
-build:rbe-toolchain-clang-libc++ --platforms=@rbe_ubuntu_clang_libcxx//config:platform
-build:rbe-toolchain-clang-libc++ --host_platform=@rbe_ubuntu_clang_libcxx//config:platform
-build:rbe-toolchain-clang-libc++ --crosstool_top=@rbe_ubuntu_clang_libcxx//cc:toolchain
-build:rbe-toolchain-clang-libc++ --extra_toolchains=@rbe_ubuntu_clang_libcxx//config:cc-toolchain
+build:rbe-toolchain-clang-libc++ --platforms=@envoy_build_tools//toolchains:rbe_linux_clang_libcxx_platform
+build:rbe-toolchain-clang-libc++ --host_platform=@envoy_build_tools//toolchains:rbe_linux_clang_libcxx_platform
+build:rbe-toolchain-clang-libc++ --crosstool_top=@envoy_build_tools//toolchains/configs/linux/clang_libcxx/cc:toolchain
+build:rbe-toolchain-clang-libc++ --extra_toolchains=@envoy_build_tools//toolchains/configs/linux/clang_libcxx/config:cc-toolchain
 build:rbe-toolchain-clang-libc++ --action_env=CC=clang --action_env=CXX=clang++ --action_env=PATH=/usr/sbin:/usr/bin:/sbin:/bin:/opt/llvm/bin
 build:rbe-toolchain-clang-libc++ --action_env=CXXFLAGS=-stdlib=libc++
 build:rbe-toolchain-clang-libc++ --action_env=LDFLAGS=-stdlib=libc++
@@ -202,20 +202,20 @@ build:rbe-toolchain-tsan --linkopt=-Wl,-rpath,/opt/libcxx_tsan/lib
 build:rbe-toolchain-tsan --config=clang-tsan
 
 build:rbe-toolchain-gcc --config=rbe-toolchain
-build:rbe-toolchain-gcc --platforms=@rbe_ubuntu_gcc//config:platform
-build:rbe-toolchain-gcc --host_platform=@rbe_ubuntu_gcc//config:platform
-build:rbe-toolchain-gcc --crosstool_top=@rbe_ubuntu_gcc//cc:toolchain
-build:rbe-toolchain-gcc --extra_toolchains=@rbe_ubuntu_gcc//config:cc-toolchain
+build:rbe-toolchain-gcc --platforms=@envoy_build_tools//toolchains:rbe_linux_gcc_platform
+build:rbe-toolchain-gcc --host_platform=@envoy_build_tools//toolchains:rbe_linux_gcc_platform
+build:rbe-toolchain-gcc --crosstool_top=@envoy_build_tools//toolchains/configs/linux/gcc/cc:toolchain
+build:rbe-toolchain-gcc --extra_toolchains=@envoy_build_tools//toolchains/configs/linux/gcc/config:cc-toolchain
 
-build:rbe-toolchain-msvc-cl --host_platform=@rbe_windows_msvc_cl//config:platform
-build:rbe-toolchain-msvc-cl --platforms=@rbe_windows_msvc_cl//config:platform
-build:rbe-toolchain-msvc-cl --crosstool_top=@rbe_windows_msvc_cl//cc:toolchain
-build:rbe-toolchain-msvc-cl --extra_toolchains=@rbe_windows_msvc_cl//config:cc-toolchain
+build:rbe-toolchain-msvc-cl --host_platform=@envoy_build_tools//toolchains:rbe_windows_msvc_cl_platform
+build:rbe-toolchain-msvc-cl --platforms=@envoy_build_tools//toolchains:rbe_windows_msvc_cl_platform
+build:rbe-toolchain-msvc-cl --crosstool_top=@envoy_build_tools//toolchains/configs/windows/msvc-cl/cc:toolchain
+build:rbe-toolchain-msvc-cl --extra_toolchains=@envoy_build_tools//toolchains/configs/windows/msvc-cl/config:cc-toolchain
 
-build:rbe-toolchain-clang-cl --host_platform=@rbe_windows_clang_cl//config:platform
-build:rbe-toolchain-clang-cl --platforms=@rbe_windows_clang_cl//config:platform
-build:rbe-toolchain-clang-cl --crosstool_top=@rbe_windows_clang_cl//cc:toolchain
-build:rbe-toolchain-clang-cl --extra_toolchains=@rbe_windows_clang_cl//config:cc-toolchain
+build:rbe-toolchain-clang-cl --host_platform=@envoy_build_tools//toolchains:rbe_windows_clang_cl_platform
+build:rbe-toolchain-clang-cl --platforms=@envoy_build_tools//toolchains:rbe_windows_clang_cl_platform
+build:rbe-toolchain-clang-cl --crosstool_top=@envoy_build_tools//toolchains/configs/windows/clang-cl/cc:toolchain
+build:rbe-toolchain-clang-cl --extra_toolchains=@envoy_build_tools//toolchains/configs/windows/clang-cl/config:cc-toolchain
 
 build:remote --spawn_strategy=remote,sandboxed,local
 build:remote --strategy=Javac=remote,sandboxed,local
@@ -265,7 +265,7 @@ build:remote-clang-cl --config=rbe-toolchain-clang-cl
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:55d9e4719d2bd0accce8f829b44dab70cd42112a
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:81a93046060dbe5620d5b3aa92632090a9ee4da6
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:55d9e4719d2bd0accce8f829b44dab70cd42112a
+FROM gcr.io/envoy-ci/envoy-build:81a93046060dbe5620d5b3aa92632090a9ee4da6
 
 ARG USERNAME=vscode
 ARG USER_UID=501

diff --git a/.github/actions/pr_notifier/pr_notifier.py b/.github/actions/pr_notifier/pr_notifier.py
@@ -69,6 +69,10 @@ def is_waiting(labels):
     return False
 
 
+def is_contrib(labels):
+    return any(label.name == "contrib" for label in labels)
+
+
 # Return true if the PR has an API tag, false otherwise.
 def is_api(labels):
     for label in labels:
@@ -174,7 +178,7 @@ def track_prs():
             pr_info.assignees, maintainers_and_prs, message, MAINTAINERS, FIRST_PASS)
 
         # If there was no maintainer, track it as unassigned.
-        if not has_maintainer_assignee:
+        if not has_maintainer_assignee and not is_contrib(labels):
             maintainers_and_prs['unassigned'] = maintainers_and_prs['unassigned'] + message
 
     # Return the dict of {maintainers : PR notifications},

diff --git a/.github/actions/pr_notifier/requirements.txt b/.github/actions/pr_notifier/requirements.txt
@@ -63,9 +63,9 @@ chardet==4.0.0 \
     --hash=sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa \
     --hash=sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5
     # via requests
-deprecated==1.2.12 \
-    --hash=sha256:08452d69b6b5bc66e8330adde0a4f8642e969b9e1702904d137eeb29c8ffc771 \
-    --hash=sha256:6d2de2de7931a968874481ef30208fd4e08da39177d61d3d4ebdf4366e7dbca1
+deprecated==1.2.13 \
+    --hash=sha256:43ac5335da90c31c24ba028af536a91d41d53f9e6901ddb021bcc572ce44e38d \
+    --hash=sha256:64756e3e14c8c5eea9795d93c524551432a0be75629f8f29e67ab8caf076c76d
     # via pygithub
 idna==2.10 \
     --hash=sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6 \
@@ -78,7 +78,7 @@ pycparser==2.20 \
 pygithub==1.55 \
     --hash=sha256:1bbfff9372047ff3f21d5cd8e07720f3dbfdaf6462fcaed9d815f528f1ba7283 \
     --hash=sha256:2caf0054ea079b71e539741ae56c5a95e073b81fa472ce222e81667381b9601b
-    # via -r .github/actions/pr_notifier/requirements.txt
+    # via -r requirements.in
 pyjwt==2.1.0 \
     --hash=sha256:934d73fbba91b0483d3857d1aff50e96b2a892384ee2c17417ed3203f173fca1 \
     --hash=sha256:fba44e7898bbca160a2b2b501f492824fc8382485d3a6f11ba5d0c1937ce6130
@@ -111,10 +111,10 @@ six==1.16.0 \
     --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
     --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
     # via pynacl
-slack-sdk==3.10.1 \
-    --hash=sha256:f17b71a578e94204d9033bffded634475f4ca0a6274c6c7a4fd8a9cb0ac7cd8b \
-    --hash=sha256:2b4dde7728eb4ff5a581025d204578ccff25a5d8f0fe11ae175e3ce6e074434f
-    # via -r .github/actions/pr_notifier/requirements.txt
+slack_sdk==3.11.2 \
+    --hash=sha256:131bf605894525c2d66da064677eabc19f53f02ce0f82a3f2fa130d4ec3bc1b0 \
+    --hash=sha256:35245ec34c8549fbb5c43ccc17101afd725b3508bb784da46530b214f496bf93
+    # via -r requirements.in
 urllib3==1.26.6 \
     --hash=sha256:39fb8672126159acb139a7718dd10806104dec1e2f0f6c88aab05d17df10c8d4 \
     --hash=sha256:f57b4c16c62fa2760b7e3d97c35b255512fb6b59a259730f36ba32ce9f8e342f

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -36,21 +36,6 @@ updates:
   schedule:
     interval: "daily"
 
-- package-ecosystem: "pip"
-  directory: "/tools/deprecate_features"
-  schedule:
-    interval: "daily"
-
-- package-ecosystem: "pip"
-  directory: "/tools/deprecate_version"
-  schedule:
-    interval: "daily"
-
-- package-ecosystem: "pip"
-  directory: "/ci/flaky_test"
-  schedule:
-    interval: "daily"
-
 - package-ecosystem: "docker"
   directory: "/ci"
   schedule:

diff --git a/.github/workflows/check-deps.yml b/.github/workflows/check-deps.yml
@@ -0,0 +1,34 @@
+name: Check for latest_release of deps
+
+on :
+  schedule :
+    - cron : '0 8 * * *'
+
+  workflow_dispatch :
+
+jobs :
+  build :
+    runs-on : ubuntu-latest
+    steps :
+      - name : checkout
+        uses : actions/checkout/@v2
+        with :
+          ref : ${{ github.head_ref }}
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v2
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install virtualenv
+
+      - name: setting up virtualenv
+        run : |
+          export GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+          # --create_issues flag to create issue only in github action
+          # and not interfere with the CI
+          ./tools/dependency/release_dates.sh ./bazel/repository_locations.bzl --create_issues
+          ./tools/dependency/release_dates.sh ./api/bazel/repository_locations.bzl --create_issues
diff --git a/BUILD b/BUILD
@@ -8,6 +8,11 @@ exports_files([
     ".coveragerc",
 ])
 
+alias(
+    name = "envoy",
+    actual = "//source/exe:envoy",
+)
+
 # These two definitions exist to help reduce Envoy upstream core code depending on extensions.
 # To avoid visibility problems, see notes in source/extensions/extensions_build_config.bzl
 #

diff --git a/CODEOWNERS b/CODEOWNERS
@@ -101,15 +101,14 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/wasm_runtime/ @PiotrSikora @mathetake @lizan
 # common matcher
 /*/extensions/common/matcher @mattklein123 @yangminzhu
-# common crypto extension
-/*/extensions/common/crypto @lizan @bdecoste @asraa
 /*/extensions/common/proxy_protocol @alyssawilk @wez470
 /*/extensions/filters/http/grpc_http1_bridge @snowp @jose
 /*/extensions/filters/http/gzip @gsagula @dio
 /*/extensions/filters/http/fault @rshriram @alyssawilk
 /*/extensions/filters/common/fault @rshriram @alyssawilk
 /*/extensions/filters/http/grpc_json_transcoder @qiwzhang @lizan
 /*/extensions/filters/http/router @alyssawilk @mattklein123 @snowp
+/*/extensions/filters/common/rbac/matchers @conqerAtapple @ggreenway @alyssawilk
 /*/extensions/filters/http/grpc_web @fengli79 @lizan
 /*/extensions/filters/http/grpc_stats @kyessenov @lizan
 /*/extensions/filters/common/original_src @klarose @snowp
@@ -203,3 +202,5 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 /contrib/mysql_proxy/ @rshriram @venilnoronha
 /contrib/postgres_proxy/ @fabriziomello @cpakulski @dio
 /contrib/sxg/ @cpapazian @rgs1 @alyssawilk
+/contrib/sip_proxy/ @durd07 @nearbyfly @dorisd0102
+/contrib/cryptomb/ @rojkov @ipuustin
diff --git a/EXTENSION_POLICY.md b/EXTENSION_POLICY.md
@@ -92,8 +92,8 @@ The `status` is one of:
 The extension status may be adjusted by the extension [CODEOWNERS](./CODEOWNERS) and/or Envoy
 maintainers based on an assessment of the above criteria. Note that the status of the extension
 reflects the implementation status. It is orthogonal to the API stability, for example, an extension
-with configuration `envoy.foo.v3alpha.Bar` might have a `stable` implementation and
-`envoy.foo.v3.Baz` can have a `wip` implementation.
+API marked with `(xds.annotations.v3.file_status).work_in_progress` might have a `stable` implementation and
+and an extension with a stable config proto can have a `wip` implementation.
 
 The `security_posture` is one of:
 * `robust_to_untrusted_downstream`: The extension is hardened against untrusted downstream traffic. It

diff --git a/GOVERNANCE.md b/GOVERNANCE.md
@@ -98,7 +98,8 @@ or you can subscribe to the iCal feed [here](webcal://kubernetes.app.opsgenie.co
 * From the envoy [landing page](https://github.com/envoyproxy/envoy) use the branch drop-down to create a branch
   from the tagged release, e.g. "release/v1.6". It will be used for the
   [stable releases](RELEASES.md#stable-releases).
-* Monitor the AZP tag build to make sure that the final docker images get pushed along with
+* Tagging will kick off another run of [AZP postsubmit](https://dev.azure.com/cncf/envoy/_build?definitionId=11). Monitor that
+  tag build to make sure that the final docker images get pushed along with
   the final docs. The final documentation will end up in the
   [envoyproxy.github.io repository](https://github.com/envoyproxy/envoyproxy.github.io/tree/main/docs/envoy).
 * Update the website ([example PR](https://github.com/envoyproxy/envoyproxy.github.io/pull/148)) for the new release.
@@ -140,7 +141,7 @@ New Features
 Deprecated
 ----------
 ```
-* Run the deprecate_versions.py script (e.g. `sh tools/deprecate_version/deprecate_version.sh`)
+* Run the deprecate_versions.py script (e.g. `bazel run //tools/deprecate_version:deprecate_version`)
   to file tracking issues for runtime guarded code which can be removed.
 * Check source/common/runtime/runtime_features.cc and see if any runtime guards in
   disabled_runtime_features should be reassessed, and ping on the relevant issues.

diff --git a/PULL_REQUESTS.md b/PULL_REQUESTS.md
@@ -102,6 +102,19 @@ you may instead just tag the PR with the issue:
 
 \#Issue
 
+### <a name="commit"></a>Commit
+
+If this PR fixes or reverts a buggy commit, please add a line of the form:
+
+Fixes commit #PR
+
+or
+
+Fixes commit SHA
+
+This will allow automated tools to detect tainted commit ranges on the main branch when the PR is
+merged.
+
 ### <a name="deprecated"></a>Deprecated
 
 If this PR deprecates existing Envoy APIs or code, it should include an update to the deprecated

diff --git a/PULL_REQUEST_TEMPLATE.md b/PULL_REQUEST_TEMPLATE.md
@@ -21,5 +21,6 @@ Release Notes:
 Platform Specific Features:
 [Optional Runtime guard:]
 [Optional Fixes #Issue]
+[Optional Fixes commit #PR or SHA]
 [Optional Deprecated:]
 [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):]