1.20.2.yaml

date: February 22, 2022

behavior_changes:

minor_behavior_changes:

bug_fixes:
- area: data plane
  change: |
    fix crash when internal redirect selects a route configured with direct response or redirect actions.
- area: jwt_authn
  change: |
    fixed the crash when a CONNECT request is sent to JWT filter configured with regex match on the Host header.
- area: tcp_proxy
  change: |
    fix a crash that occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established.
- area: upstream
  change: |
    fix stack overflow when a cluster with large number of idle connections is removed.

removed_config_or_runtime:

new_features:
# TODO(phlax): These links/refs have been set to v1.21 due to v1.20.2 not building/publishing - update once v1.20.3 lands
- area: tls
  change: |
    added support for :ref:`match_typed_subject_alt_names <v1.21:envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>` for subject alternative names to enforce specifying the subject alternative name type for the matcher to prevent matching against an unintended type in the certificate.

deprecated:
# TODO(phlax): These links/refs have been set to v1.21 due to v1.20.2 not building/publishing - update once v1.20.3 lands
- area: tls
  change: |
    :ref:`match_subject_alt_names <v1.21:envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_subject_alt_names>` has been deprecated in favor of the :ref:`match_typed_subject_alt_names <v1.21:envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>`.