Update Envoy dependency to b6e7e12ed (Sep 04, 2026)

.bazelrc

@@ -36,9 +36,26 @@ startup --host_jvm_args="-DBAZEL_TRACK_SOURCE_DIRECTORIES=1"
 # global
 #############################################################################
 
-common --noenable_bzlmod
-common --enable_workspace
-# common --@envoy//bazel:enable_bzlmod=True
+# common --enable_bzlmod
+common --remote_executor=
+build --remote_executor=
+build --modify_execution_info=.*=+no-remote-exec
+common --registry=https://bcr.bazel.build/
+common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/main
+common --copt=-Iinclude
+common --cxxopt=-Iinclude
+# quiche
+build --@quiche//:zlib=@envoy//bazel:zlib
+build --@quiche//:ssl_lib=@envoy//bazel:ssl
+build --@quiche//:quic_base_impl_lib=@envoy//source/common/quic/platform:quic_base_impl_lib
+build --@quiche//:quiche_export_impl_lib=@envoy//source/common/quic/platform:quiche_export_impl_lib
+build --@quiche//:quiche_flags_impl_lib=@envoy//source/common/quic/platform:quiche_flags_impl_lib
+build --@quiche//:quiche_logging_impl_lib=@envoy//source/common/quic/platform:quiche_logging_impl_lib
+build --@quiche//:quiche_lower_case_string_impl_lib=@envoy//source/common/quic/platform:quiche_lower_case_string_impl_lib
+build --@quiche//:quiche_platform_iovec_impl_lib=@envoy//source/common/quic/platform:quiche_platform_iovec_impl_lib
+build --@quiche//:quiche_stack_trace_impl_lib=@envoy//source/common/quic/platform:quiche_stack_trace_impl_lib
+build --@quiche//:quiche_time_utils_impl_lib=@envoy//source/common/quic/platform:quiche_time_utils_impl_lib
+
 common --noincompatible_disallow_empty_glob
 common --noincompatible_disallow_ctx_resolve_tools
 common --legacy_external_runfiles
@@ -48,7 +65,7 @@ run --color=yes
 build --color=yes
 
 common --registry=https://bcr.bazel.build/
-common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/49547ce72253df5c694b153604ed2bd0c1dd8891
+common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/b6e15c00b1c0493cd194b1b248c562bd8bc46648
 # common --registry=file:///bazel-registry
 # this can be useful for dev
 # common --lockfile_mode=off
@@ -100,7 +117,7 @@ common --@rules_python//python/config_settings:bootstrap_impl=script
 build --incompatible_default_to_explicit_init_py
 
 # Protobuf
-common --@protobuf//bazel/flags:prefer_prebuilt_protoc=true
+common --@protobuf//bazel/toolchains:prefer_prebuilt_protoc
 common --incompatible_enable_proto_toolchain_resolution
 
 # We already have absl in the build, define absl=1 to tell googletest to use absl for backtrace.
@@ -147,16 +164,19 @@ common --per_file_copt=bazel-out/.*/bin/external/protobuf.*/protoc@--THIS_CC_TOO
 # proxy-wasm-cpp-host
 common --@proxy-wasm-cpp-host//bazel:crypto_lib=@envoy//bazel:crypto
 
+# libsxg
+build --@libsxg//:crypto_lib=@envoy//bazel:crypto
+
 # quiche
 build --@quiche//:zlib=@envoy//bazel:zlib
+build --@quiche//:ssl_lib=@envoy//bazel:ssl
 
 # quiche — non-test platform impls
 build --@quiche//:quic_base_impl_lib=@envoy//source/common/quic/platform:quic_base_impl_lib
 build --@quiche//:quiche_export_impl_lib=@envoy//source/common/quic/platform:quiche_export_impl_lib
 build --@quiche//:quiche_flags_impl_lib=@envoy//source/common/quic/platform:quiche_flags_impl_lib
 build --@quiche//:quiche_logging_impl_lib=@envoy//source/common/quic/platform:quiche_logging_impl_lib
 build --@quiche//:quiche_lower_case_string_impl_lib=@envoy//source/common/quic/platform:quiche_lower_case_string_impl_lib
-build --@quiche//:quiche_mem_slice_impl_lib=@envoy//source/common/quic/platform:quiche_mem_slice_impl_lib
 build --@quiche//:quiche_platform_iovec_impl_lib=@envoy//source/common/quic/platform:quiche_platform_iovec_impl_lib
 build --@quiche//:quiche_stack_trace_impl_lib=@envoy//source/common/quic/platform:quiche_stack_trace_impl_lib
 build --@quiche//:quiche_time_utils_impl_lib=@envoy//source/common/quic/platform:quiche_time_utils_impl_lib
@@ -197,14 +217,15 @@ build:macos --@toolchains_llvm//toolchain/config:libunwind=false
 
 # Common flags for Clang (shared between all clang variants)
 common:clang-common --linkopt=-fuse-ld=lld
+common:clang-common --linkopt=-Wl,--no-keep-memory
 common:clang-common --cxxopt=-Wno-nullability-completeness
+common:clang-common --cxxopt=-Wno-error=nullability-completeness
 common:clang-common --@toolchains_llvm//toolchain/config:compiler-rt=false
 common:clang-common --@toolchains_llvm//toolchain/config:libunwind=false
 
 # Clang with libc++ (default)
 common:clang --config=clang-common
 common:clang --config=libc++
-common:clang --host_platform=@clang_platform
 common:clang --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 # Clang installed to non-standard location (ie not /opt/llvm/)
@@ -225,6 +246,7 @@ build:gcc --copt=-fno-debug-types-section
 # And in all cases the reports appear to be clear false positives.
 build:gcc --copt=-Wno-error=restrict
 build:gcc --copt=-Wno-error=uninitialized
+build:gcc --copt=-Wno-error=stringop-overread
 build:gcc --cxxopt=-Wno-missing-requires
 build:gcc --cxxopt=-Wno-dangling-reference
 build:gcc --cxxopt=-Wno-nonnull-compare
@@ -317,14 +339,24 @@ common:fips-common --@envoy//bazel:fips=True
 common:boringssl-fips --config=fips-common
 common:boringssl-fips --@envoy//bazel:ssl=@boringssl-fips//:ssl
 common:boringssl-fips --@envoy//bazel:crypto=@boringssl-fips//:crypto
+common:boringssl-fips --@quiche//:ssl_lib=@boringssl-fips//:ssl
 
 # OpenSSL
 common:openssl --@envoy//bazel:openssl=True
 common:openssl --@envoy//bazel:ssl=@envoy//compat/openssl:ssl
 common:openssl --@envoy//bazel:crypto=@envoy//compat/openssl:crypto
+# Route QUICHE's SSL to the OpenSSL compat layer too. QUICHE is still linked in
+# OpenSSL builds via non-QUIC features (e.g. HTTP datagram / CONNECT-UDP capsule
+# support), and must use the same SSL implementation as the rest of the binary
+# to avoid linking BoringSSL and OpenSSL together (symbol/ABI collisions).
+common:openssl --@quiche//:ssl_lib=@envoy//compat/openssl:ssl
 common:openssl --copt=-DENVOY_SSL_OPENSSL
 common:openssl --host_copt=-DENVOY_SSL_OPENSSL
 common:openssl --@envoy//bazel:http3=False
+# Exclude QUIC/HTTP3 sources from the quiche module overlay when HTTP/3 is
+# disabled. This keeps QUIC code that depends on BoringSSL-only primitives
+# (e.g. SIPHASH_24) out of the OpenSSL build.
+common:openssl --define=quiche_disable_http3=true
 common:openssl --test_tag_filters=-nofips,-quiche
 common:openssl --build_tag_filters=-nofips
 
@@ -508,9 +540,6 @@ build:remote --strategy=Closure=remote,sandboxed,local
 build:remote --strategy=Genrule=remote,sandboxed,local
 build:remote --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 # This flag may be more generally useful - it sets foreign_cc builds -jauto.
-# It is only set here because if it were the default it risks OOMing on local builds.
-build:remote --@envoy//bazel/foreign_cc:parallel_builds
-build:remote --@openssl//:parallel_builds
 
 ## RBE (Engflow Envoy)
 

.github/workflows/_ci.yml

@@ -33,20 +33,28 @@ jobs:
       contents: read
       packages: read
     runs-on: ubuntu-22.04
+    timeout-minutes: 180
     steps:
     - uses: actions/checkout@v7.0.1
     - name: Set gcc
       run: |
         if [[ "${{ inputs.task }}" == *"gcc"* ]]; then
           echo "build --config=gcc" >> repo.bazelrc
+          echo "build:gcc --copt=-g0" >> repo.bazelrc
+          echo "common --jobs=4" >> repo.bazelrc
         else
           echo "common --config=clang" >> repo.bazelrc
+          echo "build --copt=-g1" >> repo.bazelrc
+          echo "common --jobs=2" >> repo.bazelrc
         fi
-    - name: Configure repo Bazel settings
-      run: |
-        echo "common --jobs=200" >> repo.bazelrc
-        echo "test --local_test_jobs=4" >> repo.bazelrc
+        echo "common --local_resources=memory=3000" >> repo.bazelrc
+        echo "test --local_test_jobs=1" >> repo.bazelrc
+        if [[ "${{ inputs.task }}" != *"gcc"* ]]; then
+          echo "build --linkopt=-Wl,--threads=1" >> repo.bazelrc
+        fi
+        echo "build --strip=always" >> repo.bazelrc
         echo "build --config=bes" >> repo.bazelrc
+        echo "build --experimental_reuse_sandbox_directories=true" >> repo.bazelrc
     - name: Bind mount spare disk for build artifacts
       uses: envoyproxy/toolshed/actions/bind-mounts@actions-v0.4.25
       with:
@@ -58,6 +66,7 @@ jobs:
             target: /tmp/bazel-shared
             chown: runner:runner
     - name: Run CI script
+      timeout-minutes: 180
       run: |
         ./ci/run_envoy_docker.sh './ci/do_ci.sh ${{ inputs.task }}'
       env:

MODULE.bazel

@@ -0,0 +1,123 @@
+# Envoy commit to use
+ENVOY_COMMIT = "b6e7e12ed27300f21f4436ec6e6c119c128edb0f"
+
+module(
+    name = "nighthawk",
+    version = "1.0.0-dev",
+)
+
+####################################################################################
+# deps: Module
+####################################################################################
+
+bazel_dep(name = "envoy", version = "1.40.0-dev")
+bazel_dep(name = "envoy_api", version = "1.40.0-dev")
+bazel_dep(name = "rules_python", version = "2.2.0")
+bazel_dep(name = "protobuf", version = "35.1.bcr.envoy")
+bazel_dep(name = "proxy-wasm-cpp-host", version = "0.0.0-260704-f2db56a.envoy")
+bazel_dep(name = "googleurl", version = "0.0.0-221103-dd4080f.envoy")
+bazel_dep(name = "rules_rust", version = "0.69.0.envoy")
+bazel_dep(name = "grpc", version = "1.83.0.envoy")
+bazel_dep(name = "librdkafka", version = "2.6.0.envoy")
+bazel_dep(name = "quiche", version = "0.0.0-260831-5c9cc6b.envoy")
+bazel_dep(name = "toolchains_llvm", version = "1.9.0.envoy")
+bazel_dep(name = "envoy_toolshed", version = "0.4.13.envoy")
+bazel_dep(name = "zlib-ng", version = "2.3.2.envoy")
+bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
+bazel_dep(name = "googleapis", version = "0.0.0-20251003-2193a2bf")
+bazel_dep(name = "protoc-gen-validate", version = "1.3.3.envoy")
+bazel_dep(name = "re2", version = "2025-08-12.bcr.1")
+bazel_dep(name = "libsxg", version = "0.0.0-210708-beaa393.envoy")
+bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "abseil-cpp", version = "20260107.1", repo_name = "com_google_absl")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
+
+http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "dep_hdrhistogram_c",
+    build_file_content = """
+cc_library(
+    name = "hdrhistogram_c",
+    srcs = [
+        "src/hdr_encoding.c",
+        "src/hdr_histogram.c",
+        "src/hdr_histogram_log.c",
+        "src/hdr_interval_recorder.c",
+        "src/hdr_malloc.h",
+        "src/hdr_thread.c",
+        "src/hdr_time.c",
+        "src/hdr_writer_reader_phaser.c",
+    ],
+    hdrs = [
+        "src/hdr_atomic.h",
+        "src/hdr_encoding.h",
+        "src/hdr_endian.h",
+        "include/hdr/hdr_histogram.h",
+        "include/hdr/hdr_histogram_log.h",
+        "include/hdr/hdr_interval_recorder.h",
+        "include/hdr/hdr_writer_reader_phaser.h",
+        "src/hdr_tests.h",
+        "include/hdr/hdr_thread.h",
+        "include/hdr/hdr_time.h",
+    ],
+    includes = ["include"],
+    copts = [
+        "-std=gnu99",
+        "-Wno-implicit-function-declaration",
+        "-Wno-error",
+    ],
+    deps = ["@zlib-ng"],
+    visibility = ["//visibility:public"],
+)
+""",
+    sha256 = "bb95351a6a8b242dc9be1f28562761a84d4cf0a874ffc90a9b630770a6468e94",
+    strip_prefix = "HdrHistogram_c-0.11.8",
+    url = "https://github.com/HdrHistogram/HdrHistogram_c/archive/0.11.8.tar.gz",
+)
+
+####################################################################################
+# deps: Overrides - Use constant for commit
+####################################################################################
+
+git_override(
+    module_name = "envoy",
+    commit = ENVOY_COMMIT,
+    patch_strip = 1,
+    patches = ["//patches:envoy_quiche_mem_slice.patch"],
+    remote = "https://github.com/envoyproxy/envoy.git",
+)
+
+git_override(
+    module_name = "envoy_api",
+    commit = ENVOY_COMMIT,
+    remote = "https://github.com/envoyproxy/envoy.git",
+    strip_prefix = "api",
+)
+
+####################################################################################
+# setup: Languages - Python
+####################################################################################
+
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(
+    is_default = True,
+    python_version = "3.12",
+)
+use_repo(python, "python_3_12", python = "python_versions")
+
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip.parse(
+    hub_name = "nh_pip3",
+    python_version = "3.12",
+    requirements_lock = "//tools/base:requirements.txt",
+)
+use_repo(pip, "nh_pip3")
+
+llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
+use_repo(llvm, "llvm_toolchain")
+
+llvm_toolchain_alias_ext = use_extension("@envoy_toolshed//compile:extensions.bzl", "llvm_toolchain_alias_extension")
+use_repo(llvm_toolchain_alias_ext, "llvm_toolchain_llvm")
+
+