envoyproxy/envoy v1.40.0
Comments on “envoyproxy/envoy v1.40.0”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Envoy v1.40.0 moves its build from WORKSPACE to bzlmod, so downstreams must migrate to MODULE.bazel and add Envoy's own registry. It also raises the hermetic Clang toolchain from 18 to 22 and removes AWS-LC as a selectable TLS library. The release declares HTTP/3 and QUIC stable (a claim not independently verified) and adds X25519MLKEM768 hybrid key exchange to the default TLS curves. mcp_router no longer forwards the authorization header to backends by default, and container-aware CPU detection now applies whenever --concurrency is unset.
Why it ranked
No. 5 of 137 with a score of 0.74. The panel rated it highest on new information (0.94) and practical relevance (0.85), lowest on audience breadth (0.57). Placed No. 5, No. 6 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Major release of a widely used infrastructure proxy with breaking changes, security fixes and new AI/MCP features; detailed changelog with actionable migration notes, though a changelog is lighter on substantiation.
- AI judgeJudge 3gpt-5.6-luna
- A major Envoy release with broad infrastructure impact, breaking build changes, stable HTTP/3/QUIC, post-quantum TLS defaults, security fixes, extensibility, observability, and substantial actionable detail for operators and downstream maintainers.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.74total under rubric v2.3
- Significance0.71
- Reader interest0.76
- Audience breadth0.57
- Practical relevance0.85
- Substantiated0.82
- Technical depth0.80
- New information0.94
- Counts against: Promotional0.04
- Counts against: Overclaim0.10
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.74 | 0.60 | 0.78 | 0.71 | 0.18 | +0.24 | +0.170 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.75 | 0.70 | 0.82 | 0.76 | 0.12 | +0.26 | +0.197 |
| Audience breadthHow many people who build technology does it concern? | 0.60 | 0.50 | 0.62 | 0.57 | 0.12 | +0.13 | +0.074 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.91 | 0.80 | 0.85 | 0.85 | 0.11 | +0.22 | +0.188 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.79 | 0.75 | 0.93 | 0.82 | 0.18 | +0.05 | +0.041 |
| Technical depthHow technically substantive is it? | 0.85 | 0.70 | 0.86 | 0.80 | 0.16 | +0.05 | +0.040 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.92 | 0.90 | 0.99 | 0.94 | 0.09 | +0.05 | +0.047 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.05 | 0.03 | 0.04 | 0.02 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.11 | 0.10 | 0.08 | 0.10 | 0.03 | −0.11 | −0.011 |
| Sum of contributions | +0.739 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.739 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-04/5/"><img src="https://rubric.hrih.si/badge/2026-11-04/5.svg" alt="Ranked #5 on Rubric, 4 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 7 matches source · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceVersion
Envoy v1.40.0 switched its build from WORKSPACE to bzlmod and removed the WORKSPACE file, publishing Envoy, the API and the docs as Bazel modules.
The cited source says the same thing.
The article says “Envoy has switched from WORKSPACE to bzlmod. The WORKSPACE file is removed; Envoy, the API and the docs are published as Bazel modules (envoy, envoy_api, envoy-docs”
The source says “Switched the Bazel build from WORKSPACE to bzlmod (MODULE.bazel). The WORKSPACE file has been removed”
Source cited by the article: envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Matches sourceVersion
Envoy's hermetic LLVM/Clang toolchain was bumped from version 18 to 22, and Clang/libc++ is now the default.
The cited source says the same thing.
The article says “the hermetic LLVM/Clang toolchain is bumped from 18 to 22”
The source says “Bumped the hermetic LLVM/Clang toolchain from 18 to 22”
Source cited by the article: envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Couldn’t checkVersion
HTTP/3 and QUIC are now stable in Envoy, including upstream HTTP/3 and all QUIC extensions.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “HTTP/3 and QUIC are now stable, including upstream HTTP/3 and all QUIC extensions”
The source says No passage could be compared.
Source cited by the article: envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Matches sourceVersion
Envoy added the X25519MLKEM768 hybrid post-quantum key exchange to the default ECDH curves for upstream and downstream TLS, including FIPS builds.
The cited source says the same thing.
The article says “X25519MLKEM768 hybrid key exchange is added to the default ECDH curves for upstream and downstream TLS, including FIPS builds”
The source says “Added X25519MLKEM768 (hybrid post-quantum key exchange) to the default ECDH curves for both upstream and downstream TLS connections (including FIPS builds”
Source cited by the article: envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Matches sourceVersion
The mcp_router no longer forwards downstream request headers, notably authorization, to backends by default.
The cited source says the same thing.
The article says “downstream request headers are no longer forwarded to backends by default — notably authorization”
The source says “unless a backend explicitly configures header_forwarding, no downstream-controlled headers are forwarded beyond those the router itself synthesizes – in particular, the client’s authorization header is no longer forwarded by default”
Source cited by the article: envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Matches sourceVersion
Container-aware CPU detection is now on by default whenever --concurrency is unset, whereas the 1.37 behaviour only applied with --cpuset-threads.
The cited source says the same thing.
The article says “the 1.37 behaviour was only active with --cpuset-threads; it now applies whenever --concurrency is unset”
The source says “It is now applied whenever --concurrency is not set, so worker threads are sized to the cgroup CPU limit in containerized deployments without requiring --cpuset-threads”
Source cited by the article: envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Matches sourceCausal conclusion
The Rust SDK HttpFilter hook change to &self closes a use-after-free on synchronous filter-chain teardown.
The cited source says the same thing.
The article says “This closes a use-after-free on synchronous filter-chain teardown”
The source says “This closes a use-after-free: a filter hook that triggered a synchronous teardown of the filter chain (for example recreate_stream) could return to a freed in-module filter”
Source cited by the article: envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Matches sourceVersion
Envoy v1.40.0 carries forward a fix for an out-of-bounds write in the Brotli decompressor, tracked as GHSA-3wvj-j6qm-62mr.
The cited source says the same thing.
The article says “Out-of-Bounds Write in Brotli Decompressor (GHSA-3wvj-j6qm-62mr”
The source says “This vulnerability was addressed in Envoy v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12”
Source cited by the article: github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 4 Nov 2026, 05:47 UTC. It played no part in the ranking.