@@ -17,7 +17,7 @@
 
 set -e
 # import VERSION from the google internal go/envoy-import-status
-VERSION=a0b3df32ba54c92a08d3636a9a36013cb920e471
+VERSION=ddf9f6788e3b5c103c496784f04890acbc6628e5
 DOWNLOAD_URL="https://github.com/envoyproxy/envoy/archive/${VERSION}.tar.gz"
 DOWNLOAD_BASE_DIR="envoy-${VERSION}"
 SOURCE_PROTO_BASE_DIR="${DOWNLOAD_BASE_DIR}/api"
 
@@ -42,7 +42,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // <config_overview_bootstrap>` for more detail.
 
 // Bootstrap :ref:`configuration overview <config_overview_bootstrap>`.
-// [#next-free-field: 43]
+// [#next-free-field: 44]
 message Bootstrap {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.bootstrap.v2.Bootstrap";
@@ -433,6 +433,17 @@ message Bootstrap {
   // Optional configuration for memory allocation manager.
   // Memory releasing is only supported for `tcmalloc allocator <https://github.com/google/tcmalloc>`_.
   MemoryAllocatorManager memory_allocator_manager = 41;
+
+  // When enabled, Envoy pins each worker thread to a distinct CPU from the process affinity mask,
+  // worker ``i`` to the ``i-th`` CPU in ascending order. This improves CPU cache and ``NUMA``
+  // locality for high concurrency deployments on bare metal. It is available on Linux only and is
+  // ignored on other platforms. Pinning requires a worker count no greater than the number of CPUs
+  // in the process affinity mask. When the worker count exceeds the available CPUs no worker is
+  // pinned. Pinning is applied once when the workers start, so a later change to the process
+  // affinity mask does not re-pin.
+  //
+  // Defaults to ``false``.
+  bool enable_worker_cpu_affinity = 43;
 }
 
 // Administration interface :ref:`operations documentation
@@ -469,6 +480,8 @@ message Admin {
   bool ignore_global_conn_limit = 6;
 
   // List of admin paths that are accessible. If not specified, all admin endpoints are accessible.
+  // Matchers are evaluated against the request path. For endpoints commonly queried with
+  // parameters (for example ``/stats?format=...``), prefer ``prefix`` matchers.
   //
   // When specified, only paths in this list will be accessible, all others will return ``HTTP 403 Forbidden``.
   //
@@ -477,7 +490,8 @@ message Admin {
   // .. code-block:: yaml
   //
   //   allow_paths:
-  //   - exact: /stats
+  //   - prefix: /stats
+  //   - prefix: /config_dump
   //   - exact: /ready
   //   - prefix: /healthcheck
   //
@@ -774,6 +788,7 @@ message CustomInlineHeader {
   InlineHeaderType inline_header_type = 2 [(validate.rules).enum = {defined_only: true}];
 }
 
+// [#next-free-field: 6]
 message MemoryAllocatorManager {
   // Configures tcmalloc to perform background release of free memory in amount of bytes per ``memory_release_interval`` interval.
   // If equals to ``0``, no memory release will occur. Defaults to ``0``.
@@ -783,4 +798,57 @@ message MemoryAllocatorManager {
   // interval Envoy will try to release ``bytes_to_release`` of free memory back to operating system for reuse.
   // Defaults to ``1000`` milliseconds.
   google.protobuf.Duration memory_release_interval = 2;
+
+  // Sets the soft memory limit for tcmalloc. When the total memory used by tcmalloc exceeds this
+  // limit, background release will be performed more aggressively to bring memory usage below the
+  // limit. If not set, no soft memory limit is applied.
+  //
+  // .. note::
+  //     This is currently only supported with tcmalloc and not with ``gperftools``.
+  //
+  google.protobuf.UInt64Value soft_memory_limit_bytes = 3;
+
+  // Sets the maximum per-CPU cache size in bytes for tcmalloc. Smaller values reduce per-CPU
+  // memory overhead at the cost of increased contention on the central free list. If not set,
+  // tcmalloc's default is used.
+  //
+  // .. note::
+  //     This is currently only supported with tcmalloc and not with ``gperftools``.
+  //
+  google.protobuf.UInt32Value max_per_cpu_cache_size_bytes = 4;
+
+  // The threshold of unfreed memory in bytes that triggers the heap shrinker to release memory
+  // back to the OS. When the difference between physical memory used and application-allocated
+  // memory exceeds this threshold, free memory is released.
+  //
+  // Defaults to ``104857600`` (100 MB).
+  uint64 max_unfreed_memory_bytes = 5;
+}
+
+// A placeholder proto so that users can explicitly configure the standard
+// Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
+// [#not-implemented-hide:]
+message ListenerManager {
+}
+
+// A placeholder proto so that users can explicitly configure the standard
+// Validation Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
+// [#not-implemented-hide:]
+message ValidationListenerManager {
+}
+
+// A placeholder proto so that users can explicitly configure the API
+// Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
+// [#not-implemented-hide:]
+message ApiListenerManager {
+  enum ThreadingModel {
+    // Handle HTTP requests on the main Envoy thread which also processes platform-raised events and runs xDS clients.
+    MAIN_THREAD_ONLY = 0;
+
+    // Handle HTTP requests on a standalone worker thread.
+    STANDALONE_WORKER_THREAD = 1;
+  }
+
+  // Default to MainThreadOnly.
+  ThreadingModel threading_model = 1;
 }
@@ -5,6 +5,7 @@ package envoy.config.cluster.v3;
 import "envoy/config/core/v3/base.proto";
 import "envoy/type/v3/percent.proto";
 
+import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/status.proto";
@@ -43,6 +44,25 @@ message CircuitBreakers {
       // This parameter is optional. Defaults to 20%.
       type.v3.Percent budget_percent = 1;
 
+      // An optional duration in which requests will be considered when calculating
+      // the budget for retries. This parameter alters the way in which the retry budget
+      // is calculated, overriding the default behavior when specified.
+      //
+      // By default, when budget_interval is set to 0ms, only presently active
+      // and pending requests are considered when calculating the retry budget.
+      //
+      // When a non-zero budget_interval is specified, new requests are
+      // considered for the duration of budget_interval when calculating
+      // the retry budget.
+      //
+      // For example, if 10 requests start at the same time, with a specified budget_interval
+      // of 100ms, all 10 requests will be considered when calculating the retry
+      // budget for the next 100ms, regardless of if they have completed.
+      // All 10 requests will expire after the budget_interval duration.
+      //
+      // This parameter is optional. Defaults to 0ms.
+      google.protobuf.Duration budget_interval = 3;
+
       // Specifies the minimum retry concurrency allowed for the retry budget. The limit on the
       // number of active retries may never go below this number.
       //
 
@@ -13,6 +13,8 @@ import "envoy/config/core/v3/health_check.proto";
 import "envoy/config/core/v3/protocol.proto";
 import "envoy/config/core/v3/resolver.proto";
 import "envoy/config/endpoint/v3/endpoint.proto";
+import "envoy/config/metrics/v3/stats.proto";
+import "envoy/type/matcher/v3/metadata.proto";
 import "envoy/type/metadata/v3/metadata.proto";
 import "envoy/type/v3/percent.proto";
 
@@ -46,7 +48,7 @@ message ClusterCollection {
 }
 
 // Configuration for a single upstream cluster.
-// [#next-free-field: 60]
+// [#next-free-field: 63]
 message Cluster {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Cluster";
 
@@ -753,6 +755,18 @@ message Cluster {
     // harm latency more than the preconnecting helps.
     google.protobuf.DoubleValue predictive_preconnect_ratio = 2
         [(validate.rules).double = {lte: 3.0 gte: 1.0}];
+
+    // Restricts anticipatory connections to hosts whose endpoint metadata matches this matcher.
+    // Non-matching hosts are never preconnected, and instead get connections only on demand, as they
+    // serve real requests. If unset, all healthy hosts are eligible.
+    type.matcher.v3.MetadataMatcher preconnect_enabled_metadata = 3;
+  }
+
+  // Queueing policies for the cluster.
+  message QueuingPolicies {
+    // Queue policy for cluster pending requests. If unset, Envoy uses the FIFO queue policy.
+    // [#extension-category: envoy.queue_policy]
+    core.v3.TypedExtensionConfig pending_rq_policy = 1;
   }
 
   reserved 12, 15, 7, 11, 35;
@@ -866,6 +880,12 @@ message Cluster {
   //   :ref:`Router Filter Header <config_http_filters_router_x-envoy-upstream-alt-stat-name>`.
   string alt_stat_name = 28 [(udpa.annotations.field_migrate).rename = "observability_name"];
 
+  // Optional stats matcher that can be used to configure which stats are instantiated for this
+  // cluster. If configured, this overrides the bootstrap :ref:`stats_config
+  // <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.stats_config>` stats matcher configuration
+  // for this cluster.
+  metrics.v3.StatsMatcher stats_matcher = 61;
+
   oneof cluster_discovery_type {
     // The :ref:`service discovery type <arch_overview_service_discovery_types>`
     // to use for resolving the cluster.
@@ -887,6 +907,12 @@ message Cluster {
   google.protobuf.UInt32Value per_connection_buffer_limit_bytes = 5
       [(udpa.annotations.security).configure_for_untrusted_upstream = true];
 
+  // Optional timeout that controls how long an upstream connection is allowed to stay above the
+  // configured buffer high watermark before it is closed. If this timeout is not specified, or
+  // explicitly set to 0, connections will not be closed due to buffer high watermark usage.
+  google.protobuf.Duration per_connection_buffer_high_watermark_timeout = 60
+      [(validate.rules).duration = {gte {}}];
+
   // The :ref:`load balancer type <arch_overview_load_balancing_types>` to use
   // when picking a host in the cluster.
   LbPolicy lb_policy = 6 [(validate.rules).enum = {defined_only: true}];
@@ -1297,6 +1323,9 @@ message Cluster {
   // If ``connection_pool_per_downstream_connection`` is true, the cluster will use a separate
   // connection pool for every downstream connection
   bool connection_pool_per_downstream_connection = 51;
+
+  // Queueing policies for the cluster (e.g. the queue policy for cluster pending requests).
+  QueuingPolicies queuing_policies = 62;
 }
 
 // Extensible load balancing policy configuration.
@@ -1343,14 +1372,18 @@ message UpstreamConnectionOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.UpstreamConnectionOptions";
 
+  // [#comment: Keep this list of address types in sync with api/config/core/v3/address.proto.]
   enum FirstAddressFamilyVersion {
-    // respect the native ranking of destination ip addresses returned from dns
-    // resolution
+    // Use the first address family encountered in the address list.
     DEFAULT = 0;
 
     V4 = 1;
 
     V6 = 2;
+
+    PIPE = 3;
+
+    INTERNAL = 4;
   }
 
   message HappyEyeballsConfig {
 
@@ -21,14 +21,16 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // See the :ref:`architecture overview <arch_overview_outlier_detection>` for
 // more information on outlier detection.
-// [#next-free-field: 26]
+// [#next-free-field: 27]
 message OutlierDetection {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.cluster.OutlierDetection";
 
   // The number of consecutive server-side error responses (for HTTP traffic,
   // 5xx responses; for TCP traffic, connection failures; for Redis, failure to
   // respond PONG; etc.) before a consecutive 5xx ejection occurs. Defaults to 5.
+  //
+  // If set to 0 explicitly, consecutive 5xx ejection will be disabled.
   google.protobuf.UInt32Value consecutive_5xx = 1;
 
   // The time interval between ejection analysis sweeps. This can result in
@@ -80,6 +82,8 @@ message OutlierDetection {
 
   // The number of consecutive gateway failures (502, 503, 504 status codes)
   // before a consecutive gateway failure ejection occurs. Defaults to 5.
+  //
+  // If set to 0 explicitly, consecutive gateway failure ejection will be disabled.
   google.protobuf.UInt32Value consecutive_gateway_failure = 10;
 
   // The % chance that a host will be actually ejected when an outlier status
@@ -101,6 +105,8 @@ message OutlierDetection {
   // occurs. Defaults to 5. Parameter takes effect only when
   // :ref:`split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is set to true.
+  //
+  // If set to 0 explicitly, consecutive locally originated failure ejection will be disabled.
   google.protobuf.UInt32Value consecutive_local_origin_failure = 13;
 
   // The % chance that a host will be actually ejected when an outlier status
@@ -177,4 +183,13 @@ message OutlierDetection {
   // If enabled, at least one host is ejected regardless of the value of :ref:`max_ejection_percent<envoy_v3_api_field_config.cluster.v3.OutlierDetection.max_ejection_percent>`.
   // Defaults to false.
   google.protobuf.BoolValue always_eject_one_host = 25;
+
+  // If set to true, outlier detection will mark hosts as degraded when they return
+  // the ``x-envoy-degraded`` header.
+  // Degraded hosts are deprioritized in load balancing but are not ejected from the cluster.
+  // The degraded state is cleared using the same backoff algorithm as ejection, with the degradation
+  // period calculated as ``base_ejection_time`` multiplied by the number of times the host
+  // has been marked as degraded, capped by ``max_ejection_time``.
+  // Defaults to false.
+  google.protobuf.BoolValue detect_degraded_hosts = 26;
 }
@@ -103,7 +103,7 @@ message SocketAddress {
   // network namespace.
   //
   // .. note::
-  //    Setting this parameter requires Envoy to run with the ``CAP_NET_ADMIN`` capability.
+  //    Setting this parameter requires Envoy to run with the ``CAP_SYS_ADMIN`` capability.
   //
   // .. attention::
   //     Network namespaces are only configurable on Linux. Otherwise, this field has no effect.
@@ -188,6 +188,7 @@ message BindConfig {
 message Address {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.Address";
 
+  // [#comment: Keep this list of address types in sync with UpstreamConnectionOptions.FirstAddressFamilyVersion in api/envoy/config/cluster/v3/cluster.proto.]
   oneof address {
     option (validate.required) = true;
 
 
@@ -269,6 +269,15 @@ message RuntimeUInt32 {
   string runtime_key = 3;
 }
 
+// Runtime derived uint64 with a default when not specified.
+message RuntimeUInt64 {
+  // Default value if runtime value is not available.
+  uint64 default_value = 2;
+
+  // Runtime key to get value for comparison. This value is used if defined.
+  string runtime_key = 3;
+}
+
 // Runtime derived percentage with a default when not specified.
 message RuntimePercent {
   // Default value if runtime value is not available.
@@ -493,6 +502,14 @@ message HeaderMap {
 message WatchedDirectory {
   // Directory path to watch.
   string path = 1 [(validate.rules).string = {min_len: 1}];
+
+  // If set to true, the watcher will also subscribe to file modification events
+  // (``IN_MODIFY`` on Linux) in addition to move events (``IN_MOVED_TO``). This allows
+  // in-place file writes to trigger reload callbacks. Use this when the writing process
+  // cannot use atomic rename (e.g. certain secret managers that write certificate files
+  // directly). By default, only move/rename events are watched, which is the safe choice
+  // for atomic updates (e.g. Kubernetes ConfigMap symlink swaps).
+  bool watch_modify = 2;
 }
 
 // Data source consisting of a file, an inline value, or an environment variable.
 
@@ -3,6 +3,7 @@ syntax = "proto3";
 package envoy.config.core.v3;
 
 import "envoy/config/core/v3/base.proto";
+import "envoy/config/core/v3/extension.proto";
 import "envoy/config/core/v3/http_uri.proto";
 
 import "udpa/annotations/status.proto";
@@ -29,7 +30,13 @@ message HttpService {
   HttpUri http_uri = 1;
 
   // Specifies a list of HTTP headers that should be added to each request
-  // handled by this virtual host.
+  // handled by this virtual host. Substitution formatters are supported.
   repeated HeaderValueOption request_headers_to_add = 2
       [(validate.rules).repeated = {max_items: 1000}];
+
+  // Specifies a collection of Formatter plugins that can be used in substitution formatters
+  // in ``request_headers_to_add``.
+  // See the formatters extensions documentation for details.
+  // [#extension-category: envoy.formatter]
+  repeated TypedExtensionConfig formatters = 3;
 }