Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT by OS-kiranmalsetty · Pull Request #1206 · envoyproxy/ratelimit

OS-kiranmalsetty · 2026-08-06T15:22:25Z

Summary

A unit: month rate limit is currently computed as a fixed 60*60*24*30 second window counted from the Unix epoch, so it neither aligns with real calendar months nor accounts for months of different lengths.
Adds a USE_CALENDAR_MONTH_RATE_LIMIT setting (default "false") that, when enabled, buckets MONTH cache keys by UTC calendar month, sets their TTL/expiration to the actual time remaining until month end, and reports that same value as the reset duration (DurationUntilReset / reset header).
Defaults to false so existing MONTH limits keep their current (legacy, fixed 30-day rolling window) reset behavior unless explicitly opted in — this avoids silently changing when existing users' MONTH limits reset.
src/utils/time.go: new expiryUntilMonthEnd, MonthExpirationSeconds, MonthStartUnix helpers.
src/utils/utilities.go: ExpirationSeconds and CalculateReset take a useCalendarMonth flag and dispatch to the calendar-aware helpers for MONTH only when it's true.
src/limiter/cache_key.go, src/limiter/base_limiter.go, src/redis/fixed_cache_impl.go, src/memcached/cache_impl.go, src/redis/cache_impl.go, src/service/ratelimit.go: thread the flag from settings.Settings.UseCalendarMonthRateLimit down to cache-key bucketing, TTL, and reset reporting.
test/config/basic_config.yaml: adds a key8 MONTH descriptor for integration test coverage.
README documents the new USE_CALENDAR_MONTH_RATE_LIMIT setting.

Test plan

go build ./...
go vet ./...
gofumpt/goimports clean on all changed files
go test ./test/... (all packages pass)
New unit tests cover: calendar-month cache-key bucketing (Jan 1/Jan 31 same bucket, Feb 1 different), leap-year correctness, and that the flag being false reproduces the legacy fixed-divider behavior exactly (including not consulting the time source at all for MONTH, matching pre-existing behavior)

…TE_LIMIT A unit: month rate limit is computed as a fixed 60*60*24*30 second window counted from the Unix epoch, so it neither aligns with real calendar months nor accounts for months of different lengths (RDGRS-1999). Add a USE_CALENDAR_MONTH_RATE_LIMIT setting (default false) that, when enabled, buckets MONTH cache keys by UTC calendar month, sets their TTL/expiration to the actual time remaining until month end, and reports that same value as the reset duration. Defaults to false so existing MONTH limits keep their current reset behavior unless explicitly opted in. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com>

Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com>

OS-kiranmalsetty · 2026-08-07T15:04:50Z

@collin-lee, can you please review when you have a chance?

OS-kiranmalsetty · 2026-08-13T14:01:25Z

@envoyproxy/ratelimit-maintainers, can you please review?

OS-kiranmalsetty · 2026-08-18T15:38:09Z

@collin-lee, can you please review when you have a chance?

collin-lee · 2026-08-18T16:16:24Z

@OS-kiranmalsetty see https://github.com/memcached/memcached/blob/master/doc/protocol.txt and https://github.com/memcached/memcached/wiki/Programming#expiration

In first article look for "Expiration times" section

In the second article:

"Any time higher than 30 days is interpreted as a unix timestamp date. If you want to expire an object on january 1st of next year, this is how you do that."

in src/memcached/cache_impl.go:170-173 see how Expiration: int32(expirationSeconds) is set

31*86400 = 2,678,400 which is greater than 2,592,000 so for (Jan, Mar, May, Jul, Aug, Oct, Dec) where there are 31 days Memcache will treat this as 1970-02-01 and it will be treated as already expired / immediately evicted.

Memcached treats any expiration value greater than 30 days as an absolute Unix timestamp rather than a relative TTL. Calendar-aligned MONTH limits can produce a relative expiration up to 2,678,400 seconds (31-day months), which was passed straight into memcache.Item.Expiration and caused those keys to be treated as already expired. Convert the expiration to an absolute Unix timestamp whenever it would exceed memcached's 30-day relative-TTL threshold. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com>

Signed-off-by: Kiran Malsetty <93211513+OS-kiranmalsetty@users.noreply.github.com>

OS-kiranmalsetty · 2026-08-18T18:09:54Z

@OS-kiranmalsetty see https://github.com/memcached/memcached/blob/master/doc/protocol.txt and https://github.com/memcached/memcached/wiki/Programming#expiration

In first article look for "Expiration times" section

In the second article:

"Any time higher than 30 days is interpreted as a unix timestamp date. If you want to expire an object on january 1st of next year, this is how you do that."

in src/memcached/cache_impl.go:170-173 see how Expiration: int32(expirationSeconds) is set

31*86400 = 2,678,400 which is greater than 2,592,000 so for (Jan, Mar, May, Jul, Aug, Oct, Dec) where there are 31 days Memcache will treat this as 1970-02-01 and it will be treated as already expired / immediately evicted.

@collin-lee, updated the PR and also added additional test cases.

collin-lee · 2026-08-18T19:37:30Z

@OS-kiranmalsetty - some build failures with the tests in cache_impl_test.go and base_limiter_test.go

memcached.NewRateLimitCacheImpl and limiter.NewBaseRateLimit expecting another boolean argument

The merge of main (is_negative_hits, []uint64 -> []utils.HitsAddend) into calendar-month-rate-limit (added useCalendarMonth bool param) left several test call sites using the pre-merge signatures for NewBaseRateLimit, NewRateLimitCacheImpl, and NewFixedRateLimitCacheImpl. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com>

Negative hits (is_negative_hits descriptors) are now gated by the ENABLE_NEGATIVE_HITS environment variable, default off. While the flag is off, any request containing a negative-hit descriptor is rejected as a whole with the gRPC UNIMPLEMENTED code before the cache call, so a negative-hit descriptor is never silently processed as a positive hit. Rejections are counted in the new ratelimit.service.negative_hits_rejected statistic. The combination negative hits + memcached + local cache refuses to boot: an over-limit counter poisons the local cache and there is no invalidation path for memcached. All other combinations boot as before, including memcached negative hits without local cache. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT (envoyproxy#1206) * Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT A unit: month rate limit is computed as a fixed 60*60*24*30 second window counted from the Unix epoch, so it neither aligns with real calendar months nor accounts for months of different lengths (RDGRS-1999). Add a USE_CALENDAR_MONTH_RATE_LIMIT setting (default false) that, when enabled, buckets MONTH cache keys by UTC calendar month, sets their TTL/expiration to the actual time remaining until month end, and reports that same value as the reset duration. Defaults to false so existing MONTH limits keep their current reset behavior unless explicitly opted in. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * Trigger CI Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * docs: regenerate README TOC for new calendar-month section Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * memcached: fix expiration >30 days being misread as a Unix timestamp Memcached treats any expiration value greater than 30 days as an absolute Unix timestamp rather than a relative TTL. Calendar-aligned MONTH limits can produce a relative expiration up to 2,678,400 seconds (31-day months), which was passed straight into memcache.Item.Expiration and caused those keys to be treated as already expired. Convert the expiration to an absolute Unix timestamp whenever it would exceed memcached's 30-day relative-TTL threshold. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * test: fix call sites left out of sync by main merge The merge of main (is_negative_hits, []uint64 -> []utils.HitsAddend) into calendar-month-rate-limit (added useCalendarMonth bool param) left several test call sites using the pre-merge signatures for NewBaseRateLimit, NewRateLimitCacheImpl, and NewFixedRateLimitCacheImpl. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Signed-off-by: Kiran Malsetty <93211513+OS-kiranmalsetty@users.noreply.github.com> feat: implement is_negative_hits in rate limit descriptor (envoyproxy#1140) * feat: implement is_negative_hits in rate limit descriptor Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * added details to readme Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> redis: log recovery when a connection succeeds after a prior dial error (envoyproxy#1205) Operators currently only see repeated dial-error logs and have no explicit signal when the pool starts succeeding again. Track whether the last dial attempt failed and log once when a subsequent connection succeeds. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Update Go references and vulnerable dependencies (envoyproxy#1204) * Update Go references to 1.26.5 Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> * Update vulnerable Go dependencies Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> --------- Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> deps: bump x/net, x/text, x/sys to fix remaining CVEs (envoyproxy#1196) Follow-up to envoyproxy#1154 (which bumped x/net to 0.55.0). Bumps the golang.org/x dependencies to their latest patched releases to remediate the CVEs still outstanding after envoyproxy#1154: - golang.org/x/net v0.55.0 -> v0.57.0 (CVE-2026-46600, fixed in 0.56.0) - golang.org/x/text v0.37.0 -> v0.40.0 (CVE-2026-56852, fixed in 0.39.0) - golang.org/x/sys v0.45.0 -> v0.47.0 (already patched; kept current) No source changes required; `go build ./...` passes. Signed-off-by: Yitong Feng <yife@microsoft.com> redis: optionally close pooled connections on READONLY error replies (envoyproxy#1191) * redis: optionally close pooled connections on READONLY error replies After a master->replica failover in deployments that fail over by repointing an address at the new master (a Kubernetes Service, DNS, or a proxy - e.g. Redis without Sentinel, Dragonfly, KeyDB), the demoted master keeps already-established connections open. radix only discards pooled connections on IO errors, so those stale connections are reused forever and every write on them keeps failing with READONLY until the process restarts, turning a routine failover into a permanent rate limiting outage. Add an opt-in setting, REDIS_CLOSE_CONNECTION_ON_READONLY_ERROR (default false), that wraps pooled connections so a READONLY error reply strips radix's resp.ErrConnUsable wrapper. The pool then discards the connection and re-dials through the configured address, reaching the current master. The failing command still returns its error to the caller; only the connection handling changes. Applies to the main and per-second clients across single, cluster, and sentinel modes. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * fix README.md Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> build(deps): bump docker/setup-qemu-action from 3.2.0 to 4.2.0 (envoyproxy#1179) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.2.0 to 4.2.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@49b3bc8...96fe6ef) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump actions/checkout from 4.1.7 to 7.0.0 (envoyproxy#1173) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.7 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@692973e...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (envoyproxy#1172) Bumps alpine from `4b7ce07` to `28bd5fe`. --- updated-dependencies: - dependency-name: alpine dependency-version: 28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> add metadata to rate limit descriptors pb to yaml (envoyproxy#1175) Signed-off-by: achoo30 <achoo30@bloomberg.net> update proto to support metadata (envoyproxy#1174) Signed-off-by: achoo30 <achoo30@bloomberg.net> Update to golang-1.26.4 and update golang.org/x/net to 0.55.0 (envoyproxy#1154) Signed-off-by: Fred Dafunk <bloomenergyguy@gmail.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: bound cluster pipeline parallelism (envoyproxy#1149) * redis: bound cluster pipeline parallelism Signed-off-by: dthuynh <dthuynh@axon.com> * Refactor to address comment: use gRPC request context in PipeDo, cap the parallelism to RedisPoolSize Signed-off-by: dthuynh <dthuynh@axon.com> --------- Signed-off-by: dthuynh <dthuynh@axon.com> Co-authored-by: dthuynh <dthuynh@axon.com> fix: correct typos in memcache error messages and variable name (envoyproxy#1150) Signed-off-by: Immanuel Tikhonov <pchpr.00@list.ru> Signed-off-by: immanuwell <pchpr.00@list.ru> Update to golang 1.26.3 (envoyproxy#1152) Co-authored-by: collin-lee <collin.lee@salesforce.com> Add quota mode to rate limit descriptor proto (envoyproxy#1148) feat: add retry in init phase instead of panic directly (envoyproxy#1144) * feat: add retry in init phase instead of panic directly Signed-off-by: zirain <zirain2009@gmail.com> * respect signal handling for graceful shutdown Signed-off-by: zirain <zirain2009@gmail.com> * fix test Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Add integration test for quota based service selection. (envoyproxy#1114) Signed-off-by: Yan Avlasov <yavlasov@google.com> build: pin golang:1.26.2 to multi-arch index digest (envoyproxy#1131) PR envoyproxy#1124 updated the golang base image from 1.26.1 to 1.26.2, but the new digest sha256:7095ad02810845fa35d1fb090b8e57dd20dce4ca36b29b42951 802350d2ec90e is a single-arch (linux/amd64) image manifest rather than a multi-arch index. The previous 1.26.1 digest sha256:e2ddb153f7 86ee6210bf8c40f7f35490b3ff7d38be70d1a0d358ba64225f6428 is an OCI image index covering linux/amd64, arm64/v8, arm/v7, 386, ppc64le, riscv64, s390x and windows/amd64. When buildx is asked to produce a non-amd64 variant of the published envoyproxy/ratelimit image, the FROM line resolves to the amd64 base on every platform, so the resulting binary is amd64 regardless of the target. The multi-arch publish then stamps that amd64 binary into the arm64 layer of the released index, producing an image that fails on arm64 nodes with: exec /bin/ratelimit: exec format error Swap to the corresponding multi-arch index digest sha256:b54cbf583d39 0341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716, which contains the existing 7095ad02... amd64 manifest as one of its children plus the arm64/v8 and other platform variants. The amd64 image is unchanged; arm64 builds now produce arm64 binaries. Signed-off-by: Harrison Harris <harrison.harris@xapien.com> Co-authored-by: Harrison Harris <harrison.harris@xapien.com> Update third party libraries flagged for vulnerability scans (envoyproxy#1124) Signed-off-by: collin-lee <collin.lee@salesforce.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: add zipkin b3 header propagation (envoyproxy#1110) Fix Prometheus response time units (envoyproxy#1104) Dockerfile: add ENTRYPOINT (envoyproxy#1095) Make the docker image easier to consume. Signed-off-by: Ian Kerins <git@isk.haus> Send user defined metadata to the client (envoyproxy#1112) Signed-off-by: Yan Avlasov <yavlasov@google.com> build(deps): bump google.golang.org/grpc from v1.74.2 to v1.80.0 (envoyproxy#1111) Signed-off by: João Pereira <joao@jpereira.me> Upgrades the gRPC dependency from v1.74.2 to v1.80.0, along with its transitive dependency updates (golang.org/x/net, google.golang.org/protobuf, genproto, go-control-plane, etc.). Signed-off-by: João Pereira <joao.pereira@zwift.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Fix quota result when all limits were exceeded (envoyproxy#1059) * Fix quota result when all limits were exceeded Signed-off-by: yavlasov <yavlasov@google.com> * Address comments Signed-off-by: yavlasov <yavlasov@google.com> * Fix comment Signed-off-by: yavlasov <yavlasov@google.com> * fix comment Signed-off-by: yavlasov <yavlasov@google.com> * Remove log into a file Signed-off-by: yavlasov <yavlasov@google.com> --------- Signed-off-by: yavlasov <yavlasov@google.com> Update golang references to 1.26.1 (envoyproxy#1091) Add integration test for token based quota (envoyproxy#1092) Signed-off-by: yavlasov <yavlasov@google.com> Add quota integration test (envoyproxy#1090) Add debug logging for quota values (envoyproxy#1089) Wait for sevices to be up before running tests (envoyproxy#1088) update otel and fix failing tests (envoyproxy#1078) Signed-off-by: Ashish Tiwari <ashishjaitiwari15112000@gmail.com> feat: Support wildcard in non-trailing positions for rate limit descriptor values (envoyproxy#1085) Signed-off-by: Nam Dang <xuannam230201@gmail.com> build(deps): bump golang from 1.25.6 to 1.26.1 (envoyproxy#1079) Bumps golang from 1.25.6 to 1.26.1. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> bump go version 1.25.6 (envoyproxy#1047) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> implement quota mode for soft rate limit check (envoyproxy#1045) * implement quota mode for rate limit check Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix format Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix format Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix tests Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix quota mode flag Signed-off-by: Dan Sun <dsun20@bloomberg.net> --------- Signed-off-by: Dan Sun <dsun20@bloomberg.net> upgrade radix from v3 to v4 for improved pipeline handling (envoyproxy#1041) * feat: upgrade radix from v3 to v4 Upgrade radix Redis client from v3.8.1 to v4.1.4. Main changes: - Import paths: radix/v3 -> radix/v4 - Pool/Cluster/Sentinel use Config.New() instead of New() - All client operations require context.Context parameter - Dialer setup changed from functional options to struct config - Pipelining uses radix.NewPipeline() and Append() - Write buffering via Dialer.WriteFlushInterval Breaking from v3: - Pool on-empty behavior (WAIT/CREATE/ERROR) not available - REDIS_PIPELINE_LIMIT setting deprecated (no effect in v4) Tested with existing test suite - all tests passing. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * docs: update pipeline settings for radix v4 Update documentation to reflect radix v4's pipeline behavior: - REDIS_PIPELINE_WINDOW now sets WriteFlushInterval (auto-flush timing) - REDIS_PIPELINE_LIMIT deprecated - no effect in v4 - Add REDIS_USE_EXPLICIT_PIPELINE for manual pipeline control - Required for Redis Cluster: PIPELINE_WINDOW must be non-zero Update terminology from "implicit pipelining" to "write buffering" to better match radix v4's actual behavior. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: update tests for radix v4 - Add useExplicitPipeline parameter to test client creation - Update error assertions for v4's error message format (v4 prefixes with "response returned from Conn:") - Handle different connection errors (EOF, connection reset, broken pipe) - Update radix.FlatCmd usage for v4 API Signed-off-by: seonghyun <seonghyunoh@gmail.com> * chore: add deprecation warning for REDIS_PIPELINE_LIMIT Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: fix Redis cluster test config for radix v4 Replace deprecated RedisPipelineLimit with RedisPipelineWindow in configRedisCluster function. Radix v4 requires WriteFlushInterval (RedisPipelineWindow) for cluster mode buffering instead of the deprecated pipeline limit setting. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * style: fix gofmt struct field alignment in settings.go Signed-off-by: seonghyun <seonghyunoh@gmail.com> * fix: fail fast on unsupported REDIS_POOL_ON_EMPTY_BEHAVIOR settings Radix v4 does not support CREATE or ERROR behaviors for REDIS_POOL_ON_EMPTY_BEHAVIOR. Previously, these settings were logged as errors but the application would continue with blocking behavior, which could cause unexpected issues in production. Changes: - Panic at startup when CREATE or ERROR is detected - Prevent silent behavior changes that could cause blocking - Update tests to verify panic behavior - Improve migration documentation in comments This ensures users are immediately notified of incompatible configuration rather than experiencing unexpected blocking in production. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * fix: change REDIS_POOL_ON_EMPTY_BEHAVIOR default to WAIT The default value 'CREATE' is not supported in radix v4 and causes integration tests to panic at startup. Changed default to 'WAIT' which matches radix v4's actual pool behavior (always blocks when empty). This fixes integration test failures where tests without explicit REDIS_POOL_ON_EMPTY_BEHAVIOR settings would panic during initialization with: "REDIS_POOL_ON_EMPTY_BEHAVIOR=CREATE is not supported in radix v4" Also updated documentation to clarify that CREATE/ERROR are not supported and marked RedisPoolOnEmptyWaitDuration as deprecated. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: fix cluster connection timeout and context bug - Fix WaitForTcpPort to use timeoutCtx instead of ctx This ensures the timeout parameter is actually respected when dialing TCP connections. - Increase gRPC server startup timeout from 1s to 10s Radix v4 cluster connection initialization takes longer, especially when establishing connections to multiple cluster nodes. This prevents "connection refused" errors in integration tests. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: extract dialer creation logic to reduce duplication Consolidates Redis and Sentinel dialer setup into a reusable createDialer helper function, eliminating ~30 lines of duplicated code. Improves logging by including connection target details (e.g., "sentinel(master,host1,host2)") instead of generic "sentinel" string. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: remove deprecated REDIS_POOL_ON_EMPTY_WAIT_DURATION settings Remove the deprecated poolOnEmptyWaitDuration parameter and related configuration settings as they have no effect in radix v4. The pool always blocks until a connection is available when using WAIT behavior. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: auto-select pipeline mode based on Redis type Remove REDIS_USE_EXPLICIT_PIPELINE configuration option and automatically determine pipeline mode based on Redis deployment type: - Cluster mode: uses grouped pipeline (groups same-key commands) - INCRBY + EXPIRE for same key are pipelined together (same slot) - Reduces round-trips from 2 to 1 per key in cluster mode - Single/Sentinel mode: uses explicit pipeline (batches all commands) - All commands in one pipeline for minimal latency - Optimal for non-cluster deployments This simplifies configuration by removing user-facing options while automatically choosing the optimal pipeline strategy for each Redis type. Breaking changes: - Remove REDIS_USE_EXPLICIT_PIPELINE env var - Remove REDIS_PERSECOND_USE_EXPLICIT_PIPELINE env var - Remove UseExplicitPipeline() interface method Signed-off-by: seonghyun <seonghyunoh@gmail.com> * docs: remove non-existent REDIS_USE_EXPLICIT_PIPELINE from README The REDIS_USE_EXPLICIT_PIPELINE and REDIS_PERSECOND_USE_EXPLICIT_PIPELINE settings were documented in README but do not exist in settings.go. Removed the documentation to match the actual implementation. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * style: fix gofmt formatting in settings.go Signed-off-by: seonghyun <seonghyunoh@gmail.com> --------- Signed-off-by: seonghyun <seonghyunoh@gmail.com> add support for response dynamic metadata (envoyproxy#1027) * add support for response dynamic metadata Signed-off-by: zirain <zirain2009@gmail.com> * address Colin's comment Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> fix: apply TLS and auth config to Redis Sentinel connections (envoyproxy#1015) * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> --------- Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> feat: Add Pool On-Empty Behavior Configuration for Redis Connections (envoyproxy#1018) * feat: Add Pool On-Empty Behavior Configuration for Redis Connections Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> --------- Signed-off-by: notdu <huudutg@gmail.com> [ISSUE] Fix: Wildcard Stats Key Behavior Changes (envoyproxy#1017) * Fix: Preserve metrics for wild card Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Unify matchedWildCardKey for if-else statement Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove hasShareThreshold conditional check in non-wild-card block Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Prevent log debug to creating stats from executing twice per request Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove redundant assignment Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove dead code Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Refactor: unify logic to include value to stats Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: Nam Dang <xuannam230201@gmail.com> (fixes): local cache stat test fixes (envoyproxy#1013) * (fixes): local cache stat test fixes Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> * (fixes): invoke TestOverLimitWithStopCacheKeyIncrementWhenOverlimitConfig local cache stat tests Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> --------- Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> [Proposal] Share Threshold for Wildcard Rate Limiting (envoyproxy#1016) * Add share_threshold to make wild card values can share rate limit threshold Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Implement lazy initilization based on reviews Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: Nam Dang <xuannam230201@gmail.com> feat: Add field to add unspecified value to metric (envoyproxy#996) * Add field to add unspecified value to metric Signed-off-by: xuannam230201 <xuannam230201@gmail.com> Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update README.md to pass docs_check_format check Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update format to pass pre-commit check Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update based on comments and add more unit tests Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: xuannam230201 <xuannam230201@gmail.com> Signed-off-by: Nam Dang <xuannam230201@gmail.com> Replace Alpine with Google's distroless static image for enhanced sec… (envoyproxy#993) * Replace Alpine with Google's distroless static image for enhanced security and simplified maintenance. Includes CA certificates automatically and provides debug variant for troubleshooting. * security: pin distroless image to SHA and use nonroot variant - Pin gcr.io/distroless/static-debian12:nonroot to specific SHA digest - Ensures deterministic builds and prevents supply chain attacks - Use nonroot variant for enhanced security (runs as UID 65532) - Follows same pattern as Envoy proxy for consistency - Update documentation to reflect security improvements feat: add connection timeout configuration for Redis operations (envoyproxy#987) Signed-off-by: notdu <huudutg@gmail.com> build(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.10 (envoyproxy#980) Bumps google.golang.org/protobuf from 1.36.7 to 1.36.10. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-version: 1.36.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump golang in /examples/xds-sotw-config-server (envoyproxy#981) Bumps golang from 1.24.5 to 1.25.3. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump golang from 1.24.6 to 1.25.3 (envoyproxy#983) Bumps golang from 1.24.6 to 1.25.3. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (envoyproxy#976) Bumps alpine from `1e42bbe` to `4b7ce07`. --- updated-dependencies: - dependency-name: alpine dependency-version: 4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

A counter that goes over the limit poisons the local cache of the replica that observed it, and a refund that brings the counter back under the limit previously left every replica answering OVER_LIMIT from the local cache until the window ended. With the Redis backend, the decrement script now publishes the cache key on the ratelimit:local_cache_invalidation pub/sub channel when a refund crosses the counter back under its limit (old > limit && new <= limit), keeping the publish rate at one message per poisoning cycle. Every replica running with negative hits and a local cache subscribes on one dedicated connection to the main Redis and deletes published keys from its freecache, reconnecting with exponential backoff (capped at 30s) on connection errors. Invalidation is best-effort / at-most-once: missed messages are never buffered or replayed. Decrements routed to the dedicated per-second Redis never publish since the subscriber listens only on the main Redis. New statistics: ratelimit.localcache.invalidation.subscribed (gauge), .received and .deleted (counters). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Add ENABLE_NEGATIVE_HITS flag gating the negative-hits feature Negative hits (is_negative_hits descriptors) are now gated by the ENABLE_NEGATIVE_HITS environment variable, default off. While the flag is off, any request containing a negative-hit descriptor is rejected as a whole with the gRPC UNIMPLEMENTED code before the cache call, so a negative-hit descriptor is never silently processed as a positive hit. Rejections are counted in the new ratelimit.service.rate_limit.negative_hits_rejected statistic. The combination negative hits + memcached + local cache refuses to boot: an over-limit counter poisons the local cache and there is no invalidation path for memcached. All other combinations boot as before, including memcached negative hits without local cache. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT (envoyproxy#1206) * Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT A unit: month rate limit is computed as a fixed 60*60*24*30 second window counted from the Unix epoch, so it neither aligns with real calendar months nor accounts for months of different lengths (RDGRS-1999). Add a USE_CALENDAR_MONTH_RATE_LIMIT setting (default false) that, when enabled, buckets MONTH cache keys by UTC calendar month, sets their TTL/expiration to the actual time remaining until month end, and reports that same value as the reset duration. Defaults to false so existing MONTH limits keep their current reset behavior unless explicitly opted in. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * Trigger CI Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * docs: regenerate README TOC for new calendar-month section Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * memcached: fix expiration >30 days being misread as a Unix timestamp Memcached treats any expiration value greater than 30 days as an absolute Unix timestamp rather than a relative TTL. Calendar-aligned MONTH limits can produce a relative expiration up to 2,678,400 seconds (31-day months), which was passed straight into memcache.Item.Expiration and caused those keys to be treated as already expired. Convert the expiration to an absolute Unix timestamp whenever it would exceed memcached's 30-day relative-TTL threshold. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * test: fix call sites left out of sync by main merge The merge of main (is_negative_hits, []uint64 -> []utils.HitsAddend) into calendar-month-rate-limit (added useCalendarMonth bool param) left several test call sites using the pre-merge signatures for NewBaseRateLimit, NewRateLimitCacheImpl, and NewFixedRateLimitCacheImpl. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Signed-off-by: Kiran Malsetty <93211513+OS-kiranmalsetty@users.noreply.github.com> feat: implement is_negative_hits in rate limit descriptor (envoyproxy#1140) * feat: implement is_negative_hits in rate limit descriptor Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * added details to readme Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> redis: log recovery when a connection succeeds after a prior dial error (envoyproxy#1205) Operators currently only see repeated dial-error logs and have no explicit signal when the pool starts succeeding again. Track whether the last dial attempt failed and log once when a subsequent connection succeeds. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Update Go references and vulnerable dependencies (envoyproxy#1204) * Update Go references to 1.26.5 Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> * Update vulnerable Go dependencies Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> --------- Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> deps: bump x/net, x/text, x/sys to fix remaining CVEs (envoyproxy#1196) Follow-up to envoyproxy#1154 (which bumped x/net to 0.55.0). Bumps the golang.org/x dependencies to their latest patched releases to remediate the CVEs still outstanding after envoyproxy#1154: - golang.org/x/net v0.55.0 -> v0.57.0 (CVE-2026-46600, fixed in 0.56.0) - golang.org/x/text v0.37.0 -> v0.40.0 (CVE-2026-56852, fixed in 0.39.0) - golang.org/x/sys v0.45.0 -> v0.47.0 (already patched; kept current) No source changes required; `go build ./...` passes. Signed-off-by: Yitong Feng <yife@microsoft.com> redis: optionally close pooled connections on READONLY error replies (envoyproxy#1191) * redis: optionally close pooled connections on READONLY error replies After a master->replica failover in deployments that fail over by repointing an address at the new master (a Kubernetes Service, DNS, or a proxy - e.g. Redis without Sentinel, Dragonfly, KeyDB), the demoted master keeps already-established connections open. radix only discards pooled connections on IO errors, so those stale connections are reused forever and every write on them keeps failing with READONLY until the process restarts, turning a routine failover into a permanent rate limiting outage. Add an opt-in setting, REDIS_CLOSE_CONNECTION_ON_READONLY_ERROR (default false), that wraps pooled connections so a READONLY error reply strips radix's resp.ErrConnUsable wrapper. The pool then discards the connection and re-dials through the configured address, reaching the current master. The failing command still returns its error to the caller; only the connection handling changes. Applies to the main and per-second clients across single, cluster, and sentinel modes. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * fix README.md Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> build(deps): bump docker/setup-qemu-action from 3.2.0 to 4.2.0 (envoyproxy#1179) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.2.0 to 4.2.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@49b3bc8...96fe6ef) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump actions/checkout from 4.1.7 to 7.0.0 (envoyproxy#1173) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.7 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@692973e...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (envoyproxy#1172) Bumps alpine from `4b7ce07` to `28bd5fe`. --- updated-dependencies: - dependency-name: alpine dependency-version: 28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> add metadata to rate limit descriptors pb to yaml (envoyproxy#1175) Signed-off-by: achoo30 <achoo30@bloomberg.net> update proto to support metadata (envoyproxy#1174) Signed-off-by: achoo30 <achoo30@bloomberg.net> Update to golang-1.26.4 and update golang.org/x/net to 0.55.0 (envoyproxy#1154) Signed-off-by: Fred Dafunk <bloomenergyguy@gmail.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: bound cluster pipeline parallelism (envoyproxy#1149) * redis: bound cluster pipeline parallelism Signed-off-by: dthuynh <dthuynh@axon.com> * Refactor to address comment: use gRPC request context in PipeDo, cap the parallelism to RedisPoolSize Signed-off-by: dthuynh <dthuynh@axon.com> --------- Signed-off-by: dthuynh <dthuynh@axon.com> Co-authored-by: dthuynh <dthuynh@axon.com> fix: correct typos in memcache error messages and variable name (envoyproxy#1150) Signed-off-by: Immanuel Tikhonov <pchpr.00@list.ru> Signed-off-by: immanuwell <pchpr.00@list.ru> Update to golang 1.26.3 (envoyproxy#1152) Co-authored-by: collin-lee <collin.lee@salesforce.com> Add quota mode to rate limit descriptor proto (envoyproxy#1148) feat: add retry in init phase instead of panic directly (envoyproxy#1144) * feat: add retry in init phase instead of panic directly Signed-off-by: zirain <zirain2009@gmail.com> * respect signal handling for graceful shutdown Signed-off-by: zirain <zirain2009@gmail.com> * fix test Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Add integration test for quota based service selection. (envoyproxy#1114) Signed-off-by: Yan Avlasov <yavlasov@google.com> build: pin golang:1.26.2 to multi-arch index digest (envoyproxy#1131) PR envoyproxy#1124 updated the golang base image from 1.26.1 to 1.26.2, but the new digest sha256:7095ad02810845fa35d1fb090b8e57dd20dce4ca36b29b42951 802350d2ec90e is a single-arch (linux/amd64) image manifest rather than a multi-arch index. The previous 1.26.1 digest sha256:e2ddb153f7 86ee6210bf8c40f7f35490b3ff7d38be70d1a0d358ba64225f6428 is an OCI image index covering linux/amd64, arm64/v8, arm/v7, 386, ppc64le, riscv64, s390x and windows/amd64. When buildx is asked to produce a non-amd64 variant of the published envoyproxy/ratelimit image, the FROM line resolves to the amd64 base on every platform, so the resulting binary is amd64 regardless of the target. The multi-arch publish then stamps that amd64 binary into the arm64 layer of the released index, producing an image that fails on arm64 nodes with: exec /bin/ratelimit: exec format error Swap to the corresponding multi-arch index digest sha256:b54cbf583d39 0341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716, which contains the existing 7095ad02... amd64 manifest as one of its children plus the arm64/v8 and other platform variants. The amd64 image is unchanged; arm64 builds now produce arm64 binaries. Signed-off-by: Harrison Harris <harrison.harris@xapien.com> Co-authored-by: Harrison Harris <harrison.harris@xapien.com> Update third party libraries flagged for vulnerability scans (envoyproxy#1124) Signed-off-by: collin-lee <collin.lee@salesforce.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: add zipkin b3 header propagation (envoyproxy#1110) Fix Prometheus response time units (envoyproxy#1104) Dockerfile: add ENTRYPOINT (envoyproxy#1095) Make the docker image easier to consume. Signed-off-by: Ian Kerins <git@isk.haus> Send user defined metadata to the client (envoyproxy#1112) Signed-off-by: Yan Avlasov <yavlasov@google.com> build(deps): bump google.golang.org/grpc from v1.74.2 to v1.80.0 (envoyproxy#1111) Signed-off by: João Pereira <joao@jpereira.me> Upgrades the gRPC dependency from v1.74.2 to v1.80.0, along with its transitive dependency updates (golang.org/x/net, google.golang.org/protobuf, genproto, go-control-plane, etc.). Signed-off-by: João Pereira <joao.pereira@zwift.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Fix quota result when all limits were exceeded (envoyproxy#1059) * Fix quota result when all limits were exceeded Signed-off-by: yavlasov <yavlasov@google.com> * Address comments Signed-off-by: yavlasov <yavlasov@google.com> * Fix comment Signed-off-by: yavlasov <yavlasov@google.com> * fix comment Signed-off-by: yavlasov <yavlasov@google.com> * Remove log into a file Signed-off-by: yavlasov <yavlasov@google.com> --------- Signed-off-by: yavlasov <yavlasov@google.com> Update golang references to 1.26.1 (envoyproxy#1091) Add integration test for token based quota (envoyproxy#1092) Signed-off-by: yavlasov <yavlasov@google.com> Add quota integration test (envoyproxy#1090) Add debug logging for quota values (envoyproxy#1089) Wait for sevices to be up before running tests (envoyproxy#1088) update otel and fix failing tests (envoyproxy#1078) Signed-off-by: Ashish Tiwari <ashishjaitiwari15112000@gmail.com> feat: Support wildcard in non-trailing positions for rate limit descriptor values (envoyproxy#1085) Signed-off-by: Nam Dang <xuannam230201@gmail.com> build(deps): bump golang from 1.25.6 to 1.26.1 (envoyproxy#1079) Bumps golang from 1.25.6 to 1.26.1. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> bump go version 1.25.6 (envoyproxy#1047) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> implement quota mode for soft rate limit check (envoyproxy#1045) * implement quota mode for rate limit check Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix format Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix format Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix tests Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix quota mode flag Signed-off-by: Dan Sun <dsun20@bloomberg.net> --------- Signed-off-by: Dan Sun <dsun20@bloomberg.net> upgrade radix from v3 to v4 for improved pipeline handling (envoyproxy#1041) * feat: upgrade radix from v3 to v4 Upgrade radix Redis client from v3.8.1 to v4.1.4. Main changes: - Import paths: radix/v3 -> radix/v4 - Pool/Cluster/Sentinel use Config.New() instead of New() - All client operations require context.Context parameter - Dialer setup changed from functional options to struct config - Pipelining uses radix.NewPipeline() and Append() - Write buffering via Dialer.WriteFlushInterval Breaking from v3: - Pool on-empty behavior (WAIT/CREATE/ERROR) not available - REDIS_PIPELINE_LIMIT setting deprecated (no effect in v4) Tested with existing test suite - all tests passing. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * docs: update pipeline settings for radix v4 Update documentation to reflect radix v4's pipeline behavior: - REDIS_PIPELINE_WINDOW now sets WriteFlushInterval (auto-flush timing) - REDIS_PIPELINE_LIMIT deprecated - no effect in v4 - Add REDIS_USE_EXPLICIT_PIPELINE for manual pipeline control - Required for Redis Cluster: PIPELINE_WINDOW must be non-zero Update terminology from "implicit pipelining" to "write buffering" to better match radix v4's actual behavior. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: update tests for radix v4 - Add useExplicitPipeline parameter to test client creation - Update error assertions for v4's error message format (v4 prefixes with "response returned from Conn:") - Handle different connection errors (EOF, connection reset, broken pipe) - Update radix.FlatCmd usage for v4 API Signed-off-by: seonghyun <seonghyunoh@gmail.com> * chore: add deprecation warning for REDIS_PIPELINE_LIMIT Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: fix Redis cluster test config for radix v4 Replace deprecated RedisPipelineLimit with RedisPipelineWindow in configRedisCluster function. Radix v4 requires WriteFlushInterval (RedisPipelineWindow) for cluster mode buffering instead of the deprecated pipeline limit setting. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * style: fix gofmt struct field alignment in settings.go Signed-off-by: seonghyun <seonghyunoh@gmail.com> * fix: fail fast on unsupported REDIS_POOL_ON_EMPTY_BEHAVIOR settings Radix v4 does not support CREATE or ERROR behaviors for REDIS_POOL_ON_EMPTY_BEHAVIOR. Previously, these settings were logged as errors but the application would continue with blocking behavior, which could cause unexpected issues in production. Changes: - Panic at startup when CREATE or ERROR is detected - Prevent silent behavior changes that could cause blocking - Update tests to verify panic behavior - Improve migration documentation in comments This ensures users are immediately notified of incompatible configuration rather than experiencing unexpected blocking in production. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * fix: change REDIS_POOL_ON_EMPTY_BEHAVIOR default to WAIT The default value 'CREATE' is not supported in radix v4 and causes integration tests to panic at startup. Changed default to 'WAIT' which matches radix v4's actual pool behavior (always blocks when empty). This fixes integration test failures where tests without explicit REDIS_POOL_ON_EMPTY_BEHAVIOR settings would panic during initialization with: "REDIS_POOL_ON_EMPTY_BEHAVIOR=CREATE is not supported in radix v4" Also updated documentation to clarify that CREATE/ERROR are not supported and marked RedisPoolOnEmptyWaitDuration as deprecated. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: fix cluster connection timeout and context bug - Fix WaitForTcpPort to use timeoutCtx instead of ctx This ensures the timeout parameter is actually respected when dialing TCP connections. - Increase gRPC server startup timeout from 1s to 10s Radix v4 cluster connection initialization takes longer, especially when establishing connections to multiple cluster nodes. This prevents "connection refused" errors in integration tests. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: extract dialer creation logic to reduce duplication Consolidates Redis and Sentinel dialer setup into a reusable createDialer helper function, eliminating ~30 lines of duplicated code. Improves logging by including connection target details (e.g., "sentinel(master,host1,host2)") instead of generic "sentinel" string. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: remove deprecated REDIS_POOL_ON_EMPTY_WAIT_DURATION settings Remove the deprecated poolOnEmptyWaitDuration parameter and related configuration settings as they have no effect in radix v4. The pool always blocks until a connection is available when using WAIT behavior. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: auto-select pipeline mode based on Redis type Remove REDIS_USE_EXPLICIT_PIPELINE configuration option and automatically determine pipeline mode based on Redis deployment type: - Cluster mode: uses grouped pipeline (groups same-key commands) - INCRBY + EXPIRE for same key are pipelined together (same slot) - Reduces round-trips from 2 to 1 per key in cluster mode - Single/Sentinel mode: uses explicit pipeline (batches all commands) - All commands in one pipeline for minimal latency - Optimal for non-cluster deployments This simplifies configuration by removing user-facing options while automatically choosing the optimal pipeline strategy for each Redis type. Breaking changes: - Remove REDIS_USE_EXPLICIT_PIPELINE env var - Remove REDIS_PERSECOND_USE_EXPLICIT_PIPELINE env var - Remove UseExplicitPipeline() interface method Signed-off-by: seonghyun <seonghyunoh@gmail.com> * docs: remove non-existent REDIS_USE_EXPLICIT_PIPELINE from README The REDIS_USE_EXPLICIT_PIPELINE and REDIS_PERSECOND_USE_EXPLICIT_PIPELINE settings were documented in README but do not exist in settings.go. Removed the documentation to match the actual implementation. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * style: fix gofmt formatting in settings.go Signed-off-by: seonghyun <seonghyunoh@gmail.com> --------- Signed-off-by: seonghyun <seonghyunoh@gmail.com> add support for response dynamic metadata (envoyproxy#1027) * add support for response dynamic metadata Signed-off-by: zirain <zirain2009@gmail.com> * address Colin's comment Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> fix: apply TLS and auth config to Redis Sentinel connections (envoyproxy#1015) * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> --------- Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> feat: Add Pool On-Empty Behavior Configuration for Redis Connections (envoyproxy#1018) * feat: Add Pool On-Empty Behavior Configuration for Redis Connections Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> --------- Signed-off-by: notdu <huudutg@gmail.com> [ISSUE] Fix: Wildcard Stats Key Behavior Changes (envoyproxy#1017) * Fix: Preserve metrics for wild card Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Unify matchedWildCardKey for if-else statement Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove hasShareThreshold conditional check in non-wild-card block Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Prevent log debug to creating stats from executing twice per request Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove redundant assignment Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove dead code Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Refactor: unify logic to include value to stats Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: Nam Dang <xuannam230201@gmail.com> (fixes): local cache stat test fixes (envoyproxy#1013) * (fixes): local cache stat test fixes Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> * (fixes): invoke TestOverLimitWithStopCacheKeyIncrementWhenOverlimitConfig local cache stat tests Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> --------- Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> [Proposal] Share Threshold for Wildcard Rate Limiting (envoyproxy#1016) * Add share_threshold to make wild card values can share rate limit threshold Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Implement lazy initilization based on reviews Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: Nam Dang <xuannam230201@gmail.com> feat: Add field to add unspecified value to metric (envoyproxy#996) * Add field to add unspecified value to metric Signed-off-by: xuannam230201 <xuannam230201@gmail.com> Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update README.md to pass docs_check_format check Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update format to pass pre-commit check Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update based on comments and add more unit tests Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: xuannam230201 <xuannam230201@gmail.com> Signed-off-by: Nam Dang <xuannam230201@gmail.com> Replace Alpine with Google's distroless static image for enhanced sec… (envoyproxy#993) * Replace Alpine with Google's distroless static image for enhanced security and simplified maintenance. Includes CA certificates automatically and provides debug variant for troubleshooting. * security: pin distroless image to SHA and use nonroot variant - Pin gcr.io/distroless/static-debian12:nonroot to specific SHA digest - Ensures deterministic builds and prevents supply chain attacks - Use nonroot variant for enhanced security (runs as UID 65532) - Follows same pattern as Envoy proxy for consistency - Update documentation to reflect security improvements feat: add connection timeout configuration for Redis operations (envoyproxy#987) Signed-off-by: notdu <huudutg@gmail.com> build(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.10 (envoyproxy#980) Bumps google.golang.org/protobuf from 1.36.7 to 1.36.10. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-version: 1.36.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump golang in /examples/xds-sotw-config-server (envoyproxy#981) Bumps golang from 1.24.5 to 1.25.3. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump golang from 1.24.6 to 1.25.3 (envoyproxy#983) Bumps golang from 1.24.6 to 1.25.3. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (envoyproxy#976) Bumps alpine from `1e42bbe` to `4b7ce07`. --- updated-dependencies: - dependency-name: alpine dependency-version: 4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

A counter that goes over the limit poisons the local cache of the replica that observed it, and a refund that brings the counter back under the limit previously left every replica answering OVER_LIMIT from the local cache until the window ended. With the Redis backend, the decrement script now publishes the cache key on the ratelimit:local_cache_invalidation pub/sub channel when a refund crosses the counter back under its limit (old > limit && new <= limit), keeping the publish rate at one message per poisoning cycle. Every replica running with negative hits and a local cache subscribes on one dedicated connection to the main Redis and deletes published keys from its freecache, reconnecting with exponential backoff (capped at 30s) on connection errors. Invalidation is best-effort / at-most-once: missed messages are never buffered or replayed. Decrements routed to the dedicated per-second Redis never publish since the subscriber listens only on the main Redis. New statistics: ratelimit.localcache.invalidation.subscribed (gauge), .received and .deleted (counters). Add ENABLE_NEGATIVE_HITS flag gating the negative-hits feature Negative hits (is_negative_hits descriptors) are now gated by the ENABLE_NEGATIVE_HITS environment variable, default off. While the flag is off, any request containing a negative-hit descriptor is rejected as a whole with the gRPC UNIMPLEMENTED code before the cache call, so a negative-hit descriptor is never silently processed as a positive hit. Rejections are counted in the new ratelimit.service.rate_limit.negative_hits_rejected statistic. The combination negative hits + memcached + local cache refuses to boot: an over-limit counter poisons the local cache and there is no invalidation path for memcached. All other combinations boot as before, including memcached negative hits without local cache. Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT (#1206) * Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT A unit: month rate limit is computed as a fixed 60*60*24*30 second window counted from the Unix epoch, so it neither aligns with real calendar months nor accounts for months of different lengths (RDGRS-1999). Add a USE_CALENDAR_MONTH_RATE_LIMIT setting (default false) that, when enabled, buckets MONTH cache keys by UTC calendar month, sets their TTL/expiration to the actual time remaining until month end, and reports that same value as the reset duration. Defaults to false so existing MONTH limits keep their current reset behavior unless explicitly opted in. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * Trigger CI Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * docs: regenerate README TOC for new calendar-month section Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * memcached: fix expiration >30 days being misread as a Unix timestamp Memcached treats any expiration value greater than 30 days as an absolute Unix timestamp rather than a relative TTL. Calendar-aligned MONTH limits can produce a relative expiration up to 2,678,400 seconds (31-day months), which was passed straight into memcache.Item.Expiration and caused those keys to be treated as already expired. Convert the expiration to an absolute Unix timestamp whenever it would exceed memcached's 30-day relative-TTL threshold. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * test: fix call sites left out of sync by main merge The merge of main (is_negative_hits, []uint64 -> []utils.HitsAddend) into calendar-month-rate-limit (added useCalendarMonth bool param) left several test call sites using the pre-merge signatures for NewBaseRateLimit, NewRateLimitCacheImpl, and NewFixedRateLimitCacheImpl. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Signed-off-by: Kiran Malsetty <93211513+OS-kiranmalsetty@users.noreply.github.com> feat: implement is_negative_hits in rate limit descriptor (#1140) * feat: implement is_negative_hits in rate limit descriptor Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * added details to readme Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> redis: log recovery when a connection succeeds after a prior dial error (#1205) Operators currently only see repeated dial-error logs and have no explicit signal when the pool starts succeeding again. Track whether the last dial attempt failed and log once when a subsequent connection succeeds. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Update Go references and vulnerable dependencies (#1204) * Update Go references to 1.26.5 Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> * Update vulnerable Go dependencies Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> --------- Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> deps: bump x/net, x/text, x/sys to fix remaining CVEs (#1196) Follow-up to #1154 (which bumped x/net to 0.55.0). Bumps the golang.org/x dependencies to their latest patched releases to remediate the CVEs still outstanding after #1154: - golang.org/x/net v0.55.0 -> v0.57.0 (CVE-2026-46600, fixed in 0.56.0) - golang.org/x/text v0.37.0 -> v0.40.0 (CVE-2026-56852, fixed in 0.39.0) - golang.org/x/sys v0.45.0 -> v0.47.0 (already patched; kept current) No source changes required; `go build ./...` passes. Signed-off-by: Yitong Feng <yife@microsoft.com> redis: optionally close pooled connections on READONLY error replies (#1191) * redis: optionally close pooled connections on READONLY error replies After a master->replica failover in deployments that fail over by repointing an address at the new master (a Kubernetes Service, DNS, or a proxy - e.g. Redis without Sentinel, Dragonfly, KeyDB), the demoted master keeps already-established connections open. radix only discards pooled connections on IO errors, so those stale connections are reused forever and every write on them keeps failing with READONLY until the process restarts, turning a routine failover into a permanent rate limiting outage. Add an opt-in setting, REDIS_CLOSE_CONNECTION_ON_READONLY_ERROR (default false), that wraps pooled connections so a READONLY error reply strips radix's resp.ErrConnUsable wrapper. The pool then discards the connection and re-dials through the configured address, reaching the current master. The failing command still returns its error to the caller; only the connection handling changes. Applies to the main and per-second clients across single, cluster, and sentinel modes. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * fix README.md Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> build(deps): bump docker/setup-qemu-action from 3.2.0 to 4.2.0 (#1179) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.2.0 to 4.2.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/49b3bc8e6bdd4a60e6116a5414239cba5943d3cf...96fe6ef7f33517b61c61be40b68a1882f3264fb8) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump actions/checkout from 4.1.7 to 7.0.0 (#1173) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.7 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/692973e3d937129bcbf40652eb9f2f61becf3332...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (#1172) Bumps alpine from `4b7ce07` to `28bd5fe`. --- updated-dependencies: - dependency-name: alpine dependency-version: 28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> add metadata to rate limit descriptors pb to yaml (#1175) Signed-off-by: achoo30 <achoo30@bloomberg.net> update proto to support metadata (#1174) Signed-off-by: achoo30 <achoo30@bloomberg.net> Update to golang-1.26.4 and update golang.org/x/net to 0.55.0 (#1154) Signed-off-by: Fred Dafunk <bloomenergyguy@gmail.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: bound cluster pipeline parallelism (#1149) * redis: bound cluster pipeline parallelism Signed-off-by: dthuynh <dthuynh@axon.com> * Refactor to address comment: use gRPC request context in PipeDo, cap the parallelism to RedisPoolSize Signed-off-by: dthuynh <dthuynh@axon.com> --------- Signed-off-by: dthuynh <dthuynh@axon.com> Co-authored-by: dthuynh <dthuynh@axon.com> fix: correct typos in memcache error messages and variable name (#1150) Signed-off-by: Immanuel Tikhonov <pchpr.00@list.ru> Signed-off-by: immanuwell <pchpr.00@list.ru> Update to golang 1.26.3 (#1152) Co-authored-by: collin-lee <collin.lee@salesforce.com> Add quota mode to rate limit descriptor proto (#1148) feat: add retry in init phase instead of panic directly (#1144) * feat: add retry in init phase instead of panic directly Signed-off-by: zirain <zirain2009@gmail.com> * respect signal handling for graceful shutdown Signed-off-by: zirain <zirain2009@gmail.com> * fix test Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Add integration test for quota based service selection. (#1114) Signed-off-by: Yan Avlasov <yavlasov@google.com> build: pin golang:1.26.2 to multi-arch index digest (#1131) PR #1124 updated the golang base image from 1.26.1 to 1.26.2, but the new digest sha256:7095ad02810845fa35d1fb090b8e57dd20dce4ca36b29b42951 802350d2ec90e is a single-arch (linux/amd64) image manifest rather than a multi-arch index. The previous 1.26.1 digest sha256:e2ddb153f7 86ee6210bf8c40f7f35490b3ff7d38be70d1a0d358ba64225f6428 is an OCI image index covering linux/amd64, arm64/v8, arm/v7, 386, ppc64le, riscv64, s390x and windows/amd64. When buildx is asked to produce a non-amd64 variant of the published envoyproxy/ratelimit image, the FROM line resolves to the amd64 base on every platform, so the resulting binary is amd64 regardless of the target. The multi-arch publish then stamps that amd64 binary into the arm64 layer of the released index, producing an image that fails on arm64 nodes with: exec /bin/ratelimit: exec format error Swap to the corresponding multi-arch index digest sha256:b54cbf583d39 0341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716, which contains the existing 7095ad02... amd64 manifest as one of its children plus the arm64/v8 and other platform variants. The amd64 image is unchanged; arm64 builds now produce arm64 binaries. Signed-off-by: Harrison Harris <harrison.harris@xapien.com> Co-authored-by: Harrison Harris <harrison.harris@xapien.com> Update third party libraries flagged for vulnerability scans (#1124) Signed-off-by: collin-lee <collin.lee@salesforce.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: add zipkin b3 header propagation (#1110) Fix Prometheus response time units (#1104) Dockerfile: add ENTRYPOINT (#1095) Make the docker image easier to consume. Signed-off-by: Ian Kerins <git@isk.haus> Send user defined metadata to the client (#1112) Signed-off-by: Yan Avlasov <yavlasov@google.com> build(deps): bump google.golang.org/grpc from v1.74.2 to v1.80.0 (#1111) Signed-off by: João Pereira <joao@jpereira.me> Upgrades the gRPC dependency from v1.74.2 to v1.80.0, along with its transitive dependency updates (golang.org/x/net, google.golang.org/protobuf, genproto, go-control-plane, etc.). Signed-off-by: João Pereira <joao.pereira@zwift.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Fix quota result when all limits were exceeded (#1059) * Fix quota result when all limits were exceeded Signed-off-by: yavlasov <yavlasov@google.com> * Address comments Signed-off-by: yavlasov <yavlasov@google.com> * Fix comment Signed-off-by: yavlasov <yavlasov@google.com> * fix comment Signed-off-by: yavlasov <yavlasov@google.com> * Remove log into a file Signed-off-by: yavlasov <yavlasov@google.com> --------- Signed-off-by: yavlasov <yavlasov@google.com> Update golang references to 1.26.1 (#1091) Add integration test for token based quota (#1092) Signed-off-by: yavlasov <yavlasov@google.com> Add quota integration test (#1090) Add debug logging for quota values (#1089) Wait for sevices to be up before running tests (#1088) update otel and fix failing tests (#1078) Signed-off-by: Ashish Tiwari <ashishjaitiwari15112000@gmail.com> feat: Support wildcard in non-trailing positions for rate limit descriptor values (#1085) Signed-off-by: Nam Dang <xuannam230201@gmail.com> build(deps): bump golang from 1.25.6 to 1.26.1 (#1079) Bumps golang from 1.25.6 to 1.26.1. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> bump go version 1.25.6 (#1047) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> implement quota mode for soft rate limit check (#1045) * implement quota mode for rate limit check Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix format Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix format Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix tests Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix quota mode flag Signed-off-by: Dan Sun <dsun20@bloomberg.net> --------- Signed-off-by: Dan Sun <dsun20@bloomberg.net> upgrade radix from v3 to v4 for improved pipeline handling (#1041) * feat: upgrade radix from v3 to v4 Upgrade radix Redis client from v3.8.1 to v4.1.4. Main changes: - Import paths: radix/v3 -> radix/v4 - Pool/Cluster/Sentinel use Config.New() instead of New() - All client operations require context.Context parameter - Dialer setup changed from functional options to struct config - Pipelining uses radix.NewPipeline() and Append() - Write buffering via Dialer.WriteFlushInterval Breaking from v3: - Pool on-empty behavior (WAIT/CREATE/ERROR) not available - REDIS_PIPELINE_LIMIT setting deprecated (no effect in v4) Tested with existing test suite - all tests passing. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * docs: update pipeline settings for radix v4 Update documentation to reflect radix v4's pipeline behavior: - REDIS_PIPELINE_WINDOW now sets WriteFlushInterval (auto-flush timing) - REDIS_PIPELINE_LIMIT deprecated - no effect in v4 - Add REDIS_USE_EXPLICIT_PIPELINE for manual pipeline control - Required for Redis Cluster: PIPELINE_WINDOW must be non-zero Update terminology from "implicit pipelining" to "write buffering" to better match radix v4's actual behavior. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: update tests for radix v4 - Add useExplicitPipeline parameter to test client creation - Update error assertions for v4's error message format (v4 prefixes with "response returned from Conn:") - Handle different connection errors (EOF, connection reset, broken pipe) - Update radix.FlatCmd usage for v4 API Signed-off-by: seonghyun <seonghyunoh@gmail.com> * chore: add deprecation warning for REDIS_PIPELINE_LIMIT Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: fix Redis cluster test config for radix v4 Replace deprecated RedisPipelineLimit with RedisPipelineWindow in configRedisCluster function. Radix v4 requires WriteFlushInterval (RedisPipelineWindow) for cluster mode buffering instead of the deprecated pipeline limit setting. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * style: fix gofmt struct field alignment in settings.go Signed-off-by: seonghyun <seonghyunoh@gmail.com> * fix: fail fast on unsupported REDIS_POOL_ON_EMPTY_BEHAVIOR settings Radix v4 does not support CREATE or ERROR behaviors for REDIS_POOL_ON_EMPTY_BEHAVIOR. Previously, these settings were logged as errors but the application would continue with blocking behavior, which could cause unexpected issues in production. Changes: - Panic at startup when CREATE or ERROR is detected - Prevent silent behavior changes that could cause blocking - Update tests to verify panic behavior - Improve migration documentation in comments This ensures users are immediately notified of incompatible configuration rather than experiencing unexpected blocking in production. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * fix: change REDIS_POOL_ON_EMPTY_BEHAVIOR default to WAIT The default value 'CREATE' is not supported in radix v4 and causes integration tests to panic at startup. Changed default to 'WAIT' which matches radix v4's actual pool behavior (always blocks when empty). This fixes integration test failures where tests without explicit REDIS_POOL_ON_EMPTY_BEHAVIOR settings would panic during initialization with: "REDIS_POOL_ON_EMPTY_BEHAVIOR=CREATE is not supported in radix v4" Also updated documentation to clarify that CREATE/ERROR are not supported and marked RedisPoolOnEmptyWaitDuration as deprecated. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: fix cluster connection timeout and context bug - Fix WaitForTcpPort to use timeoutCtx instead of ctx This ensures the timeout parameter is actually respected when dialing TCP connections. - Increase gRPC server startup timeout from 1s to 10s Radix v4 cluster connection initialization takes longer, especially when establishing connections to multiple cluster nodes. This prevents "connection refused" errors in integration tests. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: extract dialer creation logic to reduce duplication Consolidates Redis and Sentinel dialer setup into a reusable createDialer helper function, eliminating ~30 lines of duplicated code. Improves logging by including connection target details (e.g., "sentinel(master,host1,host2)") instead of generic "sentinel" string. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: remove deprecated REDIS_POOL_ON_EMPTY_WAIT_DURATION settings Remove the deprecated poolOnEmptyWaitDuration parameter and related configuration settings as they have no effect in radix v4. The pool always blocks until a connection is available when using WAIT behavior. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: auto-select pipeline mode based on Redis type Remove REDIS_USE_EXPLICIT_PIPELINE configuration option and automatically determine pipeline mode based on Redis deployment type: - Cluster mode: uses grouped pipeline (groups same-key commands) - INCRBY + EXPIRE for same key are pipelined together (same slot) - Reduces round-trips from 2 to 1 per key in cluster mode - Single/Sentinel mode: uses explicit pipeline (batches all commands) - All commands in one pipeline for minimal latency - Optimal for non-cluster deployments This simplifies configuration by removing user-facing options while automatically choosing the optimal pipeline strategy for each Redis type. Breaking changes: - Remove REDIS_USE_EXPLICIT_PIPELINE env var - Remove REDIS_PERSECOND_USE_EXPLICIT_PIPELINE env var - Remove UseExplicitPipeline() interface method Signed-off-by: seonghyun <seonghyunoh@gmail.com> * docs: remove non-existent REDIS_USE_EXPLICIT_PIPELINE from README The REDIS_USE_EXPLICIT_PIPELINE and REDIS_PERSECOND_USE_EXPLICIT_PIPELINE settings were documented in README but do not exist in settings.go. Removed the documentation to match the actual implementation. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * style: fix gofmt formatting in settings.go Signed-off-by: seonghyun <seonghyunoh@gmail.com> --------- Signed-off-by: seonghyun <seonghyunoh@gmail.com> add support for response dynamic metadata (#1027) * add support for response dynamic metadata Signed-off-by: zirain <zirain2009@gmail.com> * address Colin's comment Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> fix: apply TLS and auth config to Redis Sentinel connections (#1015) * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> --------- Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> feat: Add Pool On-Empty Behavior Configuration for Redis Connections (#1018) * feat: Add Pool On-Empty Behavior Configuration for Redis Connections Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> --------- Signed-off-by: notdu <huudutg@gmail.com> [ISSUE] Fix: Wildcard Stats Key Behavior Changes (#1017) * Fix: Preserve metrics for wild card Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Unify matchedWildCardKey for if-else statement Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove hasShareThreshold conditional check in non-wild-card block Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Prevent log debug to creating stats from executing twice per request Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove redundant assignment Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove dead code Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Refactor: unify logic to include value to stats Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: Nam Dang <xuannam230201@gmail.com> (fixes): local cache stat test fixes (#1013) * (fixes): local cache stat test fixes Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> * (fixes): invoke TestOverLimitWithStopCacheKeyIncrementWhenOverlimitConfig local cache stat tests Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> --------- Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> [Proposal] Share Threshold for Wildcard Rate Limiting (#1016) * Add share_threshold to make wild card values can share rate limit threshold Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Implement lazy initilization based on reviews Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: Nam Dang <xuannam230201@gmail.com> feat: Add field to add unspecified value to metric (#996) * Add field to add unspecified value to metric Signed-off-by: xuannam230201 <xuannam230201@gmail.com> Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update README.md to pass docs_check_format check Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update format to pass pre-commit check Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update based on comments and add more unit tests Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: xuannam230201 <xuannam230201@gmail.com> Signed-off-by: Nam Dang <xuannam230201@gmail.com> Replace Alpine with Google's distroless static image for enhanced sec… (#993) * Replace Alpine with Google's distroless static image for enhanced security and simplified maintenance. Includes CA certificates automatically and provides debug variant for troubleshooting. * security: pin distroless image to SHA and use nonroot variant - Pin gcr.io/distroless/static-debian12:nonroot to specific SHA digest - Ensures deterministic builds and prevents supply chain attacks - Use nonroot variant for enhanced security (runs as UID 65532) - Follows same pattern as Envoy proxy for consistency - Update documentation to reflect security improvements feat: add connection timeout configuration for Redis operations (#987) Signed-off-by: notdu <huudutg@gmail.com> build(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.10 (#980) Bumps google.golang.org/protobuf from 1.36.7 to 1.36.10. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-version: 1.36.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump golang in /examples/xds-sotw-config-server (#981) Bumps golang from 1.24.5 to 1.25.3. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump golang from 1.24.6 to 1.25.3 (#983) Bumps golang from 1.24.6 to 1.25.3. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (#976) Bumps alpine from `1e42bbe` to `4b7ce07`. --- updated-dependencies: - dependency-name: alpine dependency-version: 4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Add ENABLE_NEGATIVE_HITS flag gating the negative-hits feature Negative hits (is_negative_hits descriptors) are now gated by the ENABLE_NEGATIVE_HITS environment variable, default off. While the flag is off, any request containing a negative-hit descriptor is rejected as a whole with the gRPC UNIMPLEMENTED code before the cache call, so a negative-hit descriptor is never silently processed as a positive hit. Rejections are counted in the new ratelimit.service.negative_hits_rejected statistic. The combination negative hits + memcached + local cache refuses to boot: an over-limit counter poisons the local cache and there is no invalidation path for memcached. All other combinations boot as before, including memcached negative hits without local cache. Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT (#1206) * Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT A unit: month rate limit is computed as a fixed 60*60*24*30 second window counted from the Unix epoch, so it neither aligns with real calendar months nor accounts for months of different lengths (RDGRS-1999). Add a USE_CALENDAR_MONTH_RATE_LIMIT setting (default false) that, when enabled, buckets MONTH cache keys by UTC calendar month, sets their TTL/expiration to the actual time remaining until month end, and reports that same value as the reset duration. Defaults to false so existing MONTH limits keep their current reset behavior unless explicitly opted in. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * Trigger CI Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * docs: regenerate README TOC for new calendar-month section Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * memcached: fix expiration >30 days being misread as a Unix timestamp Memcached treats any expiration value greater than 30 days as an absolute Unix timestamp rather than a relative TTL. Calendar-aligned MONTH limits can produce a relative expiration up to 2,678,400 seconds (31-day months), which was passed straight into memcache.Item.Expiration and caused those keys to be treated as already expired. Convert the expiration to an absolute Unix timestamp whenever it would exceed memcached's 30-day relative-TTL threshold. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * test: fix call sites left out of sync by main merge The merge of main (is_negative_hits, []uint64 -> []utils.HitsAddend) into calendar-month-rate-limit (added useCalendarMonth bool param) left several test call sites using the pre-merge signatures for NewBaseRateLimit, NewRateLimitCacheImpl, and NewFixedRateLimitCacheImpl. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Signed-off-by: Kiran Malsetty <93211513+OS-kiranmalsetty@users.noreply.github.com> feat: implement is_negative_hits in rate limit descriptor (#1140) * feat: implement is_negative_hits in rate limit descriptor Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * added details to readme Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> redis: log recovery when a connection succeeds after a prior dial error (#1205) Operators currently only see repeated dial-error logs and have no explicit signal when the pool starts succeeding again. Track whether the last dial attempt failed and log once when a subsequent connection succeeds. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Update Go references and vulnerable dependencies (#1204) * Update Go references to 1.26.5 Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> * Update vulnerable Go dependencies Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> --------- Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> deps: bump x/net, x/text, x/sys to fix remaining CVEs (#1196) Follow-up to #1154 (which bumped x/net to 0.55.0). Bumps the golang.org/x dependencies to their latest patched releases to remediate the CVEs still outstanding after #1154: - golang.org/x/net v0.55.0 -> v0.57.0 (CVE-2026-46600, fixed in 0.56.0) - golang.org/x/text v0.37.0 -> v0.40.0 (CVE-2026-56852, fixed in 0.39.0) - golang.org/x/sys v0.45.0 -> v0.47.0 (already patched; kept current) No source changes required; `go build ./...` passes. Signed-off-by: Yitong Feng <yife@microsoft.com> redis: optionally close pooled connections on READONLY error replies (#1191) * redis: optionally close pooled connections on READONLY error replies After a master->replica failover in deployments that fail over by repointing an address at the new master (a Kubernetes Service, DNS, or a proxy - e.g. Redis without Sentinel, Dragonfly, KeyDB), the demoted master keeps already-established connections open. radix only discards pooled connections on IO errors, so those stale connections are reused forever and every write on them keeps failing with READONLY until the process restarts, turning a routine failover into a permanent rate limiting outage. Add an opt-in setting, REDIS_CLOSE_CONNECTION_ON_READONLY_ERROR (default false), that wraps pooled connections so a READONLY error reply strips radix's resp.ErrConnUsable wrapper. The pool then discards the connection and re-dials through the configured address, reaching the current master. The failing command still returns its error to the caller; only the connection handling changes. Applies to the main and per-second clients across single, cluster, and sentinel modes. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * fix README.md Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> build(deps): bump docker/setup-qemu-action from 3.2.0 to 4.2.0 (#1179) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.2.0 to 4.2.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/49b3bc8e6bdd4a60e6116a5414239cba5943d3cf...96fe6ef7f33517b61c61be40b68a1882f3264fb8) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump actions/checkout from 4.1.7 to 7.0.0 (#1173) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.7 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/692973e3d937129bcbf40652eb9f2f61becf3332...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (#1172) Bumps alpine from `4b7ce07` to `28bd5fe`. --- updated-dependencies: - dependency-name: alpine dependency-version: 28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> add metadata to rate limit descriptors pb to yaml (#1175) Signed-off-by: achoo30 <achoo30@bloomberg.net> update proto to support metadata (#1174) Signed-off-by: achoo30 <achoo30@bloomberg.net> Update to golang-1.26.4 and update golang.org/x/net to 0.55.0 (#1154) Signed-off-by: Fred Dafunk <bloomenergyguy@gmail.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: bound cluster pipeline parallelism (#1149) * redis: bound cluster pipeline parallelism Signed-off-by: dthuynh <dthuynh@axon.com> * Refactor to address comment: use gRPC request context in PipeDo, cap the parallelism to RedisPoolSize Signed-off-by: dthuynh <dthuynh@axon.com> --------- Signed-off-by: dthuynh <dthuynh@axon.com> Co-authored-by: dthuynh <dthuynh@axon.com> fix: correct typos in memcache error messages and variable name (#1150) Signed-off-by: Immanuel Tikhonov <pchpr.00@list.ru> Signed-off-by: immanuwell <pchpr.00@list.ru> Update to golang 1.26.3 (#1152) Co-authored-by: collin-lee <collin.lee@salesforce.com> Add quota mode to rate limit descriptor proto (#1148) feat: add retry in init phase instead of panic directly (#1144) * feat: add retry in init phase instead of panic directly Signed-off-by: zirain <zirain2009@gmail.com> * respect signal handling for graceful shutdown Signed-off-by: zirain <zirain2009@gmail.com> * fix test Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Add integration test for quota based service selection. (#1114) Signed-off-by: Yan Avlasov <yavlasov@google.com> build: pin golang:1.26.2 to multi-arch index digest (#1131) PR #1124 updated the golang base image from 1.26.1 to 1.26.2, but the new digest sha256:7095ad02810845fa35d1fb090b8e57dd20dce4ca36b29b42951 802350d2ec90e is a single-arch (linux/amd64) image manifest rather than a multi-arch index. The previous 1.26.1 digest sha256:e2ddb153f7 86ee6210bf8c40f7f35490b3ff7d38be70d1a0d358ba64225f6428 is an OCI image index covering linux/amd64, arm64/v8, arm/v7, 386, ppc64le, riscv64, s390x and windows/amd64. When buildx is asked to produce a non-amd64 variant of the published envoyproxy/ratelimit image, the FROM line resolves to the amd64 base on every platform, so the resulting binary is amd64 regardless of the target. The multi-arch publish then stamps that amd64 binary into the arm64 layer of the released index, producing an image that fails on arm64 nodes with: exec /bin/ratelimit: exec format error Swap to the corresponding multi-arch index digest sha256:b54cbf583d39 0341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716, which contains the existing 7095ad02... amd64 manifest as one of its children plus the arm64/v8 and other platform variants. The amd64 image is unchanged; arm64 builds now produce arm64 binaries. Signed-off-by: Harrison Harris <harrison.harris@xapien.com> Co-authored-by: Harrison Harris <harrison.harris@xapien.com> Update third party libraries flagged for vulnerability scans (#1124) Signed-off-by: collin-lee <collin.lee@salesforce.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: add zipkin b3 header propagation (#1110) Fix Prometheus response time units (#1104) Dockerfile: add ENTRYPOINT (#1095) Make the docker image easier to consume. Signed-off-by: Ian Kerins <git@isk.haus> Send user defined metadata to the client (#1112) Signed-off-by: Yan Avlasov <yavlasov@google.com> build(deps): bump google.golang.org/grpc from v1.74.2 to v1.80.0 (#1111) Signed-off by: João Pereira <joao@jpereira.me> Upgrades the gRPC dependency from v1.74.2 to v1.80.0, along with its transitive dependency updates (golang.org/x/net, google.golang.org/protobuf, genproto, go-control-plane, etc.). Signed-off-by: João Pereira <joao.pereira@zwift.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Fix quota result when all limits were exceeded (#1059) * Fix quota result when all limits were exceeded Signed-off-by: yavlasov <yavlasov@google.com> * Address comments Signed-off-by: yavlasov <yavlasov@google.com> * Fix comment Signed-off-by: yavlasov <yavlasov@google.com> * fix comment Signed-off-by: yavlasov <yavlasov@google.com> * Remove log into a file Signed-off-by: yavlasov <yavlasov@google.com> --------- Signed-off-by: yavlasov <yavlasov@google.com> Update golang references to 1.26.1 (#1091) Add integration test for token based quota (#1092) Signed-off-by: yavlasov <yavlasov@google.com> Add quota integration test (#1090) Add debug logging for quota values (#1089) Wait for sevices to be up before running tests (#1088) update otel and fix failing tests (#1078) Signed-off-by: Ashish Tiwari <ashishjaitiwari15112000@gmail.com> feat: Support wildcard in non-trailing positions for rate limit descriptor values (#1085) Signed-off-by: Nam Dang <xuannam230201@gmail.com> build(deps): bump golang from 1.25.6 to 1.26.1 (#1079) Bumps golang from 1.25.6 to 1.26.1. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> bump go version 1.25.6 (#1047) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> implement quota mode for soft rate limit check (#1045) * implement quota mode for rate limit check Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix format Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix format Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix tests Signed-off-by: Dan Sun <dsun20@bloomberg.net> * fix quota mode flag Signed-off-by: Dan Sun <dsun20@bloomberg.net> --------- Signed-off-by: Dan Sun <dsun20@bloomberg.net> upgrade radix from v3 to v4 for improved pipeline handling (#1041) * feat: upgrade radix from v3 to v4 Upgrade radix Redis client from v3.8.1 to v4.1.4. Main changes: - Import paths: radix/v3 -> radix/v4 - Pool/Cluster/Sentinel use Config.New() instead of New() - All client operations require context.Context parameter - Dialer setup changed from functional options to struct config - Pipelining uses radix.NewPipeline() and Append() - Write buffering via Dialer.WriteFlushInterval Breaking from v3: - Pool on-empty behavior (WAIT/CREATE/ERROR) not available - REDIS_PIPELINE_LIMIT setting deprecated (no effect in v4) Tested with existing test suite - all tests passing. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * docs: update pipeline settings for radix v4 Update documentation to reflect radix v4's pipeline behavior: - REDIS_PIPELINE_WINDOW now sets WriteFlushInterval (auto-flush timing) - REDIS_PIPELINE_LIMIT deprecated - no effect in v4 - Add REDIS_USE_EXPLICIT_PIPELINE for manual pipeline control - Required for Redis Cluster: PIPELINE_WINDOW must be non-zero Update terminology from "implicit pipelining" to "write buffering" to better match radix v4's actual behavior. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: update tests for radix v4 - Add useExplicitPipeline parameter to test client creation - Update error assertions for v4's error message format (v4 prefixes with "response returned from Conn:") - Handle different connection errors (EOF, connection reset, broken pipe) - Update radix.FlatCmd usage for v4 API Signed-off-by: seonghyun <seonghyunoh@gmail.com> * chore: add deprecation warning for REDIS_PIPELINE_LIMIT Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: fix Redis cluster test config for radix v4 Replace deprecated RedisPipelineLimit with RedisPipelineWindow in configRedisCluster function. Radix v4 requires WriteFlushInterval (RedisPipelineWindow) for cluster mode buffering instead of the deprecated pipeline limit setting. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * style: fix gofmt struct field alignment in settings.go Signed-off-by: seonghyun <seonghyunoh@gmail.com> * fix: fail fast on unsupported REDIS_POOL_ON_EMPTY_BEHAVIOR settings Radix v4 does not support CREATE or ERROR behaviors for REDIS_POOL_ON_EMPTY_BEHAVIOR. Previously, these settings were logged as errors but the application would continue with blocking behavior, which could cause unexpected issues in production. Changes: - Panic at startup when CREATE or ERROR is detected - Prevent silent behavior changes that could cause blocking - Update tests to verify panic behavior - Improve migration documentation in comments This ensures users are immediately notified of incompatible configuration rather than experiencing unexpected blocking in production. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * fix: change REDIS_POOL_ON_EMPTY_BEHAVIOR default to WAIT The default value 'CREATE' is not supported in radix v4 and causes integration tests to panic at startup. Changed default to 'WAIT' which matches radix v4's actual pool behavior (always blocks when empty). This fixes integration test failures where tests without explicit REDIS_POOL_ON_EMPTY_BEHAVIOR settings would panic during initialization with: "REDIS_POOL_ON_EMPTY_BEHAVIOR=CREATE is not supported in radix v4" Also updated documentation to clarify that CREATE/ERROR are not supported and marked RedisPoolOnEmptyWaitDuration as deprecated. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * test: fix cluster connection timeout and context bug - Fix WaitForTcpPort to use timeoutCtx instead of ctx This ensures the timeout parameter is actually respected when dialing TCP connections. - Increase gRPC server startup timeout from 1s to 10s Radix v4 cluster connection initialization takes longer, especially when establishing connections to multiple cluster nodes. This prevents "connection refused" errors in integration tests. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: extract dialer creation logic to reduce duplication Consolidates Redis and Sentinel dialer setup into a reusable createDialer helper function, eliminating ~30 lines of duplicated code. Improves logging by including connection target details (e.g., "sentinel(master,host1,host2)") instead of generic "sentinel" string. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: remove deprecated REDIS_POOL_ON_EMPTY_WAIT_DURATION settings Remove the deprecated poolOnEmptyWaitDuration parameter and related configuration settings as they have no effect in radix v4. The pool always blocks until a connection is available when using WAIT behavior. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * refactor: auto-select pipeline mode based on Redis type Remove REDIS_USE_EXPLICIT_PIPELINE configuration option and automatically determine pipeline mode based on Redis deployment type: - Cluster mode: uses grouped pipeline (groups same-key commands) - INCRBY + EXPIRE for same key are pipelined together (same slot) - Reduces round-trips from 2 to 1 per key in cluster mode - Single/Sentinel mode: uses explicit pipeline (batches all commands) - All commands in one pipeline for minimal latency - Optimal for non-cluster deployments This simplifies configuration by removing user-facing options while automatically choosing the optimal pipeline strategy for each Redis type. Breaking changes: - Remove REDIS_USE_EXPLICIT_PIPELINE env var - Remove REDIS_PERSECOND_USE_EXPLICIT_PIPELINE env var - Remove UseExplicitPipeline() interface method Signed-off-by: seonghyun <seonghyunoh@gmail.com> * docs: remove non-existent REDIS_USE_EXPLICIT_PIPELINE from README The REDIS_USE_EXPLICIT_PIPELINE and REDIS_PERSECOND_USE_EXPLICIT_PIPELINE settings were documented in README but do not exist in settings.go. Removed the documentation to match the actual implementation. Signed-off-by: seonghyun <seonghyunoh@gmail.com> * style: fix gofmt formatting in settings.go Signed-off-by: seonghyun <seonghyunoh@gmail.com> --------- Signed-off-by: seonghyun <seonghyunoh@gmail.com> add support for response dynamic metadata (#1027) * add support for response dynamic metadata Signed-off-by: zirain <zirain2009@gmail.com> * address Colin's comment Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> fix: apply TLS and auth config to Redis Sentinel connections (#1015) * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> * fix: apply TLS and auth config to Redis Sentinel connections When using Redis Sentinel with TLS enabled, the client was failing to connect to Sentinel nodes because the TLS configuration was not being applied to the SentinelConnFunc. This caused "SSL wrong version number" errors and connection resets. This fix adds a sentinelDialFunc that properly applies: - TLS configuration (when REDIS_TLS=true) - Authentication settings (when REDIS_AUTH is set) - Connection timeout settings The fix mirrors the approach used for the main Redis connection dial function, ensuring consistent configuration across both Sentinel and data node connections. Fixes connection to Redis Sentinel over TLS. Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> --------- Signed-off-by: Stefan Kolesnikowicz <stefan@sandnetworks.com> Signed-off-by: stekole <stefan@sandnetworks.com> feat: Add Pool On-Empty Behavior Configuration for Redis Connections (#1018) * feat: Add Pool On-Empty Behavior Configuration for Redis Connections Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> * update Signed-off-by: notdu <huudutg@gmail.com> --------- Signed-off-by: notdu <huudutg@gmail.com> [ISSUE] Fix: Wildcard Stats Key Behavior Changes (#1017) * Fix: Preserve metrics for wild card Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Unify matchedWildCardKey for if-else statement Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove hasShareThreshold conditional check in non-wild-card block Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Prevent log debug to creating stats from executing twice per request Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove redundant assignment Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Fix: Remove dead code Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Refactor: unify logic to include value to stats Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: Nam Dang <xuannam230201@gmail.com> (fixes): local cache stat test fixes (#1013) * (fixes): local cache stat test fixes Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> * (fixes): invoke TestOverLimitWithStopCacheKeyIncrementWhenOverlimitConfig local cache stat tests Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> --------- Signed-off-by: Sagar Waidande <sagar10018233@gmail.com> [Proposal] Share Threshold for Wildcard Rate Limiting (#1016) * Add share_threshold to make wild card values can share rate limit threshold Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Implement lazy initilization based on reviews Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: Nam Dang <xuannam230201@gmail.com> feat: Add field to add unspecified value to metric (#996) * Add field to add unspecified value to metric Signed-off-by: xuannam230201 <xuannam230201@gmail.com> Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update README.md to pass docs_check_format check Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update format to pass pre-commit check Signed-off-by: Nam Dang <xuannam230201@gmail.com> * Update based on comments and add more unit tests Signed-off-by: Nam Dang <xuannam230201@gmail.com> --------- Signed-off-by: xuannam230201 <xuannam230201@gmail.com> Signed-off-by: Nam Dang <xuannam230201@gmail.com> Replace Alpine with Google's distroless static image for enhanced sec… (#993) * Replace Alpine with Google's distroless static image for enhanced security and simplified maintenance. Includes CA certificates automatically and provides debug variant for troubleshooting. * security: pin distroless image to SHA and use nonroot variant - Pin gcr.io/distroless/static-debian12:nonroot to specific SHA digest - Ensures deterministic builds and prevents supply chain attacks - Use nonroot variant for enhanced security (runs as UID 65532) - Follows same pattern as Envoy proxy for consistency - Update documentation to reflect security improvements feat: add connection timeout configuration for Redis operations (#987) Signed-off-by: notdu <huudutg@gmail.com> build(deps): bump google.golang.org/protobuf from 1.36.7 to 1.36.10 (#980) Bumps google.golang.org/protobuf from 1.36.7 to 1.36.10. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-version: 1.36.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump golang in /examples/xds-sotw-config-server (#981) Bumps golang from 1.24.5 to 1.25.3. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump golang from 1.24.6 to 1.25.3 (#983) Bumps golang from 1.24.6 to 1.25.3. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (#976) Bumps alpine from `1e42bbe` to `4b7ce07`. --- updated-dependencies: - dependency-name: alpine dependency-version: 4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT (#1206) * Add calendar-aligned MONTH rate limit, gated by USE_CALENDAR_MONTH_RATE_LIMIT A unit: month rate limit is computed as a fixed 60*60*24*30 second window counted from the Unix epoch, so it neither aligns with real calendar months nor accounts for months of different lengths (RDGRS-1999). Add a USE_CALENDAR_MONTH_RATE_LIMIT setting (default false) that, when enabled, buckets MONTH cache keys by UTC calendar month, sets their TTL/expiration to the actual time remaining until month end, and reports that same value as the reset duration. Defaults to false so existing MONTH limits keep their current reset behavior unless explicitly opted in. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * Trigger CI Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * docs: regenerate README TOC for new calendar-month section Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * memcached: fix expiration >30 days being misread as a Unix timestamp Memcached treats any expiration value greater than 30 days as an absolute Unix timestamp rather than a relative TTL. Calendar-aligned MONTH limits can produce a relative expiration up to 2,678,400 seconds (31-day months), which was passed straight into memcache.Item.Expiration and caused those keys to be treated as already expired. Convert the expiration to an absolute Unix timestamp whenever it would exceed memcached's 30-day relative-TTL threshold. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * test: fix call sites left out of sync by main merge The merge of main (is_negative_hits, []uint64 -> []utils.HitsAddend) into calendar-month-rate-limit (added useCalendarMonth bool param) left several test call sites using the pre-merge signatures for NewBaseRateLimit, NewRateLimitCacheImpl, and NewFixedRateLimitCacheImpl. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Signed-off-by: Kiran Malsetty <93211513+OS-kiranmalsetty@users.noreply.github.com> feat: implement is_negative_hits in rate limit descriptor (#1140) * feat: implement is_negative_hits in rate limit descriptor Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * added details to readme Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> redis: log recovery when a connection succeeds after a prior dial error (#1205) Operators currently only see repeated dial-error logs and have no explicit signal when the pool starts succeeding again. Track whether the last dial attempt failed and log once when a subsequent connection succeeds. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> Update Go references and vulnerable dependencies (#1204) * Update Go references to 1.26.5 Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> * Update vulnerable Go dependencies Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> --------- Signed-off-by: Phellippe Lima <phellippe.end@gmail.com> deps: bump x/net, x/text, x/sys to fix remaining CVEs (#1196) Follow-up to #1154 (which bumped x/net to 0.55.0). Bumps the golang.org/x dependencies to their latest patched releases to remediate the CVEs still outstanding after #1154: - golang.org/x/net v0.55.0 -> v0.57.0 (CVE-2026-46600, fixed in 0.56.0) - golang.org/x/text v0.37.0 -> v0.40.0 (CVE-2026-56852, fixed in 0.39.0) - golang.org/x/sys v0.45.0 -> v0.47.0 (already patched; kept current) No source changes required; `go build ./...` passes. Signed-off-by: Yitong Feng <yife@microsoft.com> redis: optionally close pooled connections on READONLY error replies (#1191) * redis: optionally close pooled connections on READONLY error replies After a master->replica failover in deployments that fail over by repointing an address at the new master (a Kubernetes Service, DNS, or a proxy - e.g. Redis without Sentinel, Dragonfly, KeyDB), the demoted master keeps already-established connections open. radix only discards pooled connections on IO errors, so those stale connections are reused forever and every write on them keeps failing with READONLY until the process restarts, turning a routine failover into a permanent rate limiting outage. Add an opt-in setting, REDIS_CLOSE_CONNECTION_ON_READONLY_ERROR (default false), that wraps pooled connections so a READONLY error reply strips radix's resp.ErrConnUsable wrapper. The pool then discards the connection and re-dials through the configured address, reaching the current master. The failing command still returns its error to the caller; only the connection handling changes. Applies to the main and per-second clients across single, cluster, and sentinel modes. Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> * fix README.md Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> --------- Signed-off-by: kiran malsetty <kiran.malsetty@outsystems.com> build(deps): bump docker/setup-qemu-action from 3.2.0 to 4.2.0 (#1179) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.2.0 to 4.2.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/49b3bc8e6bdd4a60e6116a5414239cba5943d3cf...96fe6ef7f33517b61c61be40b68a1882f3264fb8) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump actions/checkout from 4.1.7 to 7.0.0 (#1173) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.7 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/692973e3d937129bcbf40652eb9f2f61becf3332...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> build(deps): bump alpine in /integration-test (#1172) Bumps alpine from `4b7ce07` to `28bd5fe`. --- updated-dependencies: - dependency-name: alpine dependency-version: 28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> add metadata to rate limit descriptors pb to yaml (#1175) Signed-off-by: achoo30 <achoo30@bloomberg.net> update proto to support metadata (#1174) Signed-off-by: achoo30 <achoo30@bloomberg.net> Update to golang-1.26.4 and update golang.org/x/net to 0.55.0 (#1154) Signed-off-by: Fred Dafunk <bloomenergyguy@gmail.com> Co-authored-by: collin-lee <collin.lee@salesforce.com> feat: bound cluster pipeline parallelism (#1149) * redis: bound cluster pipeline parallelism Signed-off-by: dthuynh <dthuynh@axon.com> * Refactor to address comment: use gRPC request context in PipeDo, cap the parallelism to RedisPoolSize Signed-off-by: dthuynh <dthuynh@axon.com> --------- Signed-off-by: dthuynh <dthuynh@axon.com> Co-authored-by: dthuynh <dthuynh@axon.com> fix: correct typos in memcache error messages and variable name (#1150) Signed-off-by: Immanuel Tikhonov <pchpr.00@list.ru> Signed-off-by: immanuwell <pchpr.00@list.ru> Update to golang 1.26.3 (#1152) Co-authored-by: collin-lee <collin.lee@salesforce.com> Add quota mode to rate limit descriptor proto (#1148) feat: add retry in init phase instead of panic directly (#1144) * feat: add retry in init phase instead of panic directly Signed-off-by: zirain <zirain2009@gmail.com> * respect signal handling for graceful shutdown Signed-off-by: zirain <zirain2009@gmail.com> * fix test Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Add integration test for quota based service selection. (#1114) Signed-off-by: Yan Avlasov <yavlasov@google.com> build: pin golang:1.26.2 to multi-arch index digest (#1131) PR #1124 updated the golang base image from 1.26.1 to 1.26.2, but the new digest sha256:7095ad02810845fa35d1fb090b8e57dd20dce4ca36b29b42951 802350d2ec90e is a single-arch (linux/amd64) image manifest rather than a multi-arch index. The previous 1.26.1 digest sha256:e2ddb153f7 86ee6210bf8c40f7f35490b3ff7d38be70d1a0d358ba64225f6428 is an OCI image index covering linux/amd64, arm64/v8, arm/v7, 386, ppc64le, riscv64, s390x and windows/amd64. When buildx is asked to produce a non-amd64 variant of the published envoyproxy/ratelimit image, the FROM line resolves to the amd64 base on every platform, so the resulting binary is amd64 regardless of the target. The multi-arch publish then stamps that amd64 binary into the arm64 layer of the released index, producing an image that fails on arm64 nodes with: exec /bin/ratelimit: exec format error Swap to t…