release: v0.7.0 release notes (envoyproxy#2177)

**Description**
New Features

Multi-Tenant Hostname Routing
- AIGatewayRoute gains a hostnames field enabling hostname-based model
scoping — serve different model catalogs per tenant from a single
Gateway
- /v1/models automatically scopes its response to models matching the
request's Host header
- Wildcard hostnames (*.ai.example.com) supported via Gateway API
hostname matching rules
Provider Translation
- Anthropic → AWS Bedrock Converse — new translator path lets
Anthropic-native clients reach Bedrock without switching protocols
(text, images, tool use, thinking, streaming)
- Anthropic → OpenAI reasoning & image support — thinking/reasoning
blocks and image content no longer silently dropped during translation
- Claude Opus 4.7 reasoning — display parameter (summarized/omitted),
xhigh effort tier, and claude-mythos-preview model recognition
- Anthropic prefix support — VersionedAPISchema.prefix now works for
Anthropic backends (e.g., /{prefix}/messages)
- anthropic-beta header forwarding — mapped into anthropic_beta body
field for AWSAnthropic backends
OpenAI API Compatibility
- Audio transcription & translation — full data-plane support for
/v1/audio/transcriptions and /v1/audio/translations (Whisper endpoints,
multipart/form-data)
- Azure OpenAI Responses API — /v1/responses routes to Azure's
/openai/responses?api-version=... path
- audio_url and video_url content types — multimodal audio/video inputs
for compatible backends (vLLM, phi-4-mm, Qwen 3.5)
Quota-Aware Routing
- Backend rate limit filter injection for QuotaPolicy — first runtime
enforcement: controller injects a backend rate limit filter when a
QuotaPolicy is attached to an AIServiceBackend
MCP Gateway
- Authorization-filtered tools/list — omits tools the caller isn't
authorized to invoke, preventing tool discovery leaks
Observability
- Smarter log redaction — developer-authored metadata (tool
descriptions, function names, JSON schemas) visible in debug logs; user
content and AI-generated text remain redacted
API Changes
- AIGatewayRoute.spec.hostnames — new optional field for hostname-based
request filtering
- AIGatewayRoute.spec.rules capped at 15 (down from 128) to match
Gateway API HTTPRoute limits
- VersionedAPISchema.prefix extended to Anthropic backends
- QuotaPolicy now has runtime enforcement (backend rate limit filter
injection)
Bug Fixes
- SSE parser handles data:{json} (no space after colon)
- Responses API streaming: buffer incomplete SSE events across response
body chunks
- Responses API: capture token usage from response.incomplete and
response.failed events
- Nil-pointer guard in AWS Bedrock response translator (HTTP 200 with no
output field)
- Comprehensive Gemini finish-reason mapping (previously everything fell
through to content_filter)
- GCP Vertex AI streaming: emit empty delta object instead of omitting
it
- Responses API: handle typeless assistant output messages (e.g., from
OpenCode)
Docs
- Proposal: MCPBackend CRD (envoyproxy#2144)
- Proposal: OAuth 2.0 Token Exchange as Upstream Auth for MCP Backends
(envoyproxy#2052)
CI
- contents:write permission declared on Release workflow's release job
(envoyproxy#2139)

---------

Signed-off-by: achoo30 <achoo30@bloomberg.net>
Signed-off-by: Erica Hughberg <erica.sundberg.90@gmail.com>
Co-authored-by: Erica Hughberg <erica.sundberg.90@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: saixso <sai.soundararajan@spoton.com>

Author: 3 people

.claude/commands/release-notes

@@ -1 +1 @@
-1.37.0
+1.38.1

.envoy-version

@@ -212,8 +212,8 @@ jobs:
         include:
           - name: latest
             envoy_gateway_version: v0.0.0-latest
-          - name: v1.6.2
-            envoy_gateway_version: v1.6.2
+          - name: v1.8.1
+            envoy_gateway_version: v1.8.1
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
@@ -270,7 +270,7 @@ jobs:
       - run: make test-e2e-upgrade
         env:
           # We only need to test the upgrade from the latest stable version of EG.
-          EG_VERSION: v1.6.0
+          EG_VERSION: v1.8.1
           K8S_VERSION: ${{ matrix.k8s-version }}
 
   test_e2e_inference_extension:
@@ -299,7 +299,7 @@ jobs:
       - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       - run: make test-e2e-inference-extension
         env:
-          EG_VERSION: v1.6.0
+          EG_VERSION: v1.8.1
 
   test_e2e_namespaced:
     needs: changes
@@ -329,7 +329,7 @@ jobs:
         env:
           # We only need to test with the latest stable version of EG, since these e2e tests
           # do not depend on the EG version.
-          EG_VERSION: v1.6.0
+          EG_VERSION: v1.8.1
 
   test_e2e_aigw:
     needs: changes

.github/workflows/build_and_test.yaml

@@ -84,7 +84,12 @@ Each non-patch release should start with Release Candidate (RC) phase as follows
    Pushing a tag will trigger the pipeline to build the release candidate image and the helm chart tagged with the release candidate tag.
    The release candidate image will be available in the Docker Hub.
 
-4. The release candidate should be tested by the maintainers and the community. If there is any issue, the issue should be fixed in the main branch
+4. Generate the release notes using the Claude Code `/release-notes` command (defined in `.claude/commands/release-notes`).
+   This command analyzes commits since the last release, verifies features against the actual code, and generates
+   the release notes JSON data file, MDX page, plain-markdown copy, and navigation updates for the docs site.
+   Review the generated output and make any necessary adjustments.
+
+5. The release candidate should be tested by the maintainers and the community. If there is any issue, the issue should be fixed in the main branch
    and the new rc tag should be created. For example, if there is an issue in the release candidate v0.50.0-rc1, replace `v0.50.0-rc1` with `v0.50.0-rc2`
    in the above command and repeat the process.
 

RELEASES.md

@@ -17,7 +17,7 @@ import (
 // This matches the version in the .envoy-version file at the repo root. That is ensured in tests.
 // The reason why we don't use the constant defined in the EG as a library is that when we depend
 // on the main branch, it will be a non-released development version that func-e may not have.
-const envoyVersion = "1.37.0"
+const envoyVersion = "1.38.1"
 
 // downloadEnvoy downloads the Envoy binary used by Envoy Gateway.
 func downloadEnvoy(ctx context.Context, funcERun func_e_api.RunFunc, tmpDir, dataHome string, stdout, stderr io.Writer) error {

cmd/aigw/download_envoy.go

@@ -1,7 +1,7 @@
 module github.com/envoyproxy/ai-gateway
 
 // Explicitly specify the Go patch version to be able to purge the CI cache correctly.
-go 1.26.2
+go 1.26.4
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1
@@ -18,10 +18,10 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/cohere-ai/cohere-go/v2 v2.18.0
 	github.com/coreos/go-oidc/v3 v3.18.0
-	github.com/envoyproxy/gateway v1.7.0
-	github.com/envoyproxy/go-control-plane v0.14.0
-	github.com/envoyproxy/go-control-plane/envoy v1.37.0
-	github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20260131204543-4ca8b9cded3e
+	github.com/envoyproxy/gateway v1.8.1
+	github.com/envoyproxy/go-control-plane v0.14.1-0.20260409050421-3f47accd6e14
+	github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260409050421-3f47accd6e14
+	github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20260409050421-3f47accd6e14
 	github.com/go-logr/logr v1.4.3
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/cel-go v0.28.1
@@ -53,7 +53,7 @@ require (
 	go.opentelemetry.io/proto/otlp v1.10.0
 	go.uber.org/goleak v1.3.0
 	go.uber.org/zap v1.28.0
-	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.20.0
 	golang.org/x/tools v0.45.0
@@ -70,8 +70,9 @@ require (
 	k8s.io/client-go v0.36.1
 	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
 	sigs.k8s.io/controller-runtime v0.24.1
-	sigs.k8s.io/gateway-api v1.4.1
+	sigs.k8s.io/gateway-api v1.5.1
 	sigs.k8s.io/gateway-api-inference-extension v1.0.2
+	sigs.k8s.io/gateway-api/conformance v1.5.1
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -114,26 +115,25 @@ require (
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/containers/image/v5 v5.36.2 // indirect
 	github.com/containers/storage v1.59.1 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v29.2.0+incompatible // indirect
+	github.com/docker/cli v29.4.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v28.5.2+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.4 // indirect
+	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dominikbraun/graph v0.23.0 // indirect
 	github.com/ebitengine/purego v0.10.0 // indirect
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
-	github.com/envoyproxy/go-control-plane/contrib v1.36.1-0.20260115164926-066cbd5b3989 // indirect
+	github.com/envoyproxy/go-control-plane/contrib v1.36.1-0.20260409050421-3f47accd6e14 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
-	github.com/envoyproxy/ratelimit v1.4.1-0.20230427142404-e2a87f41d3a7 // indirect
+	github.com/envoyproxy/ratelimit v1.4.1-0.20260122083618-3fb702589d36 // indirect
 	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -143,25 +143,25 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-openapi/analysis v0.24.1 // indirect
-	github.com/go-openapi/errors v0.22.4 // indirect
-	github.com/go-openapi/jsonpointer v0.22.4 // indirect
-	github.com/go-openapi/jsonreference v0.21.4 // indirect
-	github.com/go-openapi/loads v0.23.2 // indirect
-	github.com/go-openapi/spec v0.22.3 // indirect
-	github.com/go-openapi/strfmt v0.25.0 // indirect
+	github.com/go-openapi/analysis v0.24.3 // indirect
+	github.com/go-openapi/errors v0.22.7 // indirect
+	github.com/go-openapi/jsonpointer v0.22.5 // indirect
+	github.com/go-openapi/jsonreference v0.21.5 // indirect
+	github.com/go-openapi/loads v0.23.3 // indirect
+	github.com/go-openapi/spec v0.22.4 // indirect
+	github.com/go-openapi/strfmt v0.26.1 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
-	github.com/go-openapi/swag/conv v0.25.4 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.1 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
-	github.com/go-openapi/swag/loading v0.25.4 // indirect
-	github.com/go-openapi/swag/mangling v0.25.1 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
-	github.com/go-openapi/validate v0.25.1 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-openapi/swag/conv v0.25.5 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.5 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
+	github.com/go-openapi/swag/loading v0.25.5 // indirect
+	github.com/go-openapi/swag/mangling v0.25.5 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.5 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
+	github.com/go-openapi/validate v0.25.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
@@ -182,10 +182,9 @@ require (
 	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
-	github.com/lyft/gostats v0.4.1 // indirect
+	github.com/lyft/gostats v0.4.14 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
-	github.com/miekg/dns v1.1.72 // indirect
+	github.com/mailru/easyjson v0.9.1 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.2.0 // indirect
@@ -199,8 +198,8 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/ohler55/ojg v1.28.0 // indirect
-	github.com/oklog/ulid v1.3.1 // indirect
+	github.com/ohler55/ojg v1.28.1 // indirect
+	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
@@ -231,12 +230,11 @@ require (
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
-	github.com/yuin/gopher-lua v1.1.1 // indirect
+	github.com/yuin/gopher-lua v1.1.2 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.etcd.io/etcd/api/v3 v3.6.8 // indirect
 	go.etcd.io/etcd/client/pkg/v3 v3.6.8 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.8 // indirect
-	go.mongodb.org/mongo-driver v1.17.6 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/bridges/prometheus v0.68.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
@@ -281,7 +279,7 @@ require (
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/kubectl-validate v0.0.5-0.20250915070809-d2f2d68fba09 // indirect
-	sigs.k8s.io/mcs-api v0.3.0 // indirect
+	sigs.k8s.io/mcs-api v0.4.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
 )