v1.38.6

Summary of changes:

• Security fixes:
  • GHSA-8vc2-jrm4-835w:
    oauth2: crash on requests without a :path header (i.e. CONNECT). The filter now rejects such requests with 400.
  • GHSA-47vj-9r25-wv5j:
    api_key_auth: crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.6
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.6/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.6/version_history/v1.38/v1.38.6
Full changelog:
v1.38.5...v1.38.6

Signed-off-by: wbpcode wbphub@gmail.com
Signed-off-by: Ryan Northey ryan@synca.io
Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com