build(deps): bump the examples-golang-network group across 1 directory with 2 updates

[dependabot]

Bumps the examples-golang-network group with 2 updates in the /golang-network/simple directory: github.com/envoyproxy/envoy and google.golang.org/protobuf.

Updates github.com/envoyproxy/envoy from 1.39.0 to 1.39.1

Release notes

Sourced from github.com/envoyproxy/envoy's releases.

v1.39.1

Summary of changes:

• Security fixes:

  • CVE-2026-73511: url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with envoy.reloadable_features.strip_path_parameters_per_segment.
  • CVE-2026-73512: http3: UAF on a specifically timed sequence of HTTP/3 frames.
  • CVE-2026-73513: http2: abnormal process termination on trailers received without the END_STREAM flag.
  • CVE-2026-73546: admin: sanitize stat names before converting them to HTML. Guarded by envoy.reloadable_features.sanitize_html_stats_names.
  • CVE-2026-73547: ext_authz: abnormal process termination on requests without a URI path (i.e. CONNECT).
  • CVE-2026-73548: http: payload sent before a generic HTTP upgrade was accepted could be interpreted as a pipelined HTTP/1 request and poison a shared upstream connection. Revert with envoy.reloadable_features.http_pause_generic_upgrade_request_body.
  • CVE-2026-73549: quic: crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters.
  • CVE-2026-73550: http2: dropped Host headers now count towards request header map size and count limits. Revert with envoy.reloadable_features.http2_track_size_of_dropped_host_header.
  • CVE-2026-73551: url normalization: strip path parameters from dot and dotdot segments (/.;, /..;) so canonicalization interprets them correctly. Applies only when normalize_path is enabled; revert with envoy.reloadable_features.strip_dotdot_segments_with_parameters.
  • CVE-2026-73552: safe_regex: switch charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with envoy.reloadable_features.re2_use_latin1_mode.
  • CVE-2026-73553: rbac: RBAC path matching now respects the route's ignore_path_parameters_in_path_matching, preventing authz bypass via appended path parameters. Revert with envoy.reloadable_features.rbac_respect_ignore_path_parameters.
  • CVE-2026-50572: ext_authz: UAF when ext_authz over HTTP causes a request to be rejected.
  • CVE-2026-48521: http3: abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3.

• Bug fixes:

  • http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped, corrupting large streamed bodies. Revert with envoy.reloadable_features.filter_manager_forward_added_data_on_continue.
  • ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
  • tls: fixed a memory leak in the OpenSSL compatibility layer where SSL_get0_peer_certificates() leaked an X509 refcount per call, preventing certificates from being freed on connection close.
  • tls: fixed a bug where OpenSSL used glibc's allocator instead of tcmalloc, operating on a separate heap and making OpenSSL allocations invisible to tcmalloc heap profiling.

Docker images: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.1 Docs: https://www.envoyproxy.io/docs/envoy/v1.39.1/ Release notes: https://www.envoyproxy.io/docs/envoy/v1.39.1/version_history/v1.39/v1.39.1 Full changelog: envoyproxy/envoy@v1.39.0...v1.39.1

Signed-off-by: Yan Avlasov yavlasov@google.com Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com Signed-off-by: Jonh Wendell jonh.wendell@redhat.com Signed-off-by: Ryan Northey ryan@synca.io

Commits

• b579d07 repo: Release v1.39.1
• 5ebdf90 ci: Remove mobile config (#47020)
• 8af74f2 release/docker: Bump container images (#47008)
• fc88d01 changelogs: Add release summary (#47017)
• e6d5fe8 Fix RBAC bypass via path parameters
• fc75d8e Include the length of dropped Host headers in HTTP/2 request header map size ...
• 3c79985 http: prevent generic upgrade connection poisoning
• fcb6637 Make path parameter stripping per segment.
• e9d6c32 Normalize dot and dotdot segments with parameters
• e7b4839 Avoid null de-reference of transport_socket_options for HTTP/3
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.