fix: bump Envoy to v1.35.11 to patch HTTP/2 DoS (CVE-2026-47774)

[shumkov]

Issue being fixed

The image is built FROM envoyproxy/envoy:v1.30.1, which is affected by GHSA-22m2-hvr2-xqc8 (CVE-2026-47774, CVSS 7.5 High).

It's an unauthenticated HTTP/2 downstream memory-exhaustion DoS:

• Cookie header bytes are buffered separately and merged after size validation, so they bypass max_request_headers_kb.
• HPACK/oghttp2 enforces limits on encoded bytes, so a small encoded header block expands to a large decoded one (amplification).

The 1.30 line is EOL — no backport exists there.

What was done

Bumped the base image FROM envoyproxy/envoy:v1.30.1 → v1.35.11.

Of the advisory's listed fix versions (1.35.11 / 1.36.7 / 1.37.3 / 1.38.1), only v1.35.11 is published upstream so far (released + pushed to Docker Hub 2026-06-03; the others have no GitHub release and aren't on Docker Hub yet — v1.38-latest still points at the vulnerable v1.38.0). It's also the smallest jump from 1.30, so the lowest config-deprecation risk. v1.35.11 is multi-arch (amd64 + arm64), matching the existing build platforms.

The hot-restart wrapper (hot-restarter.py / start_envoy.sh), the python3 install, and the entrypoint are unchanged — only the base tag moves.

⚠️ Follow-up required to actually publish the patched image

Merging this does not publish a new dashpay/envoy image — the release workflow only builds/pushes on a published GitHub release (or workflow_dispatch), deriving the tag from the release tag. A maintainer needs to cut a release tagged v1.35.11-impr.1 (or run the workflow manually with that tag) to produce dashpay/envoy:1.35.11-impr.1.

Once that image exists, the dashmate pin in dashpay/platform (dashpay/envoy:1.30.2-impr.1 → 1.35.11-impr.1) is bumped in the companion PR.

Note: the Dockerfile previously pinned v1.30.1 while the published tag was 1.30.2-impr.1 (the image tag comes from the git release tag, not FROM). Pinning FROM to exactly v1.35.11 here keeps the published version number honest.

Summary by CodeRabbit

Release Notes

• Chores
  • Updated the Docker image base to a newer version of the Envoy proxy.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 13933e00-c3ff-4224-91d3-34d754c7c9ce

📥 Commits

Reviewing files that changed from the base of the PR and between 14e7fec and 35e2477.

📒 Files selected for processing (1)

• Dockerfile

---

📝 Walkthrough

Walkthrough

The Dockerfile is updated to use a newer version of the Envoy proxy base image. The FROM directive is changed from envoyproxy/envoy:v1.30.1 to envoyproxy/envoy:v1.35.11, while all downstream build steps remain unchanged.

Changes

Envoy Version Update

Layer / File(s)	Summary
Base Envoy image version update Dockerfile	The base Docker image tag for Envoy is bumped from v1.30.1 to v1.35.11. All subsequent build steps (Python installation, script copying, and entrypoint configuration) remain unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A rabbit hops with glee so bright,
The Envoy proxy shines with light,
From thirty to thirty-five it climbs,
A version bump, not grand designs,
The container's ready, swift and lean! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: updating Envoy to v1.35.11 to address a critical HTTP/2 DoS vulnerability (CVE-2026-47774), which matches the changeset's single-line Dockerfile update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}