repo: Release v1.34.3

**Summary of changes**:

* TLS:
  - Fixed incorrectly cached connection properties on TLS connections that could cause network RBAC filters to fail.

* HTTP/2:
  - Fixed connection window buffer leak in oghttp2 that could cause connections to get stuck.

* Observability:
  - Fixed division by zero bug in Dynatrace sampling controller.

* Release:
  - Fixed permissions for distroless config directory.
  - Updated container images (Ubuntu/distroless).

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.34.3
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.34.3/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.34.3/version_history/v1.34/v1.34.3
**Full changelog**:
    envoyproxy/envoy@v1.34.2...v1.34.3

Author: publish-envoy[bot]

VERSION.txt

@@ -1 +1 @@
-1.34.3-dev
+1.34.3

changelogs/1.31.10.yaml

@@ -0,0 +1,10 @@
+date: July 18, 2025
+
+bug_fixes:
+- area: release
+  change: |
+    Container (Ubuntu/distroless) updates, and fixed permissions for distroless config directory.
+- area: dynatrace
+  change: |
+    Fixed a division by zero bug in the Dynatrace sampling controller that occurred when ``total_wanted`` was less than
+    ``top_k_size``. The calculation was refactored to avoid the intermediate division that could result in zero.

changelogs/1.32.8.yaml

@@ -0,0 +1,10 @@
+date: July 18, 2025
+
+bug_fixes:
+- area: release
+  change: |
+    Container (Ubuntu/distroless) updates, and fixed permissions for distroless config directory.
+- area: dynatrace
+  change: |
+    Fixed a division by zero bug in the Dynatrace sampling controller that occurred when ``total_wanted`` was less than
+    ``top_k_size``. The calculation was refactored to avoid the intermediate division that could result in zero.

changelogs/1.33.5.yaml

@@ -0,0 +1,17 @@
+date: July 18, 2025
+
+bug_fixes:
+- area: tls
+  change: |
+    Fixed an issue with incorrectly cached connection properties on TLS connections.
+    If TLS connection data was queried before it was available, an empty value was being incorrectly cached, preventing later calls from
+    getting the correct value. This could be triggered with a ``tcp_proxy`` access log configured to emit a log upon connection
+    establishment if the log contains fields of the the TLS peer certificate. Then a later use of the data, such as the network RBAC
+    filter validating a peer certificate SAN, may incorrectly fail due to the empty cached value.
+- area: release
+  change: |
+    Container (Ubuntu/distroless) updates, and fixed permissions for distroless config directory.
+- area: dynatrace
+  change: |
+    Fixed a division by zero bug in the Dynatrace sampling controller that occurred when ``total_wanted`` was less than
+    ``top_k_size``. The calculation was refactored to avoid the intermediate division that could result in zero.

changelogs/current.yaml

@@ -1,13 +1,6 @@
-date: Pending
-
-behavior_changes:
-# *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
-
-minor_behavior_changes:
-# *Changes that may cause incompatibilities for some users, but should not for most*
+date: July 18, 2025
 
 bug_fixes:
-# *Changes expected to improve the state of the world and are unlikely to have negative effects*
 - area: tls
   change: |
     Fixed an issue with incorrectly cached connection properties on TLS connections.
@@ -25,10 +18,3 @@ bug_fixes:
   change: |
     Fixed a division by zero bug in the Dynatrace sampling controller that occurred when ``total_wanted`` was less than
     ``top_k_size``. The calculation was refactored to avoid the intermediate division that could result in zero.
-
-removed_config_or_runtime:
-# *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
-
-new_features:
-
-deprecated:

docs/inventories/v1.31/objects.inv

@@ -24,7 +24,7 @@
 "1.28": 1.28.7
 "1.29": 1.29.12
 "1.30": 1.30.11
-"1.31": 1.31.9
-"1.32": 1.32.7
-"1.33": 1.33.4
-"1.34": 1.34.1
+"1.31": 1.31.10
+"1.32": 1.32.8
+"1.33": 1.33.5
+"1.34": 1.34.2