chore(deps): update envoy 1.38.x to v1.38.5 (v1.38)

[renovate]

This PR contains the following updates:

Package	Update	Change
envoyproxy/envoy	patch	1.38.4 → 1.38.5
envoyproxy/envoy	patch	v1.38.4 → v1.38.5

---

Release Notes

envoyproxy/envoy (envoyproxy/envoy)

v1.38.5

Compare Source

repo: Release v1.38.5

Summary of changes:

• Security fixes:

  • CVE-2026-35189: tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. The BoringSSL FIPS build (--config=boringssl-fips) does not receive this patch.

• Build/packaging:

  • Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.
  • Moved Debian .changes and release checksum signing into the Bazel release assembly, with an audit of signing actions.
  • Refreshed the Ubuntu build image.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.5
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.5/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.5
Full changelog:
envoyproxy/envoy@v1.38.4...v1.38.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.