 These security fixes were not available at the time of our previous security release, and we considered the control plane gRPC surface to be harder to exploit.</p><p>You can find the gRPC vulnerability fix description on their mailing list (c.f.
<a href=https://groups.google.com/forum/#!topic/grpc-io/w5jPamxdda4>HTTP/2 Security Vulnerabilities</a>).</p><h2 id=bug-fix>Bug fix</h2><ul><li>Fix an Envoy bug that breaks <code>java.net.http.HttpClient</code> and other clients that attempt to upgrade from <code>H