repo: Release v1.37.0

## Summary of changes

### Dynamic modules expansion
- Added support for network, listener, UDP listener, and access logger filters
- Introduced streaming HTTP callouts to HTTP filters
- Enhanced ABI for streaming body manipulation and header operations
- Added global module loading and improved module search path handling

### HTTP and protocol enhancements
- Container-aware CPU detection for improved resource utilization in containerized environments
- HTTP/2 performance optimizations including reduced allocations for well-known headers
- Enhanced cookie matching in route configuration
- Added vhost header customization and forward client cert matching via xDS matcher

### Filter ecosystem growth
- New transform filter for request/response body modification
- New MCP (Model Context Protocol) filter and router for agentic network
- Network-layer geoip filter for non-HTTP geolocation
- Postgres Inspector listener filter for PostgreSQL traffic routing

### Security and authorization
- Proto API Scrubber filter now production-ready with comprehensive metrics
- Enhanced ext_authz with error response support and improved header handling
- Better TLS certificate validation failure messages in access logs
- On-demand certificate fetching via SDS

### Composite filter improvements
- Support for filter chains and named filter chains
- Improved scalability through filter chain reuse across match actions

### Observability
- New stats-based access logger
- Process-level rate limiting for access logs
- Enhanced OTLP stats sink with metric dropping support
- Added execution counters and improved tracing support across filters

### Router and traffic management
- Cluster-level retry policies, hash policies, and request mirroring
- Composite cluster extension for retry-aware cluster selection
- Substitution formatting for direct response bodies and descriptor values

### Other notable changes
- Fixed multiple memory leaks and crashes in HTTP/2, Lua, and connection handling
- Improved QUIC path migration using QUICHE logic
- Enhanced TCP proxy with upstream connect mode and early data buffering
- Added MaxMind Country database support for geoip

## Breaking changes

- Changed default HTTP reset code from `NO_ERROR` to `INTERNAL_ERROR`
- Changed reset behavior to ignore upstream protocol errors by default
- Proto API Scrubber now returns `404 Not Found` instead of `403 Forbidden` for blocked methods
- Removed multiple runtime guards and legacy code paths

## Deprecations

- OpenTelemetry access log `common_config` field deprecated in favor of explicit `http_service`/`grpc_service` configuration

-----

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.37.0
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.37.0/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.37.0/version_history/v1.37/v1.37.0
**Full changelog**:
    v1.36.0...v1.37.0

Signed-off-by: Ryan Northey <ryan@synca.io>

Author: publish-envoy[bot]

VERSION.txt

@@ -1 +1 @@
-1.37.0-dev
+1.37.0

changelogs/current.yaml

@@ -1,7 +1,6 @@
-date: Pending
+date: January 13, 2026
 
 behavior_changes:
-# *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
 - area: server
   change: |
     Added container-aware CPU detection on Linux that respects cgroup CPU limits alongside hardware thread count
@@ -36,7 +35,6 @@ behavior_changes:
     ``404 Not Found`` (gRPC ``NOT_FOUND``) to prevent method enumeration.
 
 minor_behavior_changes:
-# *Changes that may cause incompatibilities for some users, but should not for most*
 - area: router
   change: |
     Added :ref:`host_rewrite <envoy_v3_api_field_config.route.v3.RouteAction.host_rewrite>` and
@@ -126,7 +124,6 @@ minor_behavior_changes:
     populated in access logs even for connections that fail during the subsequent TLS handshake processing.
 
 bug_fixes:
-# *Changes expected to improve the state of the world and are unlikely to have negative effects*
 - area: proxy_protocol
   change: |
     Fixed a bug where Envoy incorrectly removed PROXY protocol v2 TLVs if there were multiple TLVs with the same key. See
@@ -245,7 +242,6 @@ bug_fixes:
     ``proto_api_scrubber_FAILED_PRECONDITION`` instead of terminating the process.
 
 removed_config_or_runtime:
-# *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
 - area: http
   change: |
     Removed runtime guard ``envoy.reloadable_features.http1_balsa_disallow_lone_cr_in_chunk_extension``