Dependencies

Envoy is mostly self-contained — the envoy-static binary statically links almost everything — but it pulls in roughly 100 third-party repositories. They're declared in bazel/repository_locations.bzl, versioned, sha-pinned, and tracked via the security scanning in tools/dependency/.

Key dependencies

Dependency	Role
BoringSSL	Crypto and TLS. Vendored, not system.
Abseil (com_google_absl)	Hash maps, strings, time, synchronisation, status types. Used pervasively.
Protobuf	Wire format and reflection for every config and xDS message.
gRPC (com_github_grpc_grpc)	Async client + server, used for xDS, ext_authz, ext_proc, gRPC stat sinks, etc.
QUICHE	The QUIC and HTTP/3 stack.
nghttp2	HTTP/2 codec.
c-ares	Async DNS resolver.
libevent	Per-worker event loop.
CEL-CPP (cel-cpp)	Common Expression Language used in matchers and access log formatters.
OpenTracing / OpenTelemetry / Jaeger / Zipkin / Datadog / SkyWalking / X-Ray libs	Tracer SDKs.
zlib, brotli, zstd	Compression filters.
HdrHistogram	Per-stat histograms.
mimalloc / tcmalloc / gperftools	Memory allocators (selected at build time).
fmtlib, spdlog	Logging.
rapidjson	JSON parsing for some legacy paths (Protobuf JSON is preferred for new code).
rules_python, rules_go, rules_apple, rules_swift, rules_jvm_external, rules_proto	Bazel rule sets.
clang_tools, llvm-toolchain	Compilers used by the build.
buildifier / buildtools	Bazel formatting.

Where deps are declared

• bazel/repository_locations.bzl — every external repo: name, version, SHA, URLs, mirror, license. About 100 entries.
• bazel/repositories.bzl — envoy_dependencies() macro that registers them.
• bazel/external/ — per-dep BUILD files that wrap external sources.
• bazel/foreign_cc/ — wrappers for non-Bazel-native projects (CMake / Make / autotools).

Each entry in repository_locations.bzl looks like:

abseil_cpp = dict(
    project_name = "Abseil",
    project_url = "https://github.com/abseil/abseil-cpp",
    version = "...",
    sha256 = "...",
    urls = ["https://github.com/abseil/abseil-cpp/archive/{version}.tar.gz"],
    strip_prefix = "abseil-cpp-{version}",
    use_category = ["controlplane", "dataplane_core"],
    release_date = "...",
    cpe = "cpe:2.3:a:abseil:abseil-cpp:*",
    license = "Apache-2.0",
    license_url = "...",
),

The use_category field is what the dependency policy enforces.

DEPENDENCY_POLICY.md

DEPENDENCY_POLICY.md lists rules:

• Every dep must be SHA-pinned.
• Every dep must declare a use_category (dataplane_core, dataplane_ext, controlplane, observability_core, observability_ext, test_only, build, api).
• Every dep must declare a CPE for the security scanner.
• Every dep must declare a license; only allowed licenses are accepted (Apache 2, BSD-2/3, MIT, ISC, MPL, CC-BY, etc. — copyleft licenses like GPL are rejected).
• Updates that change use_category or cpe need the dependencies GitHub label and security review.
• Adding a new dep needs maintainer approval. Contrib-only deps are slightly easier but still require approval.

Security scanning

tools/dependency/ runs:

• CPE-based CVE matching against NVD.
• Stale-version checks (warn when upstream has moved on).
• SBOM generation for releases.

The Dependabot bot also opens version-bump PRs (responsible for ~10% of all commits — see fun facts).

Updating a dependency

1. Edit bazel/repository_locations.bzl with new version and sha.
2. Run tools/dependency/validate.py.
3. If use_category changed, document the rationale in the PR.
4. Run the affected tests; sometimes new versions cause minor build changes.
5. Add a release note if the update fixes a CVE.

Adding a new dependency

1. Discuss in a GitHub issue first; new deps need maintainer approval.
2. Add to repository_locations.bzl and repositories.bzl.
3. Provide a BUILD wrapper in bazel/external/ if the upstream isn't Bazel-native.
4. Categorise it (use_category).
5. Provide CPE and license metadata.
6. Add maintainer for the dep in bazel/EXTERNAL_DEPS_OWNERS.md if applicable.

Vendored vs not

Most deps are downloaded at build time, not vendored. The exceptions are small embedded snippets (handful of files in source/common/quic/platform/ shimming QUICHE's platform headers) and patches in bazel/*.patch that fix issues we couldn't push upstream.

Linking modes

envoy-static is statically linked. envoy-shared (a dev-only target) builds dynamic libraries. The static linkage is what makes the binary portable across glibc versions, but it also means the binary is large.

See also

• DEPENDENCY_POLICY.md
• Build system — Bazel layout.
• envoy-static — what's linked together.