)]}'
{
  "commit": "a568f174877b014da2a1cd4441c73d0caeb264b1",
  "tree": "995aeded9352c952099dc5339983438fcd619be1",
  "parents": [
    "ae2161f4650b1796fe8f7d1fe35738e8d4a788e6"
  ],
  "author": {
    "name": "QUICHE team",
    "email": "quiche-dev@google.com",
    "time": "Tue Sep 29 09:32:54 2026 -0700"
  },
  "committer": {
    "name": "Copybara-Service",
    "email": "copybara-worker@google.com",
    "time": "Tue Sep 29 09:33:44 2026 -0700"
  },
  "message": "Enable envoy.reloadable_features.http2_reject_frames_after_end_stream and remove the http2_reject_half_closed_remote flag.\n\nThe fix for b/514675798 exists in two layers:\n\n* `OgHttp2Session` (cl/934350045): a `HEADERS` or `DATA` frame on a half-closed (remote) stream is a stream error, so oghttp2 sends `RST_STREAM(STREAM_CLOSED)` (RFC 9113 Section 5.1). This was guarded by `quiche_reloadable_flag_http2_reject_half_closed_remote` and stripped from the QUICHE export.\n* Envoy `Http::Http2::ConnectionImpl` (upstream PR #47507): the same frames are treated as a connection-level protocol error. This is guarded by `envoy.reloadable_features.http2_reject_frames_after_end_stream`.\n\nThe upstream Envoy tests assumed the second behavior on both codecs. With the oghttp2 check in place they failed on oghttp2, which is why the runtime guard was disabled in google3.\n\nThis CL:\n\n* Makes the `OgHttp2Session` check unconditional and removes the QUICHE flag, code counts and `quiche:google3` markers so it is exported to OSS QUICHE. oghttp2 users outside Envoy keep the protection, and the `HalfClosedRemote*` tests in `oghttp2_session_test.cc` are kept.\n* Moves the `gfe2_reloadable_flag_http2_reject_half_closed_remote` config to `deprecated/`. The flag has defaulted to true since 2026-08-31, so GFE behavior does not change. GFE2 code counts were zero (b/514675798#comment16).\n* Enables `envoy.reloadable_features.http2_reject_frames_after_end_stream` (`RUNTIME_GUARD`) and removes the Copybara transforms that disabled it and its tests.\n* Replaces `b514675798-reject-half-closed-remote.patch` with `b514675798-codec-aware-end-stream-tests.patch`. This patch makes the `*AfterEndStream` tests in `http2_integration_test.cc` accept either a connection-level protocol error (nghttp2) or `RST_STREAM(STREAM_CLOSED)` (oghttp2), and adds `DownstreamRequestHeadersAfterEndStream`. It covers the same scenarios as the removed `Http2HalfClosedRemoteTest`. The change is upstreamed in https://github.com/envoyproxy/envoy/pull/47816; remove the patch once that is imported.\n\nTested: `http2_integration_test` `*AfterEndStream*` (3 runs each) with the oghttp2 check enabled, and with it disabled to simulate current OSS QUICHE; `oghttp2_session_test`.\nPiperOrigin-RevId: 990357353\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ad2f3487f7c8abe2caaa2b2288b7223c8d23c55d",
      "old_mode": 33188,
      "old_path": "quiche/http2/adapter/oghttp2_session.cc",
      "new_id": "c2d083bd87944024b338a4edf71d1d6cf81f27cc",
      "new_mode": 33188,
      "new_path": "quiche/http2/adapter/oghttp2_session.cc"
    },
    {
      "type": "modify",
      "old_id": "bd7798f0cf042d94a25a85eede8f9ca103a2f62e",
      "old_mode": 33188,
      "old_path": "quiche/http2/adapter/oghttp2_session_test.cc",
      "new_id": "a0757b3499c973e313163ed8c439256cb1f9e98d",
      "new_mode": 33188,
      "new_path": "quiche/http2/adapter/oghttp2_session_test.cc"
    }
  ]
}