add release note

zhaohuabing · zhaohuabing · commit 1c10359d41ef · 2026-01-27T12:09:10.000+08:00
Signed-off-by: Huabing (Robin) Zhao &lt;zhaohuabing@gmail.com&gt;
diff --git a/internal/xds/translator/httpfilters.go b/internal/xds/translator/httpfilters.go
@@ -77,14 +77,14 @@ type OrderedHTTPFilters []*OrderedHTTPFilter
 // newOrderedHTTPFilter gives each HTTP filter a rational order.
 // This is needed because the order of the filters is important.
 // For example:
-//  - the custom_response filter should be placed first to ensure it sees local replies.
-//  - the health_check filter should be placed next because external load balancer determines whether envoy should
-//    receive traffic based on the health check result which only depending on the current draining state of the envoy,
-//    result should not be affected by other filters, or else user traffic disruption may happen.
-//  - the fault filter should be placed after it because it doesn't rely on the functionality of other filters,
-//    and rejecting early can save computation costs for the remaining filters.
-//  - the cors filter should be put after that to avoid unnecessary processing of other filters for unauthorized cross-region access.
-//  - the router filter must be the last one since it's a terminal filter.
+//   - the custom_response filter should be placed first to ensure it sees local replies.
+//   - the health_check filter should be placed next because external load balancer determines whether envoy should
+//     receive traffic based on the health check result which only depending on the current draining state of the envoy,
+//     result should not be affected by other filters, or else user traffic disruption may happen.
+//   - the fault filter should be placed after it because it doesn't rely on the functionality of other filters,
+//     and rejecting early can save computation costs for the remaining filters.
+//   - the cors filter should be put after that to avoid unnecessary processing of other filters for unauthorized cross-region access.
+//   - the router filter must be the last one since it's a terminal filter.
 //
 // Important: please modify this method and set the order for the new filter
 // when adding a new filter in the HCM filter chain.
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
@@ -8,6 +8,7 @@ breaking changes: |
   Set HTTPRoute Accepted status to False when RequestMirror filter is used together with DirectResponse or RequestRedirect filters.
   Removed Accept-Encoding header from requests to backends when compression is enabled to avoid double compression issues.
   The default value `stats_tags` has been changed to improve the prometheus metrics output. Following metrics are affected: `envoy_cluster_*_rq_time_count`, `envoy_cluster_*_total_match_count`, `envoy_cluster_circuit_breakers_*_cx_open`.
+  Default HTTP filter ordering now places envoy.filters.http.custom_response at the first, which can change the behavior of local replies and header processing.
 
 # Updates addressing vulnerabilities, security flaws, or compliance requirements.
 security updates: |
