diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 7bdf62eb5..ec848b6b3 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "784c2432a984735c485a17dc3d2b5e021b4e44c2"
-ENVOY_SHA = "d6f6c9f2c9507092456b60581bc26c576aab81364383dae3f30b30e2a4c34a4c"
+ENVOY_COMMIT = "c8c459d3da9ef0cd02e5bd8dd05bd278614a3306"
+ENVOY_SHA = "514f70c62c740dd0576c2da6177c81d195b81bd1132df384e308b04defc60e30"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.8"  # June 18th, 2025
 HDR_HISTOGRAM_C_SHA = "bb95351a6a8b242dc9be1f28562761a84d4cf0a874ffc90a9b630770a6468e94"
diff --git a/source/client/flush_worker_impl.h b/source/client/flush_worker_impl.h
index 42ec887c9..4cd865914 100644
--- a/source/client/flush_worker_impl.h
+++ b/source/client/flush_worker_impl.h
@@ -10,6 +10,7 @@
 #include "envoy/stats/sink.h"
 #include "envoy/stats/store.h"
 #include "envoy/thread_local/thread_local.h"
+#include "envoy/upstream/cluster_manager.h"
 
 #include "source/common/worker_impl.h"
 
diff --git a/tools/base/requirements.txt b/tools/base/requirements.txt
index 4678d2a3b..cb3e3fb54 100644
--- a/tools/base/requirements.txt
+++ b/tools/base/requirements.txt
@@ -12,9 +12,9 @@ attrs==26.1.0 \
     --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \
     --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32
     # via -r tools/base/requirements.in
-certifi==2026.5.20 \
-    --hash=sha256:3c52e209ba0a4ad7aebe60436a4ab349c39e1e602e8c134221e546902ad25897 \
-    --hash=sha256:69dea482ab64caa7b9f6aba1c6bf48bb6a5448d1c0f1b17ab42ad8c763a5344d
+certifi==2026.6.17 \
+    --hash=sha256:024c88eeec92ca068db80f02b8b07c9cef7b9fe261d1d535abfd5abd6f6af432 \
+    --hash=sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
     # via
     #   -r tools/base/requirements.in
     #   requests
@@ -261,9 +261,9 @@ pygments==2.20.0 \
     --hash=sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f \
     --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
     # via pytest
-pytest==9.1.0 \
-    --hash=sha256:41dd9148c08072446394cefd3d79701701335a9f4cae69ba92e39f6c7f5c061c \
-    --hash=sha256:8ebb0e7888bdf2bdfc602ec51f8f62d50200af37356c74e503c79a94f5c81f32
+pytest==9.1.1 \
+    --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \
+    --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
     # via
     #   -r tools/base/requirements.in
     #   pytest-dependency
diff --git a/tools/code_format/config.yaml b/tools/code_format/config.yaml
index 0c40106d2..4f82fad5e 100644
--- a/tools/code_format/config.yaml
+++ b/tools/code_format/config.yaml
@@ -171,12 +171,16 @@ paths:
     - source/extensions/common/wasm
     - source/extensions/config/validators/minimum_clusters/minimum_clusters_validator.cc
     - source/extensions/config_subscription
+    - source/extensions/content_parsers/json/config.cc
+    - source/extensions/content_parsers/json/json_content_parser_impl.cc
     - source/extensions/compression/zstd/common/dictionary_manager.h
     - source/extensions/filters/http/adaptive_concurrency/controller
+    - source/extensions/filters/http/admission_control/config.cc
     - source/extensions/filters/http/basic_auth
     - source/extensions/filters/http/cache
     - source/extensions/filters/http/common
     - source/extensions/filters/http/composite
+    - source/extensions/filters/http/dynamic_modules/factory.cc
     - source/extensions/filters/http/ext_authz
     - source/extensions/filters/http/ext_proc
     - source/extensions/filters/http/file_system_buffer
@@ -252,6 +256,8 @@ paths:
   # Files in these paths can use Protobuf::util::JsonStringToMessage
   json_string_to_message:
     include:
+    - source/common/jwt/jwt.cc
+    - source/common/jwt/jwks.cc
     - source/common/protobuf/utility.cc
     - source/common/protobuf/protobuf.h
     - source/common/protobuf/yaml_utility.cc
@@ -296,11 +302,13 @@ paths:
     - source/common/common/utility.h
     - source/common/event/real_time_system.cc
     - source/common/event/real_time_system.h
+    - source/common/jwt/simple_lru_cache_inl.h
     - source/exe/main_common.cc
     - source/exe/main_common.h
     - source/extensions/common/aws/utility.cc
     - source/server/config_validation/server.cc
     - test/common/common/log_macros_test.cc
+    - test/common/jwt/simple_lru_cache_test.cc
     - test/common/protobuf/utility_test.cc
     - test/integration/integration.h
     - test/test_common/simulated_time_system.cc
@@ -355,8 +363,6 @@ paths:
   # Files in these paths can use std::regex
   std_regex:
     include:
-    - contrib/squash/filters/http/source/squash_filter.h
-    - contrib/squash/filters/http/source/squash_filter.cc
     - source/common/common/regex.h
     - source/common/common/regex.cc
     - source/common/common/utility.cc
@@ -479,6 +485,7 @@ visibility_excludes:
 - source/extensions/clusters/original_dst/
 - source/extensions/clusters/logical_dns/
 - source/extensions/clusters/dns/
+- source/extensions/dynamic_modules/
 - source/extensions/early_data/BUILD
 - source/extensions/filters/http/buffer/BUILD
 - source/extensions/filters/network/common/BUILD