Notice to all users

This release contains a security fix that changes the behavior of header parsing in the gateway. As part of fixing #7281, the decision was made to stop automatically adding client headers with the Grpc-Metadata- prefix into the grpc metadata by default. This behavior can be restored using the new mux option WithLegacyHeaderMatching. See https://grpc-ecosystem.github.io/grpc-gateway/docs/operations/security_considerations/#request-headers-become-grpc-metadata-under-a-prefix for more information.

Changes

• reject non-decimal float spellings in query and path params by @itecz26 in #7512
• docs: link example repositories in README by @wangyusheng1985 in #7517
• docs: update outdated local proxy documentation (#912) by @Asthenia0412 in #7521
• reject field[key] syntax for non-map fields in query params by @itecz26 in #7522
• keep remote address in x-forwarded-for when a client value is invalid by @itecz26 in #7531
• let WithMetadata annotators override client-forwarded metadata by @itecz26 in #7532
• try GET first for path length fallback so it isn't lost to map order by @cvas22 in #7535
• runtime: make strict deep wildcard matching a ServeMux option by @movsb in #7533
• apply middlewares to health endpoint regardless of option order by @cvas22 in #7537
• keep the Authorization header first in authorization metadata by @itecz26 in #7540
• accept form content types with parameters in the path length fallback by @spicysharkco in #7538
• keep matching other patterns when the last segment is a bare verb by @cvas22 in #7539
• fix(openapiv3): skip bindings with methods OpenAPI 3.1 can't describe by @LuisFigueroaG in #7505
• feat(openapiv3): add allow_delete_body option by @LuisFigueroaG in #7506
• openapiv2: allow any item type in google.protobuf.ListValue schema by @cvas22 in #7551
• don't add an empty path to the field mask for an empty request body by @cvas22 in #7552
• Use the httprule parser for openapiv2 path templates by @anyingiit in #7562
• Update dependency node to v24 by @renovate[bot] in #7543
• fix(gengateway): quote custom HTTP methods without a net/http constant by @LuisFigueroaG in #7575
• fix(openapiv3): emit google.protobuf.NullValue fields as null by @ybai08 in #7541
• fix(openapiv3): describe server-streaming responses as stream chunks by @ybai08 in #7577
• avoid quadratic path building for nested structs in field masks by @itecz26 in #7544
• protoc-gen-openapiv2: keep custom ref targets in the naming cache by @pujitha24 in #7560
• fix(gengateway): use the embedded field name for response_body types by @LuisFigueroaG in #7578
• reject duplicate map keys in jsonpb non-proto decoder by @itecz26 in #7561
• return io.EOF from drained ProtoMarshaller decoder by @itecz26 in #7567
• fix(openapiv3): omit oneof siblings of path and body fields from query parameters by @ybai08 in #7579
• ignore query keys naming the parent of a path-bound field by @itecz26 in #7582
• fix(openapiv2): don't put the schema type in format for json_schema types by @LuisFigueroaG in #7585
• fix(runtime): parse an empty FieldMask query parameter as an empty mask by @LuisFigueroaG in #7586
• fix(descriptor): skip additional_bindings without an HTTP pattern by @LuisFigueroaG in #7588
• fix(openapiv2): apply file-level responses to HEAD and OPTIONS operations by @LuisFigueroaG in #7592
• drop Grpc-Metadata forwarding from DefaultHeaderMatcher by @itecz26 in #7590

New Contributors

• @wangyusheng1985 made their first contribution in #7517
• @Asthenia0412 made their first contribution in #7521
• @cvas22 made their first contribution in #7535
• @spicysharkco made their first contribution in #7538
• @anyingiit made their first contribution in #7562
• @ybai08 made their first contribution in #7541

Full Changelog: v2.32.0...v2.33.0