Security
- CVE-2026-47879 — Spring Cloud Gateway SSRF and native file access with gRPC
What's Changed
- Fix WebMvc PerserveHostHeader so it matches Webflux by @ryanjbaxter in #4213
- GH-3791: Document AdaptCachedBody filter for Spring Cloud Gateway WebMVC by @won-seoop in #4197
- GH-3885: Document Spring Security integration for WebFlux and WebMVC gateways by @won-seoop in #4198
- GH-1949: Document that overriding discovery locator filters replaces defaults by @won-seoop in #4199
- GH-4024: Add documentation for the Version Route Predicate Factory by @won-seoop in #4205
- GH-3168: Document that @LoadBalanced RestClient must not be used in Gateway MVC by @won-seoop in #4200
- docs: update gateway grafana dashboard by @imanabr77 in #4215
- Bump actions/checkout from 6 to 7 by @dependabot[bot] in #4219
- Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in #4221
- Add MVC retry backoff support by @goutamadwant in #4225
- Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #4241
- Exclude release-train workflows from Dependabot updates by @ryanjbaxter in #4252
- Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in #4253
- Fix ordering in test by @ryanjbaxter in #4255
- Add missing test scope to spring-boot-resttestclient by @timpeeters in #4257
- Add warn logging when WebSocket message receive fails by @fru1tworld in #4134
- Avoid draining failed streaming proxy responses by @goutamadwant in #4217
New Contributors
- @won-seoop made their first contribution in #4197
- @imanabr77 made their first contribution in #4215
- @goutamadwant made their first contribution in #4225
- @timpeeters made their first contribution in #4257
Full Changelog: v5.0.2...v5.0.3