Requires Go 1.25 or later (previously Go 1.24).
Security and behavior changes
- RPC authentication: reject unknown apps and Redis lookup failures regardless of
StrictControl, which is now deprecated. (#5848) - CORS: preserve origin restrictions when adding headers, replacing routers, or serving files. Wildcard origins no longer allow credentials; configure explicit trusted origins for credentialed requests. (#5867)
- JWT authentication: cap request-body reads during failure logging to prevent unbounded gzip decompression. (#5865)
Fixes
- Kubernetes discovery: exclude endpoints marked not ready, retain addresses across EndpointSlices, and clarify RBAC errors.
- File and stream readers: correct EOF, long-line, and trailing-newline handling; close redirected pipes on restore.
- Redis: make
ZaddnxFloatuseZADD NXsemantics. - Allow timer resets after draining; refresh immutable resources on every access when the interval is zero.
- Preserve YAML null values and upstream gateway
Content-Typeheaders; fix a circuit-breaker data race. - Update framework dependencies.
New Contributors
@Icarus9913, @racequite, @loveulvu, @dhy-ui, @waterWang, @guoshengfei, @kediyalua, @TastyHeadphones, @reheptin, @littfed, @lowgame, @SulimanAbdulrazzaq, @leehainuo, @fzlzjerry, @prostomarkeloff, @failsafesecurity, @amirzre, @kevin9327, @hainuoli — thank you for your first contributions! 🎉