Notice to all users

This release contains a security fix that changes the behavior of header parsing in the gateway. As part of fixing #7281, the decision was made to stop automatically adding client headers with the Grpc-Metadata- prefix into the grpc metadata by default. This behavior can be restored using the new mux option WithLegacyHeaderMatching. See https://grpc-ecosystem.github.io/grpc-gateway/docs/operations/security_considerations/#request-headers-become-grpc-metadata-under-a-prefix for more information.

Changes

• reject non-decimal float spellings in query and path params by @itecz26 in #7512
• docs: link example repositories in README by @wangyusheng1985 in #7517
• docs: update outdated local proxy documentation (#912) by @Asthenia0412 in #7521
• reject field[key] syntax for non-map fields in query params by @itecz26 in #7522
• keep remote address in x-forwarded-for when a client value is invalid by @itecz26 in #7531
• let WithMetadata annotators override client-forwarded metadata by @itecz26 in #7532
• try GET first for path length fallback so it isn't lost to map order by @cvas22 in #7535
• runtime: make strict deep wildcard matching a ServeMux option by @movsb in #7533
• apply middlewares to health endpoint regardless of option order by @cvas22 in #7537
• keep the Authorization header first in authorization metadata by @itecz26 in #7540
• accept form content types with parameters in the path length fallback by @spicysharkco in #7538
• keep matching other patterns when the last segment is a bare verb by @cvas22 in #7539
• fix(openapiv3): skip bindings with methods OpenAPI 3.1 can't describe by @LuisFigueroaG in #7505
• feat(openapiv3): add allow_delete_body option by @LuisFigueroaG in #7506
• openapiv2: allow any item type in google.protobuf.ListValue schema by @cvas22 in #7551
• don't add an empty path to the field mask for an empty request body by @cvas22 in #7552
• Use the httprule parser for openapiv2 path templates by @anyingiit in #7562
• Update dependency node to v24 by @renovate[bot] in #7543
• fix(gengateway): quote custom HTTP methods without a net/http constant by @LuisFigueroaG in #7575
• fix(openapiv3): emit google.protobuf.NullValue fields as null by @ybai08 in #7541
• fix(openapiv3): describe server-streaming responses as stream chunks by @ybai08 in #7577
• avoid quadratic path building for nested structs in field masks by @itecz26 in #7544
• protoc-gen-openapiv2: keep custom ref targets in the naming cache by @pujitha24 in #7560
• fix(gengateway): use the embedded field name for response_body types by @LuisFigueroaG in #7578
• reject duplicate map keys in jsonpb non-proto decoder by @itecz26 in #7561
• return io.EOF from drained ProtoMarshaller decoder by @itecz26 in #7567
• fix(openapiv3): omit oneof siblings of path and body fields from query parameters by @ybai08 in #7579
• ignore query keys naming the parent of a path-bound field by @itecz26 in #7582
• fix(openapiv2): don't put the schema type in format for json_schema types by @LuisFigueroaG in #7585
• fix(runtime): parse an empty FieldMask query parameter as an empty mask by @LuisFigueroaG in #7586
• fix(descriptor): skip additional_bindings without an HTTP pattern by @LuisFigueroaG in #7588
• fix(openapiv2): apply file-level responses to HEAD and OPTIONS operations by @LuisFigueroaG in #7592
• drop Grpc-Metadata forwarding from DefaultHeaderMatcher by @itecz26 in #7590

New Contributors

• @wangyusheng1985 made their first contribution in #7517
• @Asthenia0412 made their first contribution in #7521
• @cvas22 made their first contribution in #7535
• @spicysharkco made their first contribution in #7538
• @anyingiit made their first contribution in #7562
• @ybai08 made their first contribution in #7541

Full Changelog: v2.32.0...v2.33.0

What's Changed

• fix(openapiv2): render Any additional properties as true by @Boulea7 in #7215
• refuse client headers spoofing gateway x-forwarded-* metadata by @itecz26 in #7418
• avoid copying path components per handler in ServeMux.ServeHTTP by @itecz26 in #7426
• fix field mask path for nested Any in FieldMaskFromRequestBody by @itecz26 in #7438
• fix: handle CRLF line endings in proto comments by @somaz94 in #7419
• ci: detect deleted generated files by @Boulea7 in #7420
• stop double-unescaping path params in ServeMux.ServeHTTP by @itecz26 in #7449
• fix(httprule): reject invalid characters in HTTP path verb by @Sducabbagedog in #7454
• fix: preserve empty dynamic objects in field masks by @tianrking in #7450
• fix NewDoubleArray dropping path params that share a prefix by @itecz26 in #7452
• fix(openapiv2): pick merge leader from openapi_configuration too by @LuisFigueroaG in #7471
• fix(runtime): accept unpadded base64 for bytes parameters by @LuisFigueroaG in #7472
• treat %2f as a path separator in encodedPathSplitter by @itecz26 in #7486
• feat(openapiv3): support security schemes and requirements by @LuisFigueroaG in #7481
• feat(openapiv3): add openapiv3_tag service annotation by @LuisFigueroaG in #7495
• reject duplicate fields in DefaultQueryParser.Parse by @itecz26 in #7500
• fix(openapiv3): don't repeat nested path parameters as query parameters by @LuisFigueroaG in #7501
• Gate strict ** matching from #7412 behind strict_deep_wildcard generator flag by @johanbrandhorst in #7527

New Contributors

• @Boulea7 made their first contribution in #7215
• @somaz94 made their first contribution in #7419
• @Sducabbagedog made their first contribution in #7454
• @tianrking made their first contribution in #7450
• @LuisFigueroaG made their first contribution in #7471
• @TonyWu2333 made their first contribution in #7484
• @pujitha24 made their first contribution in #7493

Full Changelog: v2.31.0...v2.32.0

What's Changed

• Update minimum Go version from 1.25.0 to 1.26.0 by @johanbrandhorst in #7269
• fix(openapiv2): omit oneof siblings of path parameters from query parameters by @hsdfat in #7207
• fix: import response type package when response_body is set by @MicBun in #7225
• openapiv3: add extension (x-*) support by @Abmun in #7237
• docs: add a security considerations page by @cleitonaugusto in #7282
• fix(openapiv2): emit map key type in query parameter names by @iamrajiv in #7307
• Fix template_test format strings by @skitt in #7323
• Add edition 2026 support by @printfn in #7352
• fix(openapiv2): emit a primitive type for well-known object query parameters by @iamrajiv in #7351
• reject out-of-range numeric enum query values in parseField by @itecz26 in #7369
• feat(protoc-gen-openapiv3): support response_body binding by @tobiaskohlbau in #7371
• clamp overflowing grpc-timeout to max duration by @itecz26 in #7382
• validate forwarded header values before adding to grpc metadata by @itecz26 in #7390
• reject out-of-range enum numbers in jsonpb non-proto decoder by @itecz26 in #7397
• fix(openapiv2): emit minItems and maxItems on query parameters by @wofiporia in #7389
• reject grpc-metadata headers mapping into reserved grpcgateway- namespace by @itecz26 in #7401
• parse integer and enum path params as base 10 in convert.go by @itecz26 in #7405
• protoc-gen-openapiv2: allow proto files without a go_package option by @cipherprofessor in #7409
• runtime: deep wildcard (**) must not match zero segments after a preceding literal by @cipherprofessor in #7412

New Contributors

• @MicBun made their first contribution in #7225
• @Abmun made their first contribution in #7237
• @cleitonaugusto made their first contribution in #7282
• @skitt made their first contribution in #7323
• @itecz26 made their first contribution in #7369
• @tobiaskohlbau made their first contribution in #7371
• @wofiporia made their first contribution in #7389
• @cipherprofessor made their first contribution in #7409

Full Changelog: v2.30.0...v2.31.0

New Features

• protoc-gen-openapiv3: Brand new minimal OpenAPI v3 generator (#6623), plus follow-ups:
  • Visibility selectors (#6673)
  • disable_default_errors option (#6672)
  • Annotation support (#6681)
  • Improved plugin error surfacing (#6937)
  • field_behavior REQUIRED support for query parameters (#7180) — @maydietwice
• openapiv3-merge: New standalone tool for merging OpenAPI v3 documents (#6771) — @johanbrandhorst
• protoc-gen-openapiv2 moved to the protoc toolchain (#6988) — @EliSauder

Fixes

Documentation

• Clarify HttpBody download usage (#6904) — @ketpatil77
• Clarify Go tool dependency options (#7042) — @hawk-roy
• Add a runnable OpenTelemetry tracing example (#7110) — @hsdfat
• Fix SLSA link in README (#7149) — @ZayanKhan-12
• Explain Buf strategy for shared API config (#7147) — @dlanov

Tests / CI / Infra

• Add test coverage for slice converters in convert.go (#7041) — @viniciusmtsantos
• Remove Java swagger generator test dependency (#6735) — @johanbrandhorst
• CI improvements — go-version-file usage, release workflow tag input, checkout ref fixes, node_test timeouts, Node 22 LTS for browser tests (avoids a Node 24 zlib hang) (#6627, #6632, #6633, #6867, #6868) — @johanbrandhorst
• Better Bazel caching; auto-merge job for dependabot PRs (#6667, #6668) — @johanbrandhorst
• Run gazelle on openapiv3 files; add missing Bazel files (#6734, #6738) — @johanbrandhorst

New Contributors

@alliasgher, @superShen0916, @puneetdixit200, @ketpatil77, @EliSauder, @maskedmaxx, @hawk-roy, @viniciusmtsantos, @cyphercodes, @abhishek-dalbanjan, @hsdfat, @ZayanKhan-12, @dlanov, @maydietwice, @pkhanaljc, @Ritik100-AIT

Full Changelog: v2.29.0...v2.30.0

What's Changed

• fix: use proto.Merge to avoid copylocks with use_opaque_api=true by @emahiro in #6383
• fix: allow proto3 optional fields in path parameters by @susanachl in #6416
• Add option to disable HTTP method override by @achew22 in #6447
• Add Go documentation badge to README by @achew22 in #6448
• fix: add missing return statements in error handler paths by @jet-go in #6561
• Deprecate fields and methods if file is deprecated by @aidandj in #6613
• Add edition 2024 support by @printfn in #6622

New Contributors

• @emahiro made their first contribution in #6383
• @susanachl made their first contribution in #6416
• @jet-go made their first contribution in #6561
• @aidandj made their first contribution in #6613
• @printfn made their first contribution in #6622

Full Changelog: v2.28.0...v2.29.0

What's Changed

• feat: add option to disable chunked headers by @irenarindos in #6354
• fix(protoc-gen-openapiv2): fix panic on enum resolution in nested messages by @franchb in #6367

New Contributors

• @irenarindos made their first contribution in #6354

Full Changelog: v2.27.8...v2.28.0

What's Changed

• Fix opaque missing imports casing by @kellen-miller in #6304
• Revert "fix(protoc-gen-openapiv2): prevent panic when generating OpenAPI for multiple files" by @johanbrandhorst in #6309
• fix(protoc-gen-openapiv2): fix naming cache for multi-file generation by @franchb in #6315
• fix(openapiv2): exclude oneof fields from required with proto3 field semantics by @sessa in #6335

New Contributors

• @sessa made their first contribution in #6335

Full Changelog: v2.27.7...v2.27.8

Re-release of v2.26.7 as v2.27.7 for correct semver ordering.

What's Changed

• Revert "feat(generator): harden opaque imports and fix snake case to go casing" by @johanbrandhorst in #6299

Full Changelog: v2.27.6...v2.26.7

What's Changed

• feat(generator): harden opaque imports and fix snake case to go casing by @kellen-miller in #6279
• fix(protoc-gen-openapiv2): prevent panic when generating OpenAPI for multiple files by @franchb in #6275

New Contributors

• @franchb made their first contribution in #6275

Full Changelog: v2.27.5...v2.27.6