[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/grpc-ecosystem/grpc-gateway/v2	v2.31.0 → v2.33.0

---

Release Notes

grpc-ecosystem/grpc-gateway (github.com/grpc-ecosystem/grpc-gateway/v2)

v2.33.0

Compare Source

Notice to all users

This release contains a security fix that changes the behavior of header parsing in the gateway. As part of fixing #​7281, the decision was made to stop automatically adding client headers with the Grpc-Metadata- prefix into the grpc metadata by default. This behavior can be restored using the new mux option WithLegacyHeaderMatching. See https://grpc-ecosystem.github.io/grpc-gateway/docs/operations/security_considerations/#request-headers-become-grpc-metadata-under-a-prefix for more information.

Changes

• reject non-decimal float spellings in query and path params by @​itecz26 in #​7512
• docs: link example repositories in README by @​wangyusheng1985 in #​7517
• docs: update outdated local proxy documentation (#​912) by @​Asthenia0412 in #​7521
• reject field[key] syntax for non-map fields in query params by @​itecz26 in #​7522
• keep remote address in x-forwarded-for when a client value is invalid by @​itecz26 in #​7531
• let WithMetadata annotators override client-forwarded metadata by @​itecz26 in #​7532
• try GET first for path length fallback so it isn't lost to map order by @​cvas22 in #​7535
• runtime: make strict deep wildcard matching a ServeMux option by @​movsb in #​7533
• apply middlewares to health endpoint regardless of option order by @​cvas22 in #​7537
• keep the Authorization header first in authorization metadata by @​itecz26 in #​7540
• accept form content types with parameters in the path length fallback by @​spicysharkco in #​7538
• keep matching other patterns when the last segment is a bare verb by @​cvas22 in #​7539
• fix(openapiv3): skip bindings with methods OpenAPI 3.1 can't describe by @​LuisFigueroaG in #​7505
• feat(openapiv3): add allow_delete_body option by @​LuisFigueroaG in #​7506
• openapiv2: allow any item type in google.protobuf.ListValue schema by @​cvas22 in #​7551
• don't add an empty path to the field mask for an empty request body by @​cvas22 in #​7552
• Use the httprule parser for openapiv2 path templates by @​anyingiit in #​7562
• Update dependency node to v24 by @​renovate[bot] in #​7543
• fix(gengateway): quote custom HTTP methods without a net/http constant by @​LuisFigueroaG in #​7575
• fix(openapiv3): emit google.protobuf.NullValue fields as null by @​ybai08 in #​7541
• fix(openapiv3): describe server-streaming responses as stream chunks by @​ybai08 in #​7577
• avoid quadratic path building for nested structs in field masks by @​itecz26 in #​7544
• protoc-gen-openapiv2: keep custom ref targets in the naming cache by @​pujitha24 in #​7560
• fix(gengateway): use the embedded field name for response_body types by @​LuisFigueroaG in #​7578
• reject duplicate map keys in jsonpb non-proto decoder by @​itecz26 in #​7561
• return io.EOF from drained ProtoMarshaller decoder by @​itecz26 in #​7567
• fix(openapiv3): omit oneof siblings of path and body fields from query parameters by @​ybai08 in #​7579
• ignore query keys naming the parent of a path-bound field by @​itecz26 in #​7582
• fix(openapiv2): don't put the schema type in format for json_schema types by @​LuisFigueroaG in #​7585
• fix(runtime): parse an empty FieldMask query parameter as an empty mask by @​LuisFigueroaG in #​7586
• fix(descriptor): skip additional_bindings without an HTTP pattern by @​LuisFigueroaG in #​7588
• fix(openapiv2): apply file-level responses to HEAD and OPTIONS operations by @​LuisFigueroaG in #​7592
• drop Grpc-Metadata forwarding from DefaultHeaderMatcher by @​itecz26 in #​7590

New Contributors

• @​wangyusheng1985 made their first contribution in #​7517
• @​Asthenia0412 made their first contribution in #​7521
• @​cvas22 made their first contribution in #​7535
• @​spicysharkco made their first contribution in #​7538
• @​anyingiit made their first contribution in #​7562
• @​ybai08 made their first contribution in #​7541

Full Changelog: grpc-ecosystem/grpc-gateway@v2.32.0...v2.33.0

v2.32.0

Compare Source

What's Changed

• fix(openapiv2): render Any additional properties as true by @​Boulea7 in #​7215
• refuse client headers spoofing gateway x-forwarded-* metadata by @​itecz26 in #​7418
• avoid copying path components per handler in ServeMux.ServeHTTP by @​itecz26 in #​7426
• fix field mask path for nested Any in FieldMaskFromRequestBody by @​itecz26 in #​7438
• fix: handle CRLF line endings in proto comments by @​somaz94 in #​7419
• ci: detect deleted generated files by @​Boulea7 in #​7420
• stop double-unescaping path params in ServeMux.ServeHTTP by @​itecz26 in #​7449
• fix(httprule): reject invalid characters in HTTP path verb by @​Sducabbagedog in #​7454
• fix: preserve empty dynamic objects in field masks by @​tianrking in #​7450
• fix NewDoubleArray dropping path params that share a prefix by @​itecz26 in #​7452
• fix(openapiv2): pick merge leader from openapi_configuration too by @​LuisFigueroaG in #​7471
• fix(runtime): accept unpadded base64 for bytes parameters by @​LuisFigueroaG in #​7472
• treat %2f as a path separator in encodedPathSplitter by @​itecz26 in #​7486
• feat(openapiv3): support security schemes and requirements by @​LuisFigueroaG in #​7481
• feat(openapiv3): add openapiv3_tag service annotation by @​LuisFigueroaG in #​7495
• reject duplicate fields in DefaultQueryParser.Parse by @​itecz26 in #​7500
• fix(openapiv3): don't repeat nested path parameters as query parameters by @​LuisFigueroaG in #​7501
• Gate strict ** matching from #​7412 behind strict_deep_wildcard generator flag by @​johanbrandhorst in #​7527

New Contributors

• @​Boulea7 made their first contribution in #​7215
• @​somaz94 made their first contribution in #​7419
• @​Sducabbagedog made their first contribution in #​7454
• @​tianrking made their first contribution in #​7450
• @​LuisFigueroaG made their first contribution in #​7471
• @​TonyWu2333 made their first contribution in #​7484
• @​pujitha24 made their first contribution in #​7493

Full Changelog: grpc-ecosystem/grpc-gateway@v2.31.0...v2.32.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 13 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.71.0 -> v0.72.0
go.opentelemetry.io/otel	v1.46.0 -> v1.47.0
go.opentelemetry.io/otel/metric	v1.46.0 -> v1.47.0
go.opentelemetry.io/otel/sdk	v1.46.0 -> v1.47.0
go.opentelemetry.io/otel/sdk/metric	v1.46.0 -> v1.47.0
go.opentelemetry.io/otel/trace	v1.46.0 -> v1.47.0
golang.org/x/net	v0.59.0 -> v0.61.0
golang.org/x/sync	v0.23.0 -> v0.24.0
golang.org/x/sys	v0.48.0 -> v0.49.0
golang.org/x/term	v0.46.0 -> v0.47.0
golang.org/x/text	v0.42.0 -> v0.43.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260921155816-b14227669459 -> v0.0.0-20261026165753-2ffab32bce7e
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260918162117-cecb64721679 -> v0.0.0-20261019180522-ce908d29299b