[dependabot]

Bumps github.com/grpc-ecosystem/grpc-gateway/v2 from 2.31.0 to 2.33.0.

Release notes

Sourced from github.com/grpc-ecosystem/grpc-gateway/v2's releases.

v2.33.0

Notice to all users

This release contains a security fix that changes the behavior of header parsing in the gateway. As part of fixing #7281, the decision was made to stop automatically adding client headers with the Grpc-Metadata- prefix into the grpc metadata by default. This behavior can be restored using the new mux option WithLegacyHeaderMatching. See https://grpc-ecosystem.github.io/grpc-gateway/docs/operations/security_considerations/#request-headers-become-grpc-metadata-under-a-prefix for more information.

Changes

• reject non-decimal float spellings in query and path params by @​itecz26 in grpc-ecosystem/grpc-gateway#7512
• docs: link example repositories in README by @​wangyusheng1985 in grpc-ecosystem/grpc-gateway#7517
• docs: update outdated local proxy documentation (#912) by @​Asthenia0412 in grpc-ecosystem/grpc-gateway#7521
• reject field[key] syntax for non-map fields in query params by @​itecz26 in grpc-ecosystem/grpc-gateway#7522
• keep remote address in x-forwarded-for when a client value is invalid by @​itecz26 in grpc-ecosystem/grpc-gateway#7531
• let WithMetadata annotators override client-forwarded metadata by @​itecz26 in grpc-ecosystem/grpc-gateway#7532
• try GET first for path length fallback so it isn't lost to map order by @​cvas22 in grpc-ecosystem/grpc-gateway#7535
• runtime: make strict deep wildcard matching a ServeMux option by @​movsb in grpc-ecosystem/grpc-gateway#7533
• apply middlewares to health endpoint regardless of option order by @​cvas22 in grpc-ecosystem/grpc-gateway#7537
• keep the Authorization header first in authorization metadata by @​itecz26 in grpc-ecosystem/grpc-gateway#7540
• accept form content types with parameters in the path length fallback by @​spicysharkco in grpc-ecosystem/grpc-gateway#7538
• keep matching other patterns when the last segment is a bare verb by @​cvas22 in grpc-ecosystem/grpc-gateway#7539
• fix(openapiv3): skip bindings with methods OpenAPI 3.1 can't describe by @​LuisFigueroaG in grpc-ecosystem/grpc-gateway#7505
• feat(openapiv3): add allow_delete_body option by @​LuisFigueroaG in grpc-ecosystem/grpc-gateway#7506
• openapiv2: allow any item type in google.protobuf.ListValue schema by @​cvas22 in grpc-ecosystem/grpc-gateway#7551
• don't add an empty path to the field mask for an empty request body by @​cvas22 in grpc-ecosystem/grpc-gateway#7552
• Use the httprule parser for openapiv2 path templates by @​anyingiit in grpc-ecosystem/grpc-gateway#7562
• Update dependency node to v24 by @​renovate[bot] in grpc-ecosystem/grpc-gateway#7543
• fix(gengateway): quote custom HTTP methods without a net/http constant by @​LuisFigueroaG in grpc-ecosystem/grpc-gateway#7575
• fix(openapiv3): emit google.protobuf.NullValue fields as null by @​ybai08 in grpc-ecosystem/grpc-gateway#7541
• fix(openapiv3): describe server-streaming responses as stream chunks by @​ybai08 in grpc-ecosystem/grpc-gateway#7577
• avoid quadratic path building for nested structs in field masks by @​itecz26 in grpc-ecosystem/grpc-gateway#7544
• protoc-gen-openapiv2: keep custom ref targets in the naming cache by @​pujitha24 in grpc-ecosystem/grpc-gateway#7560
• fix(gengateway): use the embedded field name for response_body types by @​LuisFigueroaG in grpc-ecosystem/grpc-gateway#7578
• reject duplicate map keys in jsonpb non-proto decoder by @​itecz26 in grpc-ecosystem/grpc-gateway#7561
• return io.EOF from drained ProtoMarshaller decoder by @​itecz26 in grpc-ecosystem/grpc-gateway#7567
• fix(openapiv3): omit oneof siblings of path and body fields from query parameters by @​ybai08 in grpc-ecosystem/grpc-gateway#7579
• ignore query keys naming the parent of a path-bound field by @​itecz26 in grpc-ecosystem/grpc-gateway#7582
• fix(openapiv2): don't put the schema type in format for json_schema types by @​LuisFigueroaG in grpc-ecosystem/grpc-gateway#7585
• fix(runtime): parse an empty FieldMask query parameter as an empty mask by @​LuisFigueroaG in grpc-ecosystem/grpc-gateway#7586
• fix(descriptor): skip additional_bindings without an HTTP pattern by @​LuisFigueroaG in grpc-ecosystem/grpc-gateway#7588
• fix(openapiv2): apply file-level responses to HEAD and OPTIONS operations by @​LuisFigueroaG in grpc-ecosystem/grpc-gateway#7592
• drop Grpc-Metadata forwarding from DefaultHeaderMatcher by @​itecz26 in grpc-ecosystem/grpc-gateway#7590

New Contributors

• @​wangyusheng1985 made their first contribution in grpc-ecosystem/grpc-gateway#7517
• @​Asthenia0412 made their first contribution in grpc-ecosystem/grpc-gateway#7521
• @​cvas22 made their first contribution in grpc-ecosystem/grpc-gateway#7535
• @​spicysharkco made their first contribution in grpc-ecosystem/grpc-gateway#7538
• @​anyingiit made their first contribution in grpc-ecosystem/grpc-gateway#7562
• @​ybai08 made their first contribution in grpc-ecosystem/grpc-gateway#7541

Full Changelog: grpc-ecosystem/grpc-gateway@v2.32.0...v2.33.0

... (truncated)

Commits

• de0b890 drop Grpc-Metadata forwarding from DefaultHeaderMatcher (#7590)
• b4a1288 fix(openapiv2): apply file-level responses to HEAD and OPTIONS operations (#7...
• 4b9b9fc Update googleapis digest to 933dd1b (#7591)
• 82aa33e Update googleapis digest to 6efda15 (#7589)
• 29bff47 fix(descriptor): skip additional_bindings without an HTTP pattern (#7588)
• 3ea00e5 Update googleapis digest to 4148102 (#7587)
• 8387556 fix(runtime): parse an empty FieldMask query parameter as an empty mask (#7586)
• f789d86 fix(openapiv2): don't put the schema type in format for json_schema types (#7...
• 1315094 Update googleapis digest to 7721fc7 (#7584)
• 8b3c0de ignore query keys naming the parent of a path-bound field (#7582)
• Additional commits viewable in compare view