edge

current master build to be referred by https://github.com/coupergateway/features/pkgs/container/features%2Fcouper

v1.14.2

Security patch release

Addresses three high-severity OpenTelemetry advisories.

Security

• go.opentelemetry.io/otel 1.43.0 — fix multi-value baggage header DoS amplification (GHSA-mh2q-q3fh-2475)
• go.opentelemetry.io/otel/sdk 1.43.0 — fix PATH hijacking via BSD kenv not using absolute path (GHSA-hfvc-g4fc-pqhx) and arbitrary code execution via PATH hijacking (GHSA-9h8m-3fm2-qjrq)

Dependencies

• go.opentelemetry.io/otel and otel/sdk, otel/metric, otel/trace, otel/exporters/otlp/otlptrace*, otel/exporters/otlp/otlpmetric/otlpmetricgrpc 1.39.0/1.38.0 → 1.43.0
• go.opentelemetry.io/otel/exporters/prometheus 0.60.0 → 0.64.0
• google.golang.org/grpc 1.79.3 → 1.80.0
• golang.org/x/net 0.48.0 → 0.52.0, golang.org/x/crypto 0.46.0 → 0.49.0 (transitive)

Built with Go 1.26.2.

Full changelog: v1.14.1...v1.14.2

v1.14.1

1.14.1

• Dependencies
  • build with go 1.26.2 — security fixes for crypto/tls, crypto/x509, html/template, archive/tar, and os packages (#940)
  • google.golang.org/grpc 1.79.3 — security fix for authorization bypass via malformed :path headers (#940)
  • gosaml2 0.11.0 and goxmldsig 1.6.0 (#939)

v1.14.0

1.14.0

• Added

  • argon2i and argon2id password hash support for basic_auth htpasswd_file (#866)
  • beta_rate_limiter access control for fixed/sliding window rate limiting (#881)
  • beta_introspection block in jwt block to facilitate token introspection in order to detect revoked tokens (#649)
  • startup_delay attribute for job block to delay the first job execution after startup (#836)
  • OpenTelemetry tracing documentation with configuration reference for beta_traces, trace propagation settings, and CLI flags (#672)
  • Access control metrics: couper_access_control_total, couper_access_control_duration_seconds, couper_access_control_rate_limited_total, and couper_access_control_rate_limiter_active_keys; Grafana dashboard updated with Access Control row (#924)
  • Documentation website dark theme support and improved styling for readability (#931)
  • Devcontainer feature to install Couper in development containers (ghcr.io/coupergateway/features/couper) (#931)
  • Couper documentation available as Context7 MCP library for LLM-assisted development (#931)
  • SAML IdP metadata auto-update: idp_metadata_url attribute to fetch IdP metadata from a URL with automatic refresh via metadata_ttl and metadata_max_stale attributes (#912)

• Changed

  • beta_rate_limit block in backend block has left beta and is renamed to throttle; the old name is deprecated and will be removed in version 1.15 (#914)
  • beta_backend_rate_limit_exceeded error type is renamed to backend_throttle_exceeded; the old name is deprecated and will be removed in version 1.15 (#914)
  • beta_job block has left beta and is renamed to job; the old name is deprecated and will be removed in version 1.15 (#898)

• Fixed

  • Fix traceparent header not being propagated to backends when using beta_traces due to trace context injection into the wrong (request) headers; now correctly injected into response headers by TraceHandler and into outgoing request headers by InstrumentedRoundTripper (#923)
  • Fix redundant span creation in producers and innerRoundTrip when using beta_traces; consolidate all backend tracing into a single InstrumentedRoundTripper with correct SpanKindClient (#923)
  • Fix TraceContext propagator missing Baggage support when using beta_traces; use composite propagator with both TraceContext and Baggage (#923)
  • Fix backend_response not being available in custom_log_fields for OIDC/OAuth2 token and userinfo backend requests; also fixes request name showing as <nil> in upstream logs for these requests (#797)

• Security

  • Return explicit error when backend origin evaluates to empty string instead of falling back to the client request URL (#920)
  • Sanitize \r, \n, and \0 characters from header values set via HCL expressions to prevent header injection (#920)
  • Reject path traversal sequences (.., %2e%2e) in path and path_prefix attributes (#920)
  • Remove rate limiter key value from error messages to prevent information leakage (#920)
  • Use constant-time comparison for username in basic_auth (#920)

• Dependencies

  • build with go 1.26 (#926)
  • hcl 2.23.0 and go-cty 1.16.2 (#816)

v1.13.2

1.13.2

• Dependencies
  • build with go 1.23 (#886)
  • golang-jwt to the unaffected version v5.2.2 to address the third-party CVE-2025-30204 (#886)
  • golang.org/x/crypto v0.39.0 (#886)

v1.13.1

1.13.1

• Changed

  • ulimit, open files and max procs values are now logged with debug log level (#857)

• Fixed

  • Addressed the third-party CVE-2025-30153 affecting our OpenAPI feature by upgrading to the non-affected version v0.132.0 (#883)

v1.13.0

1.13.0

• Added

  • can() function (#699)
  • url_decode() function (#781)
  • bearer = true attribute for jwt block to indicate retrieving token from Authorization: Bearer .... This is the new default token source indicator. header = "Authorization" is now deprecated in favour of this new attribute. (#724)
  • IPv6 support via -bind-address option. (#752)
  • also watch files which has been referenced within the configuration file when using [-watch] (https://docs.couper.io/configuration/command-line#basic-options) (#747)
  • automatic MAXPROCS setting for Couper runtime to respect the number of available CPU resources in cloud environments (#840)

• Changed

  • More specific error log messages for oauth2 and beta_token_request token request errors (#755)
  • In addition to having an appropriate JSON media type in the Content-Type header field, (backend) requests or backend responses for an endpoint are only JSON-parsed if indicated by a .json_body reference in the endpoint configuration (#749)
  • beta_rate_limit status code 429 responses are no longer wrapped as a Couper error (#827)

• Fixed

  • WWW-Authenticate header realm param value for basic_auth (#715)
  • Server-Timing header only reporting last requests/proxies of endpoint sequences (#751)
  • Selecting of appropriate error handler in two cases (#753)
  • Storing of digit-starting string object keys in request context and of digit-starting string header field names in request variable (#799)
  • Use of boolean values for the headers attribute or modifiers (#805)
  • Duplicate CORS response headers (with backend sending CORS response headers, too) (#804)
  • Erroneously sending 404 when serving from files due to wrong registration of base_paths, and when serving from multiple files or spa in combination with api due to wrong selecting of the API error template (#803)
  • Possible deadlock for beta_rate_limit (#827)

• Dependencies

  • build with go 1.22 (#810)
  • upgrade jwt library from v4 to v5 (#769, #834)
  • update OpenAPI lib to v0.126.0 (#837)
  • update uuid lib to v1.6.0 and xid lib to 1.5.0 (#838)
  • update logrus lib to 1.9.3 (#839)

v1.12.2

Note: The Couper project has been moved to a new home: https://github.com/coupergateway/couper !
The maintainer is still the same (@malud) and supported with ❤️ by Milecrew.
This affects the following locations which you have to update accordingly:

Dockerhub: coupergateway/couper and coupergateway/couper-oidc-gateway
VSCode-Extension: Couper Configuration (Marketplace / Open VSX)
Homebrew: brew tap coupergateway/couper and then brew install couper (formula)
Examples: https://github.com/coupergateway/couper-examples

• Fixed
  • Reading the origin response-body even if there is no origin body or json_body variable reference; piping the response-body again to the client (#766)

v1.12.1

1.12.1

• Fixed
  • Erroneously sending an empty Server-Timing header (#700)
  • URL scheme while using the tls block (#703)
  • For OIDC, trying to request userinfo from a non-existing (not required, though recommended) userinfo endpoint (#709)
  • Use of backend_responses' body or json_body properties in api-level error handlers (#710)
  • Some ..._file attributes missing for path absolutizing (#713)
  • WWW-Authenticate header realm param value for basic_auth (#715)
  • JWT access control now creating 401 error status code, adding a WWW-Authenticate: Bearer[...] response header if appropriate (#719)
  • Erroneous multiplying of health probes, jobs and requests to JWKS and OpenID configuration resources after a reload with -watch (#730, #736)
  • Reading PEM-encoded CA certificates (ca_file setting or -ca-file option) containing bytes trailing the PEM message (#739)

v1.12.0

1.12.0

• Added

  • beta_job block to describe one or more job definitions for simple recurring http tasks (#610)
  • server_timing_header setting, that allows Couper to include an additional Server-Timing HTTP response header field detailing connection and transport relevant metrics for each backend request. (#657)

• Changed

  • Use nested jwt_signing_profile block in oauth2 block for grant_type "urn:ietf:params:oauth:grant-type:jwt-bearer" in absence of assertion attribute (#619)
  • Improved the way an SPA bootstrap_file gets cached and served in combination with bootstrap_data (#656)
  • Harmonized and improved logged error information for references to undefined blocks (#651)
  • Unbeta permission features: (#673)
    • beta_required_permission attribute for api and endpoint blocks,
    • beta_granted_permissions and beta_required_permission request context variables,
    • beta_insufficient_permissions error type,
    • beta_permissions_claim, beta_permissions_map, beta_permissions_map_file, beta_roles_claim, beta_roles_map and beta_roles_map_file attributes for jwt block.

• Fixed

  • Use of backend-related variables in custom_log_fields within a backend block (#658)
  • Loop with evaluation error in custom_log_fields if log level is "debug" (#659)
  • Removed error message with couper help command (#678)

VSCode-Extension

The vscode extension has been moved to our own publisher couper. The new extension can be found here:

• Marketplace: https://marketplace.visualstudio.com/items?itemName=couper.couperconf
• Open-VSX: https://open-vsx.org/extension/couper/couperconf (claiming the namespace is still pending)