Skip to content

v0.17.21

Latest
Latest

Choose a tag to compare

View all tags
@dadrus dadrus released this 14 Aug 15:27
v0.17.21
76dd2a5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.17.21 (2026-08-14)

This release deprecates forward_response_headers_to_upstream as part of #3375. Users relying on this option should start planning their migration (see #3375 for details).

It also contains a larger set of bug fixes addressing correctness and robustness in request processing, caching, and communication with external authentication and authorization systems.

Deprecations

  • forward_response_headers_to_upstream setting of the remote authorizer is deprecated (#3375) (7ac4f55)

Bug Fixes

  • Apply OAuth2 introspection assertions to cached responses (#3453) (57f8860)
  • Apply remote authorizer expressions to cached responses (#3451) (87a2eea)
  • Avoid ambiguous scope representation in client credentials hashes (#3448) (0fc3016)
  • Consider forwarded values in generic authenticator cache keys (#3455) (72508b2)
  • Consider forwarded values in generic contextualizer cache keys (#3457) (71daea9)
  • Corrected client IP extraction for Envoy gRPC ext_authz (#3440) (5dc599c)
  • Data race in CEL networks() resolved (#3432) (a737196)
  • Enforced trusted proxies for Envoy gRPC ext_authz (#3437) (427fdc6)
  • Ensure deterministic and unambiguous cache identities (#3464) (dfbea56)
  • Ensuring generic authenticator does not follow redirects (#3468) (0ef1baf)
  • Ensuring oauth2_introspection authenticator does not follow redirects (#3469) (8b42cc7)
  • Ensuring remote authorizer does not follow redirects (#3467) (213e18e)
  • Error messages in html responses escaped (#3466) (7c06c48)
  • Generic authenticator respects rule-level cache TTL overrides (#3447) (c66cce2)
  • JWT authenticator respects rule-level cache TTL overrides (#3447) (c66cce2)
  • OAuth2 client credentials finalizer respects rule-level cache TTL overrides (#3447) (c66cce2)
  • OAuth2 introspection authenticator respects rule-level cache TTL overrides (#3447) (c66cce2)
  • Validate cached JWKs before use (#3449) (3ab18f6)

Dependencies

  • update golang to v1.26.6 (#3461) (b4d70fb)
  • update google.golang.org/genproto/googleapis/rpc digest to ec0a776 (#3434) (563027d)
  • update module github.com/google/cel-go to v0.31.0 (#3427) (db7757e)
  • update module github.com/knadh/koanf/maps to v0.1.3 (#3430) (96f55f2)
  • update module google.golang.org/protobuf to v1.36.12 (#3435) (1e26e18)
Assets 27
Loading