v1.8.0

Security Fixes

• Unauthenticated Runtime Configuration Disclosure via Admin API /api/config in fabio
• Default Unauthenticated Admin Write API Enables Routing Takeover
• fabio: setting proxy.header.clientip to X-Real-Ip silently makes the client-IP header attacker-controlled

Quick summary:

• 37e26bcf7 The Admin UI is default off
• 3987d3570 No return API keys in the config api or logs.
• a5307ce76 Add a parameter to clear headers provided by client.

Changelog

• ad1b238 Version 1.8.0 release.
• 17f1ff0 Merge commit from fork
• 6485b59 Merge commit from fork
• a8263fe Merge pull request #1085 from marco-m/registry-perf-improvement
• 67fbf1d registry/custom: tests: shave off 3 seconds
• 3b56424 registry/custom: tests: use t.Fatal instead of fmt.Print + t.FailNow
• ca5487d registry/custom: tests: no need to predeclare a variable
• 2ffdbe1 Merge pull request #1063 from froque/allow_route_weight_0
• 111f5fb Allows to use route weight 0 to exclude some targets
• 22b528d build(deps): bump github.com/magiconair/properties (#1075)
• 2059cbe Fix #1000: Support Proxy Protocol v2 ? (#1074)
• 66e463d Merge pull request #1072 from marco-m/auth-tests-speedup
• 9fa856c auth: tests: reduce runtime from 2.3 sec to 0.3 sec thanks to syncttest
• fdebf1d auth: refactor newBasicAuth (push to the left)
• f3d005f auth: newBasicAuth: return concrete type, not interface
• e70cf6b auth: add documentation comments
• 3987d35 Redact secrets from /api/config endpoint and startup log.
• 7d37976 Merge pull request #1076 from fabiolb/dependabot/go_modules/google.golang.org/grpc-1.83.2
• a5307ce Adding a proxy.header.clearclient config param to optionally remove potentially tainted headers from the client request.
• 9dd409f Merge pull request #1079 from fabiolb/bugfix/bgp_mac
• aba3095 Make the bgp tests runnable on macOS
• 50af9cd build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2
• cc28bdf Merge pull request #1042 from tristanmorgan/bgp_update
• 2f2c703 Fix gobgp v4 port regressions and drop the hardcoded AS_PATH
• 426447e use string buffer in bgp/logger.go
• efe8f42 Update github.com/osrg/gobgp to use v4 package.
• cc80782 Merge pull request #1056 from fabiolb/dependabot/go_modules/golang.org/x/net-0.57.0
• 7171293 build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0
• 3c3f086 Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 (#1064)
• e266be6 Add a SECURITY.md file. (#1069)
• 12e9626 Merge pull request #1070 from tristanmorgan/go_update
• 556a3be Merge pull request #1073 from tristanmorgan/no_admin
• 37e26bc Default admin interface to "no"
• 827dc66 Update httputil.ReverseProxy to migrate from director to rewrite.
• 2e477aa Run modernise and tweak golangci-lint config.
• 885af43 Adjust for Go 1.27 gzip changes.
• da9f262 Merge pull request #1071 from marco-m/basic-auth-tests
• 19da201 auth/basic_test: actually test the logs
• d28d083 auth/basic_test: simplifications
• 12be5e0 auth/basic_test: make test helpers idiomatic
• ff132c6 auth/basic_test: use self-describing names
• 41ca9df auth/basic_test: strings can be compared directly
• 18b7bbf auth/basic_test: booleans can be compared directly
• 2456d96 Merge pull request #1068 from marco-m/docs-auth-index
• 20ba0bb docs/features: add missing features to the index
• 906e8e2 docs/feature: sort list alphabetically
• d1a2d87 Changelog 1.7.3
• 3383df3 Merge pull request #1067 from marco-m/fix-broken-links
• 8ecb568 docs: fix broken links (github/ebay -> github/fabiolb)
• fff87fe Merge pull request #1065 from marco-m/update-x-text
• 47a095f fix: Infinite loop on invalid input in golang.org/x/text