org.springframework.cloud:spring-cloud-gateway

Security

• CVE-2026-47879 — Spring Cloud Gateway SSRF and native file access with gRPC

What's Changed

• Fix WebMvc PerserveHostHeader so it matches Webflux by @ryanjbaxter in #4213
• GH-3791: Document AdaptCachedBody filter for Spring Cloud Gateway WebMVC by @won-seoop in #4197
• GH-3885: Document Spring Security integration for WebFlux and WebMVC gateways by @won-seoop in #4198
• GH-1949: Document that overriding discovery locator filters replaces defaults by @won-seoop in #4199
• GH-4024: Add documentation for the Version Route Predicate Factory by @won-seoop in #4205
• GH-3168: Document that @LoadBalanced RestClient must not be used in Gateway MVC by @won-seoop in #4200
• docs: update gateway grafana dashboard by @imanabr77 in #4215
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #4219
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in #4221
• Add MVC retry backoff support by @goutamadwant in #4225
• Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #4241
• Exclude release-train workflows from Dependabot updates by @ryanjbaxter in #4252
• Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in #4253
• Fix ordering in test by @ryanjbaxter in #4255
• Add missing test scope to spring-boot-resttestclient by @timpeeters in #4257
• Add warn logging when WebSocket message receive fails by @fru1tworld in #4134
• Avoid draining failed streaming proxy responses by @goutamadwant in #4217

New Contributors

• @won-seoop made their first contribution in #4197
• @imanabr77 made their first contribution in #4215
• @goutamadwant made their first contribution in #4225
• @timpeeters made their first contribution in #4257

Full Changelog: v5.0.2...v5.0.3

🔒 CVEs

• Fix for CVE-2026-47825

⭐ New Features

• Enable body filter codec encoding customization via CodecCustomizer #4151
• Adds StripContextPath filter #4089

🐞 Bug Fixes

• RewriteFunction nullability in Spring Boot 4 #4061
• AbstractProxyExchange takes into account MediaType parameters #3948

📔 Documentation

• docs(server-webflux): updating gateway actuator documentation as per … #4163
• Fix typos in DiscoveryLocatorProperties documentation, make terms consistent, remove already implemented TODO #4123
• Spring Cloud Gateway docs contain wrong configuration properties #4103
• Spring Cloud Docs has wrong references in "How It Works" section for Server MVC #4098
• [doc] Fix broken link to GatewayFilter #4073
• Documentation mismatch: Route configuration path incorrect for Spring Cloud Gateway Server WebFlux #4047
• Docs: Fix broken GitHub links in Server WebMvc "How It Works" docs #3928
• CONTRIBUTING references CLA, but this appears to have been replaced with DCO #3884
• Document TLS/SSL Configuration for Spring Cloud MVC Gateway #3654
• Better docs about naming convention in PredicateDefinition: Path receives pattern key and it works? #3523

❤️ Contributors

Thank you to all the contributors who worked on this release:

@03hjain, @AahilRafiq, @RenanMarques, @Yuri-Costa09, @dependabot[bot], @garvit-joshi, @jerolba, @qnnn, and @ryanjbaxter

⭐ New Features

• Support 'by' parameter in Forwarded header (RFC 7239) #4019
• Support epoch millisecond values for datetime predicates in WebMVC #4005
• Enhance MVC CircuitBreaker: add support for 'not permitted' handling and resume-without-error behavior #4000

🐞 Bug Fixes

• Adds support for ApiVersionHolder #4044
• Gateway metrics require optional spring-boot-micrometer-tracing dependency since 5.0.0 #4006
• Usage of Jackson 2 modules in Spring Cloud Gateway MVC #4001

📔 Documentation

• Documentation mentions deprecated Hystrix in Gateway features #4041
• Update document on retrieving a particular route #2561

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot], @raccoonback, @rjuare8, and @spencergibb

🐞 Bug Fixes

• ClassClastException in Bucket4jFilterFunctions.rateLimit() #3983
• Spring Cloud Gateway Proxyexchange Webmvc artifact is missing configuration metadata files #3979

❤️ Contributors

Thank you to all the contributors who worked on this release:

@Kcruz28, @dependabot[bot], @rjuare8, and @ryanjbaxter

⭐ New Features

• Retry filter based on Spring Framework's retry functionality #3970
• Add support for JSpecify in proxyexchange-{webmvc|webflux} #3953
• Add support for JSpecify in server-webmvc #3952

🐞 Bug Fixes

• Exclude io.netty:netty-transport-native-io_uring from server webflux #3971

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot] and @ryanjbaxter

⭐ New Features

• Add support for JSpecify in server-webflux #3943
• Add support for multiple proto files in one descriptor for JsonToGrpcGatewayFilterFactory #3341

🐞 Bug Fixes

• BUG: GRPCResponseHeadersFilter forces grpc-status in trailer to 0 #3783

📔 Documentation

• Fix the invalid links in the document #3932

❤️ Contributors

Thank you to all the contributors who worked on this release:

@JoeCqupt and @dependabot[bot]

🔒 CVEs

• Fix for CVE-2026-47825

⭐ New Features

• MVC ProxyExchange does not provide observability of URI template #3458
• Add support for empty path prefixes #3201

📔 Documentation

• docs: add ReadBody route predicate factory documentation #4138

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot], @mhalbritter, @pachat-pacifique, and @ryanjbaxter

🐞 Bug Fixes

• Issue with shortcut configuration not working for SetRequestUriGatewayFilterFactory #4062

📔 Documentation

• Question: Route stops working after upgrading to Spring Boot 4.0.1 #4032

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot]

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot]

What's Changed

• Fix incorrect handling of url-encoded parameters in FormFilter by @Shawyeok in #3930
• Bump antora from 3.2.0-alpha.10 to 3.2.0-alpha.11 in /docs by @dependabot[bot] in #4011
• Bump antora from 3.2.0-alpha.10 to 3.2.0-alpha.11 in /docs by @dependabot[bot] in #4009
• Add new property for GatewayTagsProvider by @ryanjbaxter in #4013
• Updates test to work with new framework changes. by @spencergibb in #4018

New Contributors

• @Shawyeok made their first contribution in #3930

Full Changelog: v4.3.2...v4.3.3

🐞 Bug Fixes

• GatewayTagsProvider not working as documented #4007
• FormFilter Issue: Incorrect Handling of URL-Encoded Parameters in Query String #3929

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot] and @spencergibb