v4.1.1

What's Changed

• Strip X-Forwarded-Host, X-Forwarded-Prefix and Forwarded from untrusted connections by @fool1280 in #2186
• Further path normalization by @fool1280 in #2185

Full Changelog: v4.1.0...v4.1.1

v4.1.0

What's Changed

• build(deps): bump org.wiremock:wiremock from 3.10.0 to 3.13.2 by @dependabot[bot] in #2173
• build(deps): bump com.palantir.javaformat:gradle-palantir-java-format from 2.83.0 to 2.94.0 by @dependabot[bot] in #2164
• build(deps): bump com.diffplug.spotless from 8.1.0 to 8.8.0 by @dependabot[bot] in #2165
• Reformat with spotless by @jguerra in #2182
• Add new connection pool options for using default buffer sizing by @jguerra in #2176

Full Changelog: v4.0.0...v4.1.0

v4.0.0

Zuul 4.0.0 replaces the RxJava Observable based async filter execution with CompletableFuture. RxJava 1.x is long past end-of-life, and moving to CompletableFuture lets the filter runner drop its custom RxJava Scheduler and Observer for plain JDK primitives.

Breaking changes

• ZuulFilter.applyAsync now returns CompletableFuture<O> instead of Observable<O>. The Observable-based method is renamed to applyAsyncObservable and deprecated. Both have default bridge implementations on the interface, so a filter can override either one (#2075)
• The debugRouting / debugRequest infrastructure is removed (#2078)
• Connection draining is now event-based rather than channel-attribute based (#2161). Zuul-core fires a ConnectionCloseEvent down the pipeline instead of setting a channel attribute that every write has to check, so a graceful shutdown starts immediately on the event instead of waiting for the next response (an idle HTTP/1.1 connection can be closed right away), and OOS closes get random jitter to spread them out. The close handlers were reworked and CLOSE_AFTER_RESPONSE was removed - see Connection draining below
• SessionContext no longer extends HashMap<String, Object>; it now wraps one via composition (#2171) and is @NullMarked (#2174). The common Map methods are re-exposed directly, but code that relied on it being a Map needs updating, and nullmarking turns the accessors @Nullable which can surface new NullAway warnings in consumers. The getRouteHost / setRouteHost / removeRouteHost accessors are removed - use the generic get/set with your own Key<T>.

Migrating a filter

A filter overriding applyAsync to return an Observable will not compile against 4.0.0. The minimal fix is a one-line rename:

Before:

@Override
public Observable<HttpResponseMessage> applyAsync(HttpRequestMessage request) {
    return service.call(request).map(this::toResponse);
}

After:

@Override
public Observable<HttpResponseMessage> applyAsyncObservable(HttpRequestMessage request) {
    return service.call(request).map(this::toResponse);
}

The default applyAsync bridges applyAsyncObservable back to a CompletableFuture, so the rest of the filter keeps working unchanged. The filter should be rewritten to return a CompletableFuture directly and delete applyAsyncObservable. applyAsyncObservable will be removed entirely in a later 4.x release.

Connection draining

Consumers that build their own channel pipelines need small updates:

• The close and expiry handlers moved to the com.netflix.netty.common.close package
• HTTP/2 connection close now lives on the connection pipeline, not the stream - drop any stream-level close-handler wiring
• CLOSE_AFTER_RESPONSE / the allow_then_close rejection type is gone; throttled connections just close

Additional Changes

Also in this release: lazy hashCode caching (#2085), Objects.requireNonNull / @NonNull over preconditions (#2090), removal of unused classes (#2153), and a switch to typed SessionContext.Key<T> keys instead of stringly-typed context keys, both in the filter runner (#2167) and across SessionContext's own internal state (#2174).

Full Changelog: v3.6.21...v4.0.0

v3.6.21

What's Changed

• build(deps): bump com.uber.nullaway:nullaway from 0.13.1 to 0.13.7 by @dependabot[bot] in #2166
• build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #2150
• Upgrade Netty to v4.2.16.Final by @gavinbunney in #2175

Full Changelog: v3.6.20...v3.6.21

v3.6.20

What's Changed

• Add Headers.collapseMultiValuedHeaders() by @gavinbunney in #2172

Full Changelog: v3.6.19...v3.6.20

v3.6.19

What's Changed

• Make http2 graceful shutdown timeouts configurable by @jguerra in #2162
• Fix server shutdown hook logic by @jguerra in #2163
• Skip filters with a no-op processContentChunk during chunk processing by @gavinbunney in #2168
• Avoid allocating an iterator per filter in FilterConstraints.isConstrained by @gavinbunney in #2169

Full Changelog: v3.6.18...v3.6.19

v3.6.18

What's Changed

• Resolve FilterConstraints once and key the isConstrained cache by Class by @gavinbunney in #2158
• Add single-pass setAll to Headers that preserves multi-valued headers by @gavinbunney in #2157

Full Changelog: v3.6.17...v3.6.18

v3.6.17

What's Changed

• Add zero-allocation iteration helpers to Headers by @gavinbunney in #2154
• Build origin requests and client responses with the allocation-free Headers iterators by @gavinbunney in #2155

Full Changelog: v3.6.16...v3.6.17

v3.6.16

What's Changed

• Matthoffman/unpin brotli4j by @matthoffman in #2151

Full Changelog: v3.6.15...v3.6.16

v3.6.15

What's Changed

• Re-fix 1xx handling by @matthoffman in #2149

Full Changelog: v3.6.14...v3.6.15