Releases: cloudfoundry/routing-release
Releases · cloudfoundry/routing-release
0.379.0
0.379.0
Release Date: April 21, 2026
Changes
- Upgrade routing-healthchecker - Author: App Platform Runtime Working Group CI Bot - SHA: d3e116e
- fix: Use OS-assigned ports to prevent cross-suite port collisions - Author: Clemens Hoffmann - SHA: ee826a5
- fix: Use dynamic port for debug server in integration tests - Author: Clemens Hoffmann - SHA: 8ed0d8c
- fix: Stop router before NATS in AfterEach to prevent proc crash - Author: Clemens Hoffmann - SHA: b2bf830
- fix: Add nil check before err.Error() in SSL port refusal test - Author: Clemens Hoffmann - SHA: 7d46eb7
- fix: Add 10s timeout to all HTTP clients in router test suite - Author: Clemens Hoffmann - SHA: 62a6a19
- fix: Guard println with nil check to prevent proc crash on nil error - Author: Clemens Hoffmann - SHA: 2474743
- fix: Update requestTimeout in keep-alive test to match EndpointTimeout - Author: Clemens Hoffmann - SHA: 7e506e7
- Fix flaky keep-alive and 100-Continue router tests - Author: Clemens Hoffmann - SHA: d683a0f
- Replace Eventually(...).ShouldNot with Consistently(...).ShouldNot - Author: Clemens Hoffmann - SHA: 191ee35
- Add timeout to health check HTTP client in router test - Author: Clemens Hoffmann - SHA: 5512b6f
- Use global defaultEventuallyTimeout 10s - Author: Clemens Hoffmann - SHA: cc19c34
- Fix flaky router and integration tests by setting explicit Eventually timeout - Author: Clemens Hoffmann - SHA: 7662465
- Fix data race in registry heartbeat-based pruning test - Author: Clemens Hoffmann - SHA: ad9d4d8
Go Packages Updates
- Bumped go.mod package 'code.cloudfoundry.org/cfhttp/v2' from 'v2.73.0' to 'v2.74.0'
- Bumped go.mod package 'code.cloudfoundry.org/clock' from 'v1.65.0' to 'v1.66.0'
- Bumped go.mod package 'code.cloudfoundry.org/debugserver' from 'v0.91.0' to 'v0.92.0'
- Bumped go.mod package 'code.cloudfoundry.org/diego-logging-client' from 'v0.100.0' to 'v0.101.0'
- Bumped go.mod package 'code.cloudfoundry.org/durationjson' from 'v0.68.0' to 'v0.69.0'
- Bumped go.mod package 'code.cloudfoundry.org/eventhub' from 'v0.68.0' to 'v0.69.0'
- Bumped go.mod package 'code.cloudfoundry.org/lager/v3' from 'v3.65.0' to 'v3.66.0'
- Bumped go.mod package 'code.cloudfoundry.org/localip' from 'v0.67.0' to 'v0.68.0'
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.50.0' to 'v0.51.0'
- Bumped go.mod package 'github.com/honeycombio/libhoney-go' from 'v1.26.0' to 'v1.27.1'
- Bumped go.mod package 'github.com/jackc/pgx/v5' from 'v5.9.1' to 'v5.9.2'
- Bumped go.mod package 'github.com/nats-io/nats-server/v2' from 'v2.12.6' to 'v2.12.7'
- Bumped go.mod package 'github.com/nats-io/nats.go' from 'v1.50.0' to 'v1.51.0'
- Bumped go.mod package 'github.com/tedsuo/ifrit' from 'v0.0.0-20230516164442-7862c310ad26' to 'v0.0.0-20260418191334-846868129986'
- Bumped go.mod package 'google.golang.org/genproto/googleapis/rpc' from 'v0.0.0-20260406210006-6f92a3bedf2d' to 'v0.0.0-20260414002931-afd174a4e478'
Go Package Updates for nats-client
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.50.0' to 'v0.51.0'
- Bumped go.mod package 'github.com/nats-io/nats.go' from 'v1.50.0' to 'v1.51.0'
✨ Built with go 1.25.9
Full Changelog: v0.378.0...v0.379.0
Resources
0.378.0
0.378.0
Release Date: April 15, 2026
This release introduces support for __Host--prefixed session cookies, and a new Prometheus metric endpoints_per_pool which provides the number of instances for each pool configured with hash-based routing.
Changes
- fix: Handle empty LoadBalancingAlgorithm in pool and update subscriber test expectations - Author: Clemens Hoffmann - SHA: 99c70b2
- fix: Re-add linter ignore command to fake_varzreporter (#553) - Author: Clemens Hoffmann - SHA: aa4ab18
- feat: Support __Host- prefixed session cookies for sticky sessions (#549) - Author: Clemens Hoffmann - SHA: ecde9d4
- feat: Add endpoints_per_pool Prometheus metric for hash-based routing (#550) - Author: Clemens Hoffmann - SHA: 2f28706
- fix: Per-route load balancing algorithm not reverting to platform default on removal (#552) - Author: Clemens Hoffmann - SHA: 34c3f9d
✨ Built with go 1.25.9
Full Changelog: v0.377.0...v0.378.0
Resources
0.377.0
0.377.0
Release Date: April 13, 2026
Changes
- Upgrade routing-healthchecker - Author: App Platform Runtime Working Group CI Bot - SHA: a49b560
Go Packages Updates
- Bumped go.mod package 'code.cloudfoundry.org/cfhttp/v2' from 'v2.72.0' to 'v2.73.0'
- Bumped go.mod package 'code.cloudfoundry.org/clock' from 'v1.64.0' to 'v1.65.0'
- Bumped go.mod package 'code.cloudfoundry.org/debugserver' from 'v0.90.0' to 'v0.91.0'
- Bumped go.mod package 'code.cloudfoundry.org/diego-logging-client' from 'v0.99.0' to 'v0.100.0'
- Bumped go.mod package 'code.cloudfoundry.org/durationjson' from 'v0.67.0' to 'v0.68.0'
- Bumped go.mod package 'code.cloudfoundry.org/eventhub' from 'v0.67.0' to 'v0.68.0'
- Bumped go.mod package 'code.cloudfoundry.org/go-metric-registry' from 'v0.0.0-20260401052628-da46951e1a8b' to 'v0.0.0-20260409052016-6e68d03a192f'
- Bumped go.mod package 'code.cloudfoundry.org/lager/v3' from 'v3.64.0' to 'v3.65.0'
- Bumped go.mod package 'code.cloudfoundry.org/localip' from 'v0.66.0' to 'v0.67.0'
- Bumped go.mod package 'golang.org/x/crypto' from 'v0.49.0' to 'v0.50.0'
- Bumped go.mod package 'golang.org/x/mod' from 'v0.34.0' to 'v0.35.0'
- Bumped go.mod package 'golang.org/x/net' from 'v0.52.0' to 'v0.53.0'
- Bumped go.mod package 'golang.org/x/sys' from 'v0.42.0' to 'v0.43.0'
- Bumped go.mod package 'golang.org/x/text' from 'v0.35.0' to 'v0.36.0'
- Bumped go.mod package 'golang.org/x/tools' from 'v0.43.0' to 'v0.44.0'
- Bumped go.mod package 'google.golang.org/genproto/googleapis/rpc' from 'v0.0.0-20260401024825-9d38bb4040a9' to 'v0.0.0-20260406210006-6f92a3bedf2d'
Go Package Updates for nats-client
- Bumped go.mod package 'golang.org/x/crypto' from 'v0.49.0' to 'v0.50.0'
- Bumped go.mod package 'golang.org/x/sys' from 'v0.42.0' to 'v0.43.0'
✨ Built with go 1.25.9
Full Changelog: v0.376.0...v0.377.0
Resources
0.376.0
0.376.0
Release Date: April 10, 2026
Changes
- Upgrade golang-1.25-linux (1.25.9) - Author: App Platform Runtime Working Group CI Bot - SHA: 9b8053c
✨ Built with go 1.25.9
Full Changelog: v0.375.0...v0.376.0
Resources
0.375.0
0.375.0
Release Date: April 06, 2026
Changes
- feat: Support multiple JSESSIONID cookies for CHIPS migration - Author: Clemens Hoffmann - SHA: 82b744c
- Merge pull request #547 from cloudfoundry/TNZ-79284-route-services-tls - Author: Amelia Downs - SHA: 9c2b980
- Restrict cipher suites on internal route services port (7070) - Author: Amelia Downs - SHA: fa2a42a
- Merge pull request #548 from kart2bc/gh-determineimage - Author: Amelia Downs - SHA: fcc214d
- include determine image tag to pick go version - Author: karthick udayakumar - SHA: ae041aa
- docs: Update the documentation - Author: Pascal Zimmermann - SHA: e26a9d3
- docs: Update the documentation - Author: Pascal Zimmermann - SHA: 4265d17
- feat: Update the error handling of the script and the jq command - Author: Pascal Zimmermann - SHA: 9dab422
- feat: Update the execution permissions of the script and the documetation - Author: Pascal Zimmermann - SHA: 9e39c5e
- docs: Add documentation to run the RATS on you CF on KIND setup - Author: Pascal Zimmermann - SHA: b4f6219
Changes for routing-api
- docs: Update the documentation - Author: Pascal Zimmermann - SHA: fbc073c74b125e9a9b215a674fa0fa6c740d93bd
- docs: Add documentation to run the RATS on you CF on KIND setup - Author: Pascal Zimmermann - SHA: 7735b9986bc947dbdcc0bf4316de88f19f301d19
Go Packages Updates
- Bumped go.mod package 'code.cloudfoundry.org/diego-logging-client' from 'v0.98.0' to 'v0.99.0'
- Bumped go.mod package 'code.cloudfoundry.org/go-metric-registry' from 'v0.0.0-20260325091030-e6272bdc60ad' to 'v0.0.0-20260401052628-da46951e1a8b'
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.49.0' to 'v0.50.0'
- Bumped go.mod package 'github.com/google/pprof' from 'v0.0.0-20260302011040-a15ffb7f9dcc' to 'v0.0.0-20260402051712-545e8a4df936'
- Bumped go.mod package 'github.com/lib/pq' from 'v1.12.0' to 'v1.12.3'
- Bumped go.mod package 'go.step.sm/crypto' from 'v0.77.1' to 'v0.77.2'
- Bumped go.mod package 'google.golang.org/genproto/googleapis/rpc' from 'v0.0.0-20260319201613-d00831a3d3e7' to 'v0.0.0-20260401024825-9d38bb4040a9'
- Bumped go.mod package 'google.golang.org/grpc' from 'v1.79.3' to 'v1.80.0'
Go Package Updates for nats-client
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.49.0' to 'v0.50.0'
✨ Built with go 1.25.8
Full Changelog: v0.374.0...v0.375.0
Resources
0.374.0
0.374.0
Release Date: March 30, 2026
This release introduces Hash-Based Load Balancing — a new load-balancing algorithm. Currently, this feature is marked as experimental. Use at your own risk and feel free to provide feedback or report bugs.
This load-balancing algorithm distributes requests to endpoints based on the value of a configured HTTP request header. This allows routing requests with the same header value to the same application instance. To avoid overloading a single instance, an optional balance factor can be configured.
The new load-balancing algorithm can be set as a per-route option by setting loadbalancing=hash. It introduces two new per-route options, both only available when hash is set as load balancer:
hash_header: Required whenloadbalancing=hash. Defines the HTTP request header name whose value determines which application instance a request is routed to.hash_balance: Optional whenloadbalancing=hash. Defines the maximum ratio of requests to a particular application instance compared to the average across all instances. For example, with a factor of 2.0, the load on each instance may be at most 200% of the average load. When not specified, load balancing is disabled and requests are routed strictly by hash.
Note: Documentation will be updated and enhanced shortly after this release.
Changes
Go Packages Updates
- Bumped go.mod package 'code.cloudfoundry.org/bbs' from 'v0.0.0-20260319204745-f9b7322ba965' to 'v0.0.0-20260323203855-1402bd61fc46'
- Bumped go.mod package 'code.cloudfoundry.org/debugserver' from 'v0.89.0' to 'v0.90.0'
- Bumped go.mod package 'code.cloudfoundry.org/diego-logging-client' from 'v0.97.0' to 'v0.98.0'
- Bumped go.mod package 'code.cloudfoundry.org/go-metric-registry' from 'v0.0.0-20260316221732-b5ae994e6b10' to 'v0.0.0-20260325091030-e6272bdc60ad'
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.48.0' to 'v0.49.0'
- Bumped go.mod package 'github.com/jackc/pgx/v5' from 'v5.9.0' to 'v5.9.1'
- Bumped go.mod package 'github.com/nats-io/nats-server/v2' from 'v2.12.5' to 'v2.12.6'
- Bumped go.mod package 'github.com/nats-io/nats.go' from 'v1.49.0' to 'v1.50.0'
Go Package Updates for nats-client
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.48.0' to 'v0.49.0'
- Bumped go.mod package 'github.com/nats-io/nats.go' from 'v1.49.0' to 'v1.50.0'
✨ Built with go 1.25.8
Full Changelog: v0.373.0...v0.374.0
Resources
0.373.0
0.373.0
Release Date: March 27, 2026
Changes
- (fix): Fix sticky session refreshing - Author: Clemens Hoffmann - SHA: 6ebb286
- Use valid CIDR in test - Author: Clemens Hoffmann - SHA: ab8362b
- Fix wrong test description and indent - Author: Clemens Hoffmann - SHA: 7c48c82
- Upgrade routing-healthchecker - Author: App Platform Runtime Working Group CI Bot - SHA: 4983025
- Fix and improve documentation across routing-release docs. - Author: Clemens Hoffmann - SHA: 9037610
✨ Built with go 1.25.8
Full Changelog: v0.372.0...v0.373.0
Resources
0.372.0
0.372.0
Release Date: March 23, 2026
❗BREAKING CHANGE ❗
- Using the new default configuration, users can no longer access internal network ranges via route-services, see https://github.com/cloudfoundry/routing-release/blob/a39cee143bf82c6ae5d374101bce1166506dc4cd/jobs/gorouter/spec#L250-L257.
- The feature was implemented from routing-release 0.369.0 via #537
- The default configuration was adjusted applying the secure-by-default principle via #542
- The new default spec reverts the default ASGs: https://docs.cloudfoundry.org/concepts/asg.html#default-asg
- This fixes CVE-2026-22726
- If an operator wants to keep allowing this, the property needs to be overwritten:
- type: replace
path: /instance_groups/name=router/jobs/name=gorouter/properties/router/route_services?/egress_blocklist
value: []
Changes
- Revert "Apply TLS cipher and version settings to internal route services port (7070)" - Author: Amelia Downs - SHA: 23822f3
- feat: add CF private IPs as route-service blocklist defaults (#542) - Author: Patrick Lowin - SHA: 86b61c9
Changes for routing-api
- ai-assisted=yes Codify what was previously considered a bug in Routing Api - Author: Geoff Franks - SHA: a90e7de18be7907dba0203df4b0f312b740ac0a0
Blob Updates
- Bumped blob 'haproxy/haproxy-2.8.19.tar.gz' to 'haproxy/haproxy-2.8.20.tar.gz'
Go Packages Updates
- Bumped go.mod package 'code.cloudfoundry.org/bbs' from 'v0.0.0-20260218135931-a998cae3b567' to 'v0.0.0-20260319204745-f9b7322ba965'
- Bumped go.mod package 'code.cloudfoundry.org/cfhttp/v2' from 'v2.71.0' to 'v2.72.0'
- Bumped go.mod package 'code.cloudfoundry.org/clock' from 'v1.63.0' to 'v1.64.0'
- Bumped go.mod package 'code.cloudfoundry.org/debugserver' from 'v0.88.0' to 'v0.89.0'
- Bumped go.mod package 'code.cloudfoundry.org/diego-logging-client' from 'v0.96.0' to 'v0.97.0'
- Bumped go.mod package 'code.cloudfoundry.org/durationjson' from 'v0.66.0' to 'v0.67.0'
- Bumped go.mod package 'code.cloudfoundry.org/eventhub' from 'v0.66.0' to 'v0.67.0'
- Bumped go.mod package 'code.cloudfoundry.org/go-metric-registry' from 'v0.0.0-20260303102542-76ee3e2b6585' to 'v0.0.0-20260316221732-b5ae994e6b10'
- Bumped go.mod package 'code.cloudfoundry.org/lager/v3' from 'v3.63.0' to 'v3.64.0'
- Bumped go.mod package 'code.cloudfoundry.org/localip' from 'v0.65.0' to 'v0.66.0'
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.47.0' to 'v0.48.0'
- Bumped go.mod package 'github.com/antithesishq/antithesis-sdk-go' from 'v0.6.0' to 'v0.7.0'
- Bumped go.mod package 'github.com/jackc/pgx/v5' from 'v5.8.0' to 'v5.9.0'
- Bumped go.mod package 'github.com/klauspost/compress' from 'v1.18.4' to 'v1.18.5'
- Bumped go.mod package 'github.com/lib/pq' from 'v1.11.2' to 'v1.12.0'
- Bumped go.mod package 'github.com/minio/highwayhash' from 'v1.0.4-0.20251030100505-070ab1a87a76' to 'v1.0.4'
- Bumped go.mod package 'github.com/nats-io/jwt/v2' from 'v2.8.0' to 'v2.8.1'
- Bumped go.mod package 'go.step.sm/crypto' from 'v0.76.2' to 'v0.77.1'
- Bumped go.mod package 'google.golang.org/genproto/googleapis/rpc' from 'v0.0.0-20260311181403-84a4fc48630c' to 'v0.0.0-20260319201613-d00831a3d3e7'
- Bumped go.mod package 'google.golang.org/grpc' from 'v1.79.2' to 'v1.79.3'
Go Package Updates for nats-client
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.47.0' to 'v0.48.0'
- Bumped go.mod package 'github.com/klauspost/compress' from 'v1.18.4' to 'v1.18.5'
Bosh Job Spec changes:
diff --git a/jobs/gorouter/spec b/jobs/gorouter/spec
index c7b6a7934..8e7a93cf2 100644
--- a/jobs/gorouter/spec
+++ b/jobs/gorouter/spec
@@ -250,7 +250,11 @@ properties:
router.route_services.egress_blocklist:
description: |
Route Service Requests to these CIDRs will be blocked with HTTP status code 502.
- default: []
+ default:
+ - 10.0.0.0/8
+ - 169.254.0.0/16
+ - 172.16.0.0/12
+ - 192.168.0.0/16
router.route_services.cert_chain:
description: Certificate chain used for client authentication to TLS-registered route services. In PEM format.
router.route_services.private_key:
✨ Built with go 1.25.8
Full Changelog: v0.371.0...v0.372.0
Resources
0.371.0
0.371.0
Release Date: March 19, 2026
Changes
- Apply TLS cipher and version settings to internal route services port (7070) - Author: Amelia Downs - SHA: 006b547
✨ Built with go 1.25.8
Full Changelog: v0.370.0...v0.371.0
Resources
0.370.0
0.370.0
Release Date: March 16, 2026
Changes
- Upgrade routing-healthchecker - Author: App Platform Runtime Working Group CI Bot - SHA: 50a0c75
- Merge pull request #538 from sap-contributions/gorouter-route-srv-egress-blocklist-2 - Author: Amelia Downs - SHA: 5c4094e
- Spec tests for route service egress blocklist - Author: Daria - SHA: e559d80
Go Packages Updates
- Bumped go.mod package 'code.cloudfoundry.org/cfhttp/v2' from 'v2.70.0' to 'v2.71.0'
- Bumped go.mod package 'code.cloudfoundry.org/clock' from 'v1.62.0' to 'v1.63.0'
- Bumped go.mod package 'code.cloudfoundry.org/debugserver' from 'v0.87.0' to 'v0.88.0'
- Bumped go.mod package 'code.cloudfoundry.org/diego-logging-client' from 'v0.94.0' to 'v0.96.0'
- Bumped go.mod package 'code.cloudfoundry.org/durationjson' from 'v0.65.0' to 'v0.66.0'
- Bumped go.mod package 'code.cloudfoundry.org/eventhub' from 'v0.65.0' to 'v0.66.0'
- Bumped go.mod package 'code.cloudfoundry.org/lager/v3' from 'v3.62.0' to 'v3.63.0'
- Bumped go.mod package 'code.cloudfoundry.org/localip' from 'v0.64.0' to 'v0.65.0'
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.46.0' to 'v0.47.0'
- Bumped go.mod package 'github.com/nats-io/nats-server/v2' from 'v2.12.4' to 'v2.12.5'
- Removed go.mod package 'go.uber.org/automaxprocs' version 'v1.6.0'
- Bumped go.mod package 'golang.org/x/crypto' from 'v0.48.0' to 'v0.49.0'
- Bumped go.mod package 'golang.org/x/mod' from 'v0.33.0' to 'v0.34.0'
- Bumped go.mod package 'golang.org/x/net' from 'v0.51.0' to 'v0.52.0'
- Bumped go.mod package 'golang.org/x/oauth2' from 'v0.35.0' to 'v0.36.0'
- Bumped go.mod package 'golang.org/x/sync' from 'v0.19.0' to 'v0.20.0'
- Bumped go.mod package 'golang.org/x/sys' from 'v0.41.0' to 'v0.42.0'
- Bumped go.mod package 'golang.org/x/text' from 'v0.34.0' to 'v0.35.0'
- Bumped go.mod package 'golang.org/x/time' from 'v0.14.0' to 'v0.15.0'
- Bumped go.mod package 'golang.org/x/tools' from 'v0.42.0' to 'v0.43.0'
- Bumped go.mod package 'google.golang.org/genproto/googleapis/rpc' from 'v0.0.0-20260226221140-a57be14db171' to 'v0.0.0-20260311181403-84a4fc48630c'
Go Package Updates for nats-client
- Bumped go.mod package 'code.cloudfoundry.org/tlsconfig' from 'v0.46.0' to 'v0.47.0'
- Bumped go.mod package 'golang.org/x/crypto' from 'v0.48.0' to 'v0.49.0'
- Bumped go.mod package 'golang.org/x/sys' from 'v0.41.0' to 'v0.42.0'
✨ Built with go 1.25.8
Full Changelog: v0.369.0...v0.370.0