v0.24.48

Changes

fix: panic on concurrent access of statebag (#3915)

httptrace seems to be called concurrently so we can not use unprotected
statebag to pass around the time.Time. Add a new member to the context

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.48 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.48 skipper --help

v0.24.47

Changes

feature: expose invalid routes via support listener API (#3897)

Fixes #3488

Context

Operators in multitenant ingress setups currently have no programmatic
way to discover which routes failed validation — the only option is
grepping logs for "failed to process route" messages. The routeTable
already tracks invalidRoutes []*eskip.Route alongside validRoutes,
but Routing.ServeHTTP unconditionally serves only the valid set.
Invalid routes are silently dropped from the routing table with no API
visibility into what broke or why.

Approach

This extends the existing /routes handler with a ?invalid=true query
parameter rather than adding a separate endpoint. The query param
approach follows @szuecs's guidance in the issue — invalid routes are a
filtered view of the same data, not a distinct resource, and this avoids
new mux registrations or a parallel ServeHTTP implementation.

The harder design decision was how to expose error messages (per
@AlexanderYastrebov's suggestion). The validation errors are computed in
processRouteDefs and newMatcher but were previously only sent to
metrics and discarded. Rather than adding an error field to
eskip.Route (a core type used across the entire codebase for parsing,
serialization, and matching), the errors are stored in a separate
invalidRouteErrors map[string]string on routeTable and merged into
the JSON response via a custom MarshalJSON on InvalidRouteResponse.

Changes

• processRouteDefs returns a third value — error messages keyed by
  route ID — collected from filter, predicate, backend, and matcher
  validation failures
• routeTable gains an invalidRouteErrors field, populated from both
  processRouteDefs and newMatcher error paths in receiveRouteMatcher
• Routing.ServeHTTP switches between validRoutes and invalidRoutes
  based on the invalid query param; all existing behavior (pagination,
  content negotiation, X-Count/X-Timestamp headers) works identically
  for both sets
• InvalidRouteResponse wraps a route with its error string, using
  custom JSON marshaling to merge the error into the route's existing JSON
  structure (necessary because eskip.Route has its own MarshalJSON)
• Documentation added to the "Routing table information" section of
  operation.md

Testing

Five new tests cover the feature surface: JSON response with error field
validation, eskip text format output, HEAD request with correct count,
pagination with offset/limit, and backward compatibility (no param,
?invalid=false, and ?invalid= all return valid routes). All eleven
TestRoutingHandler* tests pass, including the six pre-existing ones —
no regressions.

Notes for Reviewer

• The InvalidRouteResponse.MarshalJSON round-trips through
  json.Marshal → map[string]json.RawMessage → inject error →
  json.Marshal. This is slightly less efficient than direct byte
  manipulation but avoids fragile assumptions about eskip.Route's JSON
  output format. The cost is negligible since this endpoint is only hit by
  operators debugging, not in the request path.
• The issue mentions adding "a new metric for number of invalid routes"
  — individual route metrics already exist via SetInvalidRoute and the
  gauge tracking added in #3550/#3610, so this PR focuses solely on the
  API surface.
• Scope excludes routesrv (cmd/routesrv), which has its own route
  handler and would need separate treatment.

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.47 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.47 skipper --help

v0.24.46

Changes

fix: example eskip backend type Forward (#3913)

fix: example eskip backend type Forward

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.46 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.46 skipper --help

v0.24.45

Changes

build(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 (#3907)

Bumps
docker/setup-buildx-action
from 3.12.0 to 4.0.0.

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.0.0

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in docker/setup-buildx-action#483
• Remove deprecated inputs/outputs by @​crazy-max in docker/setup-buildx-action#464
• Switch to ESM and update config/test wiring by @​crazy-max in docker/setup-buildx-action#481
• Bump @​actions/core from 1.11.1 to 3.0.0 in docker/setup-buildx-action#475
• Bump @​docker/actions-toolkit from 0.63.0 to 0.79.0 in docker/setup-buildx-action#482 docker/setup-buildx-action#485
• Bump js-yaml from 4.1.0 to 4.1.1 in docker/setup-buildx-action#452
• Bump lodash from 4.17.21 to 4.17.23 in docker/setup-buildx-action#472
• Bump minimatch from 3.1.2 to 3.1.5 in docker/setup-buildx-action#480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

Commits

• 4d04d5d Merge pull request #485 from docker/dependabot/npm_and_yarn/docker/actions-to...
• cd74e05 chore: update generated content
• eee38ec build(deps): bump @​docker/actions-toolkit from 0.77.0 to 0.79.0
• 7a83f65 Merge pull request #484 from docker/dependabot/github_actions/docker/setup-qe...
• a5aa967 Merge pull request #464 from crazy-max/rm-deprecated
• e73d53f build(deps): bump docker/setup-qemu-action from 3 to 4
• 28a438e Merge pull request #483 from crazy-max/node24
• 034e9d3 chore: update generated content
• b4664d8 remove deprecated inputs/outputs
• a8257de node 24 as default runtime
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits
  that have been made to it
• @dependabot show <dependency name> ignore conditions will show all
  of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.45 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.45 skipper --help

v0.24.44

Changes

update go to 1.25.8 (#3912)

https://osv.dev/GO-2026-4601
https://osv.dev/GO-2026-4602
https://osv.dev/GO-2026-4603

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.44 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.44 skipper --help

v0.24.43

Changes

Downgrade opa version to last stable (#3911)

Downgrade opa version to last stable.

Later need to update to the new version with this fix
open-policy-agent/opa#8341

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.43 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.43 skipper --help

v0.24.42

Changes

Refactor: matcher use min (#3901)

Refactor: matcher use min

---

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.42 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.42 skipper --help

v0.24.41

Changes

feature: disable metrics compression (#3899)

feature: disable metrics compression

new config flag: -disable-metrics-compression=true

polarsignals profiling finding

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.41 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.41 skipper --help

v0.24.40

Changes

filters/oidc: credentials from secret store (#3896)

fixes #3895

contributor: @schroeniAUDI

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.40 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.40 skipper --help

v0.24.39

Changes

test: logging package (#3890)

test: logging and logging/loggingtest packages

---

Multiarch Docker image

Multiarch Docker image is available in GitHub's docker registry:

docker run -it ghcr.io/zalando/skipper:v0.24.39 skipper --help

Docker image

Docker image is available in Zalando's Open Source registry:

docker run -it registry.opensource.zalan.do/teapot/skipper:v0.24.39 skipper --help