$ the-wire · showcase
Consul API gateway backport isolates failing routes
By RepoJournal · Filed · About HashiCorp
A backported fix stops a single misconfigured route from taking down an entire API gateway listener.
Consul's API gateway discovery-chain synthesis now isolates failures per route. In a backport [1], if a single route on a listener fails to compile, synthesis skips and logs that route instead of discarding the entire listener's routing config. Previously, a genuine backend misconfiguration on one route would break every correctly-configured route sharing that listener. The fix is a backport, so it applies to supported release branches.
Security fixes landed across Consul and its tooling for dependencies qs, xmldom, fast-uri, and @babel/runtime. Consul patched qs, xmldom, and fast-uri [2]; ember-cli-api-double patched qs and @babel/runtime [3]. If your build pulls these packages transitively, update to the patched versions to close the vulnerabilities.
Documentation for cluster snapshot retention now removes tier names in favor of "non-development" to stay accurate if cluster tiers are renamed again [4]. The docs repos also ran their standard automated sync between public and private copies [5].
Action items
- → Update Consul to a release containing the backported API gateway bulkheading fix if you run API gateways hashicorp/consul [plan]
- → Apply the dependency security patches for qs, xmldom, fast-uri, and @babel/runtime hashicorp/consul [immediate]
- → Apply the dependency security patches for qs and @babel/runtime in ember-cli-api-double hashicorp/ember-cli-api-double [immediate]
References
- [1] fix: backport api-gateway error bulkheading ↗ hashicorp/consul
- [2] fix sec vuln for qs, xmldom and fast-uri ↗ hashicorp/consul
- [3] fix sec vuln for qs, @babel/run time ↗ hashicorp/ember-cli-api-double
- [4] Update snapshot retention policy for cluster deletion (#3331) ↗ hashicorp/web-unified-docs
- [5] Repo sync ↗ hashicorp/web-unified-docs
