LoginSign Up
← Back to all sparks
S

Skipper

INFRA · APIS
Velocity5.0

HTTP router and reverse proxy for service composition

opensource.zalando.com/skipper ↗

One pull request per version tag, and most of them are dependency bumps.

http-proxykubernetes-ingressper-pr-releasesdependabotopa-policymaintenance
◆Current state
Skipper cuts a release for essentially every merged pull request — six tags between 27 July and 7 August, each containing a single change. Two of the six are Dependabot bumps to CI actions and a fuzzing base image, two are test-only adjustments, and one fixes an error type assertion. Every entry carries the same boilerplate pointing at the multiarch image in GitHub's registry.
◆Where it's heading
The visible work is maintenance of an already-stable proxy rather than feature development. What the test changes hint at is where the correctness concerns sit: an OPA policy test updated to explicitly deny truncated request bodies, because oversized JSON cannot be fully parsed and a policy that ignores input.truncated_body can be bypassed. That is authorization-under-load hardening, and it is the most interesting thing in the window even though it landed as a test.
◆Prediction
The per-PR tagging rhythm will continue producing several versions a week regardless of change size. Readers tracking this product should expect the meaningful changes to be a small minority of the tags.

◆Recent moves

  1. 1d ago

    Skipper 0.27.45 fixes the proxy listener on an insecure address

    The one entry in this run that changes runtime behavior: a fix to the proxy listener binding on an insecure address. In a feed dominated by dependency bumps and test edits, this is the release with actual operator impact.

    View source ↗
  2. 2d ago

    Skipper 0.27.44 fixes an inverted mTLS test readiness check

    Corrects an inverted readiness check in the mTLS routesrv test, which was giving up on the first connection error instead of retrying until health returned 204. Test infrastructure only, tagged as its own release per this project's convention.

    View source ↗
  3. 3d ago

    Skipper 0.27.43 fixes an error type assertion

    A one-line error type assertion fix, released as its own version. A clear illustration of the per-pull-request tagging pattern this project follows.

    View source ↗
  4. 4d ago

    Skipper 0.27.42 hardens an OPA test against truncated bodies

    Updates an OPA test policy to deny truncated request bodies, on the reasoning that oversized JSON cannot be fully parsed so policies must handle input.truncated_body explicitly. A test change, but one documenting a real policy-bypass shape worth knowing about.

    View source ↗
  5. 12d ago

    Skipper 0.27.41 bumps actions/setup-python in CI

    A Dependabot bump of actions/setup-python from 6.3.0 to 7.0.0 in CI. No effect on the shipped proxy.

    View source ↗
  6. 12d ago

    Skipper 0.27.40 bumps the ClusterFuzzLite base image

    A Dependabot bump of the ClusterFuzzLite base builder image, tagged thirty minutes before the next release. Pure fuzzing-infrastructure upkeep.

    View source ↗