[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
csv (changelog)	3.3.6 → 3.3.7
github.com/grpc-ecosystem/grpc-gateway/v2	v2.32.0 → v2.33.0

---

Release Notes

ruby/csv (csv)

v3.3.7: csv 3.3.7 - 2026-10-28

Compare Source

Improvements

• Improved documents.

  • GH-376
  • Patch by Oskar Eichler

• Improved error handling.

  • GH-378
  • GH-379
  • Reported by sswander

Thanks

• Oskar Eichler

• sswander

grpc-ecosystem/grpc-gateway (github.com/grpc-ecosystem/grpc-gateway/v2)

v2.33.0

Compare Source

Notice to all users

This release contains a security fix that changes the behavior of header parsing in the gateway. As part of fixing #​7281, the decision was made to stop automatically adding client headers with the Grpc-Metadata- prefix into the grpc metadata by default. This behavior can be restored using the new mux option WithLegacyHeaderMatching. See https://grpc-ecosystem.github.io/grpc-gateway/docs/operations/security_considerations/#request-headers-become-grpc-metadata-under-a-prefix for more information.

Changes

• reject non-decimal float spellings in query and path params by @​itecz26 in #​7512
• docs: link example repositories in README by @​wangyusheng1985 in #​7517
• docs: update outdated local proxy documentation (#​912) by @​Asthenia0412 in #​7521
• reject field[key] syntax for non-map fields in query params by @​itecz26 in #​7522
• keep remote address in x-forwarded-for when a client value is invalid by @​itecz26 in #​7531
• let WithMetadata annotators override client-forwarded metadata by @​itecz26 in #​7532
• try GET first for path length fallback so it isn't lost to map order by @​cvas22 in #​7535
• runtime: make strict deep wildcard matching a ServeMux option by @​movsb in #​7533
• apply middlewares to health endpoint regardless of option order by @​cvas22 in #​7537
• keep the Authorization header first in authorization metadata by @​itecz26 in #​7540
• accept form content types with parameters in the path length fallback by @​spicysharkco in #​7538
• keep matching other patterns when the last segment is a bare verb by @​cvas22 in #​7539
• fix(openapiv3): skip bindings with methods OpenAPI 3.1 can't describe by @​LuisFigueroaG in #​7505
• feat(openapiv3): add allow_delete_body option by @​LuisFigueroaG in #​7506
• openapiv2: allow any item type in google.protobuf.ListValue schema by @​cvas22 in #​7551
• don't add an empty path to the field mask for an empty request body by @​cvas22 in #​7552
• Use the httprule parser for openapiv2 path templates by @​anyingiit in #​7562
• Update dependency node to v24 by @​renovate[bot] in #​7543
• fix(gengateway): quote custom HTTP methods without a net/http constant by @​LuisFigueroaG in #​7575
• fix(openapiv3): emit google.protobuf.NullValue fields as null by @​ybai08 in #​7541
• fix(openapiv3): describe server-streaming responses as stream chunks by @​ybai08 in #​7577
• avoid quadratic path building for nested structs in field masks by @​itecz26 in #​7544
• protoc-gen-openapiv2: keep custom ref targets in the naming cache by @​pujitha24 in #​7560
• fix(gengateway): use the embedded field name for response_body types by @​LuisFigueroaG in #​7578
• reject duplicate map keys in jsonpb non-proto decoder by @​itecz26 in #​7561
• return io.EOF from drained ProtoMarshaller decoder by @​itecz26 in #​7567
• fix(openapiv3): omit oneof siblings of path and body fields from query parameters by @​ybai08 in #​7579
• ignore query keys naming the parent of a path-bound field by @​itecz26 in #​7582
• fix(openapiv2): don't put the schema type in format for json_schema types by @​LuisFigueroaG in #​7585
• fix(runtime): parse an empty FieldMask query parameter as an empty mask by @​LuisFigueroaG in #​7586
• fix(descriptor): skip additional_bindings without an HTTP pattern by @​LuisFigueroaG in #​7588
• fix(openapiv2): apply file-level responses to HEAD and OPTIONS operations by @​LuisFigueroaG in #​7592
• drop Grpc-Metadata forwarding from DefaultHeaderMatcher by @​itecz26 in #​7590

New Contributors

• @​wangyusheng1985 made their first contribution in #​7517
• @​Asthenia0412 made their first contribution in #​7521
• @​cvas22 made their first contribution in #​7535
• @​spicysharkco made their first contribution in #​7538
• @​anyingiit made their first contribution in #​7562
• @​ybai08 made their first contribution in #​7541

Full Changelog: grpc-ecosystem/grpc-gateway@v2.32.0...v2.33.0

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am on wednesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ️ Artifact update notice

File name: docs/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
google.golang.org/genproto/googleapis/api	v0.0.0-20261012220534-4341edf3f941 -> v0.0.0-20261026165753-2ffab32bce7e
google.golang.org/genproto/googleapis/rpc	v0.0.0-20261005182115-fad411399dd8 -> v0.0.0-20261019180522-ce908d29299b