chore: Update all non-major dependencies (v3.x.x)

api-catalog-ui/frontend/package.json

@@ -92,7 +92,7 @@
         "ajv": "8.20.0",
         "ansi-regex": "6.2.2",
         "babel-plugin-transform-vite-meta-env": "1.0.3",
-        "body-parser": "2.2.2",
+        "body-parser": "2.3.0",
         "caniuse-lite": "1.0.30001799",
         "concurrently": "9.2.1",
         "cors": "2.8.6",
@@ -139,7 +139,7 @@
     "overrides": {
         "openapi-snippet": {
             "openapi-sampler": {
-                "fast-xml-parser": "5.8.0"
+                "fast-xml-parser": "5.9.0"
             }
         },
         "cosmiconfig": {

gateway-service/src/main/java/org/zowe/apiml/gateway/filters/proxyheaders/X509AndGwAwareXForwardedHeadersFilter.java

@@ -56,6 +56,11 @@
 @Slf4j
 public class X509AndGwAwareXForwardedHeadersFilter extends XForwardedHeadersFilter {
 
+    // Order must be higher than RemoveXForwardedHeadersFilter (0) so this filter
+    // runs AFTER SCG has stripped untrusted headers — allowing trust evaluation
+    // on the original request headers and emitting the final header set.
+    public static final int ORDER_AFTER_REMOVE_XFW_HEADERS = 1;
+
     // Generic all-in-one Forwarded header not handled by the default spring filter
     public static final String FORWARDED_HEADER = "Forwarded";
 
@@ -93,9 +98,17 @@ public X509AndGwAwareXForwardedHeadersFilter(
         this.isProxyTrusted = isTrusted;
     }
 
+    @Override
+    public int getOrder() {
+        return ORDER_AFTER_REMOVE_XFW_HEADERS;
+    }
+
     @Override
     public HttpHeaders filter(HttpHeaders input, ServerWebExchange exchange) {
-        if (!hasXForwardedHeader(input)) return super.filter(input, exchange);
+        // SCG 4.3.5+ introduces RemoveXForwardedHeadersFilter which strips
+        // X-Forwarded headers from 'input' before this filter runs.
+        // Check the original request headers to detect incoming X-Forwarded headers.
+        if (!hasXForwardedHeader(exchange.getRequest().getHeaders())) return super.filter(input, exchange);
 
         boolean trustedSourceByX509 = Optional.ofNullable(exchange.getRequest().getSslInfo())
             .map(SslInfo::getPeerCertificates)
@@ -132,7 +145,9 @@ public InetSocketAddress getRemoteAddress() {
                 return super.filter(removeXForwardHttpHeaders(input), sanitizedExchange);
             }
         }
-        return super.filter(input, exchange);
+        // Trusted — use the original request headers to preserve X-Forwarded info
+        // that RemoveXForwardedHeadersFilter may have stripped from 'input'
+        return super.filter(exchange.getRequest().getHeaders(), exchange);
     }
 
     private HttpHeaders removeXForwardHttpHeaders(HttpHeaders input) {

gradle/versions.gradle

@@ -10,7 +10,7 @@ dependencyResolutionManagement {
             version('springCloudNetflix', '4.3.3')
             version('springCloudCommons', '4.3.3')
             version('springCloudCB', '3.3.3')
-            version('springCloudGateway', '4.3.4')
+            version('springCloudGateway', '4.3.5')
             version('springFramework', '6.2.19')
             version('springRetry', '2.0.13')