Gateway 5.5.4

Itential Gateway 5.5.4 is a maintenance release containing one enhancement, one bug fix, and one security fix.

Enhancements (1)

Issue	Description
Custom installation directories for the RPM (ENG-28763)	Added support for installing the Gateway 5 RPM to custom directories, such as `/apps`, with `rpm --relocate`. You can relocate each of the four directories independently: `/opt/gateway`, `/etc/gateway`, `/var/log/gateway`, and `/var/lib/gateway`. When you upgrade a relocated installation, repeat the same `--relocate` flags. Otherwise, the upgrade reverts to the default paths.

Bug fixes (1)

Issue Description

Secret references in Basic authentication headers not resolved (ENG-32510) Fixed an issue where Gateway didn’t resolve $GATEWAYSECRET_(...) secret references in Basic authentication headers that were base64-encoded before they reached Gateway. The target system received the literal placeholders as credentials. Gateway now decodes Basic Authorization and Proxy-Authorization headers, resolves the secret references in the username and password, and re-encodes the header before it sends the request. Headers without secret references are forwarded unchanged.

Issue	Description
Secret references in Basic authentication headers not resolved (ENG-32510)	Fixed an issue where Gateway didn’t resolve `$GATEWAYSECRET_(...)` secret references in Basic authentication headers that were base64-encoded before they reached Gateway. The target system received the literal placeholders as credentials. Gateway now decodes Basic `Authorization` and `Proxy-Authorization` headers, resolves the secret references in the username and password, and re-encodes the header before it sends the request. Headers without secret references are forwarded unchanged.

Security fixes (1)

Issue	Description
Updated Go and golang.org/x/net (ENG-30748, ENG-30747)	Updated Go to 1.26.10 and `golang.org/x/net` to v0.60.0 to resolve 12 vulnerabilities in the Go standard library and networking packages, including CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, and CVE-2026-78669.