From a02cb7ecd2620c837508489436d0a792dd7fed17 Mon Sep 17 00:00:00 2001 From: Abhishek Choudhary Date: Thu, 20 Aug 2026 14:27:51 +0545 Subject: [PATCH] chore: release 3.18.0 Signed-off-by: Abhishek Choudhary --- .requirements | 2 +- CHANGELOG.md | 179 +++++++++++++++++++++++++++++++++++++ apisix/core/version.lua | 2 +- ci/check_changelog_prs.ts | 5 ++ docs/en/latest/config.json | 2 +- docs/zh/latest/config.json | 2 +- 6 files changed, 188 insertions(+), 4 deletions(-) diff --git a/.requirements b/.requirements index 9c76f3ee01d3..215b4f93b283 100644 --- a/.requirements +++ b/.requirements @@ -18,4 +18,4 @@ APISIX_PACKAGE_NAME=apisix APISIX_RUNTIME=1.3.16 -APISIX_DASHBOARD_COMMIT=c8d3466d3c36386d3888efbc8250cd8183c77298 +APISIX_DASHBOARD_COMMIT=045e3142867e3b7d5d1b8ec40bf8f66a7ce24a64 diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e0e1e60ce8e..e2ab2afb1f9d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,7 @@ title: Changelog ## Table of Contents +- [3.18.0](#3180) - [3.17.0](#3170) - [3.16.0](#3160) - [3.15.0](#3150) @@ -85,6 +86,184 @@ title: Changelog - [0.7.0](#070) - [0.6.0](#060) +## 3.18.0 + +**The changes marked with :warning: are not backward compatible.** + +### Change + +- :warning: change(debug): report executed plugins with phase in execution order. The `Apisix-Plugins` debug header now carries `name#phase` entries in execution order instead of a de-duplicated plugin-name list [#13710](https://github.com/apache/apisix/pull/13710) +- :warning: feat: bound request and response body buffering in plugins. `max_req_body_size` / `max_resp_body_size` (default 64 MiB) added to ~19 plugins; larger bodies are now rejected or truncated instead of being buffered without limit [#13705](https://github.com/apache/apisix/pull/13705) +- :warning: fix(batch-processor): bound the pending entries backlog by default. Every batch-processor logger now defaults `max_pending_entries` to 8192 and discards entries above it [#13826](https://github.com/apache/apisix/pull/13826) +- :warning: refactor(ai-aws-content-moderation): moderate decoded LLM content in the access phase. Priority moved from 1050 to 1031, the plugin now requires ai-proxy/ai-proxy-multi, moderates the extracted prompt instead of the raw body, and denies with `deny_code` (default 200) instead of 400 [#13647](https://github.com/apache/apisix/pull/13647) +- :warning: feat(ai-aliyun-content-moderation): role-aware `request_check_mode` and O(n) content chunking. Request moderation now covers the user role of the latest turn by default instead of every message in the body [#13598](https://github.com/apache/apisix/pull/13598) +- :warning: fix(sls-logger): verify the TLS certificate of the log server. New `ssl_verify` option, default `true` [#13785](https://github.com/apache/apisix/pull/13785) +- :warning: fix(openid-connect): enforce audience, issuer and required scopes. Bearer introspection fails closed when the discovery document is unavailable, `claim_validator.audience.match_with_client_id` now implies `required`, and `required_scopes` is enforced on session (authorization code) flows [#13829](https://github.com/apache/apisix/pull/13829) +- :warning: fix(admin): reject duplicate consumer authentication keys instead of silently accepting them [#13529](https://github.com/apache/apisix/pull/13529) +- :warning: perf(core): sanitize the `X-Forwarded-*` headers in the NGINX config. `$var_x_forwarded_proto` is removed, while `$var_x_forwarded_host` and `$var_x_forwarded_port` are no longer writable from Lua, and a trusted peer that sends no `X-Forwarded-Host`/`X-Forwarded-Port` now receives the APISIX-observed values instead of falling through to `$host`/`$server_port` [#13803](https://github.com/apache/apisix/pull/13803) +- :warning: feat: add `max_post_args_readable_size` to bound `post_arg.*` body reads. A request body above the 64 MiB default no longer resolves `post_arg.*`, so routes matching on those predicates stop matching it; raise the value or set it to `0` to restore the previous unbounded behavior [#13601](https://github.com/apache/apisix/pull/13601) +- :warning: fix(ldap-auth): `tls_verify: true` now performs real certificate verification, which the previously pinned `lua-resty-ldap` silently ignored; an LDAP server with a self-signed or hostname-mismatched certificate must present a trusted certificate, or verification has to be turned off explicitly [#13762](https://github.com/apache/apisix/pull/13762) +- :warning: fix(ldap-auth): key the consumer lookup on the escaped bind DN. A consumer whose `user_dn` was written in the previous unescaped form stops matching once the username contains RFC 4514 structural characters; rewrite such values in escaped form, e.g. `cn=comma\,user,ou=users,dc=example,dc=org` [#13805](https://github.com/apache/apisix/pull/13805) +- :warning: feat(prometheus): add built-in LLM histograms for TTFT and token distribution. `apisix_llm_latency` gains a `type` label and streaming requests now emit both `type="total"` and `type="ttft"`, so existing queries, dashboards and alerts must select `type="total"` [#13487](https://github.com/apache/apisix/pull/13487) +- :warning: feat(ai-plugins): add `fail_mode` for Consumer-bound protocol handling. Its `skip` default lets unrecognized or non-AI traffic through instead of failing: `ai-aliyun-content-moderation` and `ai-prompt-guard` no longer return an error, and `ai-aws-content-moderation` no longer moderates a non-JSON body as raw text. Set `fail_mode: error` where such traffic must be rejected [#13489](https://github.com/apache/apisix/pull/13489) + +### Core + +- feat: raise default sizes for non-evictable shared dicts: `prometheus-metrics` 15m/10m→128m, `nacos` 10m→64m, consul and kubernetes discovery `shared_size` 1m→64m, `tracing_buffer` 10m→32m [#13688](https://github.com/apache/apisix/pull/13688) +- chore(core): remove the dead `clean_handlers` mechanism. `core.config_util.add_clean_handler`, `cancel_clean_handler` and `fire_all_clean_handlers` no longer exist [#13761](https://github.com/apache/apisix/pull/13761) +- feat(ai-proxy): send LLM requests through `ngx_http_ffi_client`. New `plugin_attr.ai-proxy.http_client`, defaulting to the FFI client, which ships with the APISIX-Runtime pinned by this release; on a hand-built runtime without the module, set `plugin_attr.ai-proxy.http_client: lua-resty-http` [#13778](https://github.com/apache/apisix/pull/13778) +- feat: support per-port PROXY protocol for stream TCP proxy [#13561](https://github.com/apache/apisix/pull/13561) +- feat(stream): support `set_real_ip_from` to trust an inbound PROXY protocol header [#13700](https://github.com/apache/apisix/pull/13700) +- feat(stream): support upstream client certificate (mTLS) in the L4 proxy [#13596](https://github.com/apache/apisix/pull/13596) +- feat(router): add `match_uri_encoded_slash` to keep `%2F` in path parameters [#13626](https://github.com/apache/apisix/pull/13626) +- feat: support `http_method` and `http_req_body` in active health checks [#13726](https://github.com/apache/apisix/pull/13726) +- feat(data_encryption): support AES-256 keys in the encryption keyring [#13756](https://github.com/apache/apisix/pull/13756) +- refactor: decouple generic data encryption from `ssl.lua` [#13564](https://github.com/apache/apisix/pull/13564) +- perf(plugin): reuse the filtered global-rule plugin set across phases [#13779](https://github.com/apache/apisix/pull/13779) +- fix: keep the chash ring stable during health changes [#13532](https://github.com/apache/apisix/pull/13532) +- fix(balancer): keep least_conn load state across upstream scaling [#13666](https://github.com/apache/apisix/pull/13666) +- fix(balancer): separate the keepalive pool by referenced client cert [#13587](https://github.com/apache/apisix/pull/13587) +- fix(healthcheck): reuse the checker on node-only upstream changes instead of destroy-and-rebuild [#13629](https://github.com/apache/apisix/pull/13629) +- fix(healthcheck): probe domain nodes by the node domain, not the resolved IP [#13743](https://github.com/apache/apisix/pull/13743) +- fix(healthcheck): purge stale targets and release the periodic lock [#13627](https://github.com/apache/apisix/pull/13627) +- fix(healthcheck): guard `construct_upstream` in healthcheck timers [#13592](https://github.com/apache/apisix/pull/13592) +- fix(stream): initialize env and secret for TLS cert resolution [#12935](https://github.com/apache/apisix/pull/12935) +- fix: fetch secrets from the upstream ssl config [#13062](https://github.com/apache/apisix/pull/13062) +- fix: invalidate the secret LRU cache on `/secrets` changes [#13668](https://github.com/apache/apisix/pull/13668) +- fix(secret): log an error when a secret reference cannot be resolved [#13737](https://github.com/apache/apisix/pull/13737) +- fix: reject consumer auth when a secret reference fails to resolve [#13667](https://github.com/apache/apisix/pull/13667) +- fix: encode control characters in `$upstream_uri` to prevent CRLF injection [#13787](https://github.com/apache/apisix/pull/13787) +- fix: reset `X-Forwarded-For` only for untrusted sources under `trusted_addresses` [#13611](https://github.com/apache/apisix/pull/13611) +- fix: normalize the case of hosts carried on a service [#13781](https://github.com/apache/apisix/pull/13781) +- fix(plugin): preserve plugin-conf state across the consumer route merge [#13757](https://github.com/apache/apisix/pull/13757) +- fix(resource): support all plugin-bearing resource types in `fetch_latest_conf` [#13663](https://github.com/apache/apisix/pull/13663) +- fix(config_etcd): keep the previous value when a full reload gets invalid data [#13717](https://github.com/apache/apisix/pull/13717) +- fix(etcd): do not advance the watch revision on a timeout, and make the recovery reload cheap [#13721](https://github.com/apache/apisix/pull/13721) +- fix(json): make cjson instances inherit APISIX's cjson options [#13680](https://github.com/apache/apisix/pull/13680) +- fix(env): resolve the `os.getenv` prefix collision for `env` directives [#13595](https://github.com/apache/apisix/pull/13595) +- fix(cli): remove the stale key after resolving an env var in config keys [#12885](https://github.com/apache/apisix/pull/12885) +- fix(cli): quote `nginx_config.envs` entries so values with spaces work [#13713](https://github.com/apache/apisix/pull/13713) +- fix(admin): harden stream_route `superior_id` dependency checks [#13672](https://github.com/apache/apisix/pull/13672) +- fix(admin): encrypt only after successful validation [#13729](https://github.com/apache/apisix/pull/13729) +- fix(admin): encrypt the inline upstream client key of a stream route [#13833](https://github.com/apache/apisix/pull/13833) +- fix(admin): reconcile the plugins reload instead of trusting the broadcast [#13714](https://github.com/apache/apisix/pull/13714) +- fix(control): reconcile `/v1/plugins/reload` like the admin reload path [#13745](https://github.com/apache/apisix/pull/13745) +- fix(log-sanitize): return raw tables to avoid double `delay_encode` [#13605](https://github.com/apache/apisix/pull/13605) +- fix(dns): correct the `error()` call in dns client initialization [#13358](https://github.com/apache/apisix/pull/13358) +- fix: avoid 503 error after dns service temporary fail [#13137](https://github.com/apache/apisix/pull/13137) +- fix(cli): add IPv6 listen support for the PROXY protocol [#12859](https://github.com/apache/apisix/pull/12859) +- fix(upstream): use `cert` and `key` instead of stale `ok` in mTLS error checks [#13442](https://github.com/apache/apisix/pull/13442) +- fix(core.request): `set_header` must update the cached headers with a normalized key [#13517](https://github.com/apache/apisix/pull/13517) +- fix(admin): `encrypt_fields` get double-encrypted on every PATCH [#13525](https://github.com/apache/apisix/pull/13525) +- fix(plugin): ignore `plugin_metadata` of disabled or unknown plugins [#13514](https://github.com/apache/apisix/pull/13514) +- fix(xrpc): stream routes with xRPC protocols fail `check_schema` in HTTP workers when the Admin API is disabled [#13515](https://github.com/apache/apisix/pull/13515) +- fix(secret): aws secret manager fails when the secret name contains a slash [#13519](https://github.com/apache/apisix/pull/13519) +- fix(consul): one invalid node should not discard the remaining nodes of the service [#13513](https://github.com/apache/apisix/pull/13513) +- fix(nacos): declare the `nacos-stream` shared dict in the stream subsystem [#13541](https://github.com/apache/apisix/pull/13541) +- fix: redis connections with different database/credentials must not share a keepalive pool [#13516](https://github.com/apache/apisix/pull/13516) + +### Plugins + +- feat: add ai-cache plugin [#13578](https://github.com/apache/apisix/pull/13578) +- feat(ai-cache): add the semantic (L2) cache layer [#13632](https://github.com/apache/apisix/pull/13632) +- feat(ai-cache): add streaming support with format tagging [#13644](https://github.com/apache/apisix/pull/13644) +- feat: add ai-lakera-guard plugin [#13570](https://github.com/apache/apisix/pull/13570) +- feat(ai-lakera-guard): scan LLM responses (direction output/both, non-streaming and streaming) [#13606](https://github.com/apache/apisix/pull/13606) +- feat: add ldap-auth-advanced plugin [#13762](https://github.com/apache/apisix/pull/13762) +- feat(ai-proxy-multi): add the semantic load-balancing algorithm [#13676](https://github.com/apache/apisix/pull/13676) +- feat(ai-proxy): include AI observability vars in `llm_summary` [#13609](https://github.com/apache/apisix/pull/13609) +- feat(ai-rate-limiting): support the redis policy for shared counters [#13670](https://github.com/apache/apisix/pull/13670) +- feat(ai-aws-content-moderation): moderate LLM responses, including streams [#13735](https://github.com/apache/apisix/pull/13735) +- feat(ai-aws-content-moderation): add `request_check_roles` and `request_check_mode` [#13773](https://github.com/apache/apisix/pull/13773) +- feat(ai-aliyun-content-moderation): moderate system and tool role content [#13646](https://github.com/apache/apisix/pull/13646) +- feat(prometheus): add metrics for AI cache hits, misses, bypasses, and embedding latency [#13659](https://github.com/apache/apisix/pull/13659) +- feat(prometheus): stream active connections, termination status and bandwidth [#13796](https://github.com/apache/apisix/pull/13796) +- feat: add `log_format_extra` to enrich the default logger format [#13568](https://github.com/apache/apisix/pull/13568) +- feat(kafka-logger): add TLS support for Kafka brokers [#13607](https://github.com/apache/apisix/pull/13607) +- feat(elasticsearch-logger): encrypt the `headers` field at rest [#13612](https://github.com/apache/apisix/pull/13612) +- feat: encrypt `redis_password` and `sentinel_password` in limit-count, limit-req and limit-conn [#13624](https://github.com/apache/apisix/pull/13624) +- feat(proxy-rewrite): support multiple same-name headers in `headers.add`/`headers.set` [#13597](https://github.com/apache/apisix/pull/13597) +- feat(openid-connect): add the `set_raw_id_token_header` option [#13616](https://github.com/apache/apisix/pull/13616) +- feat(openid-connect): support PAR and DPoP client options [#13649](https://github.com/apache/apisix/pull/13649) +- feat(ldap-auth): add `hide_credentials` [#13832](https://github.com/apache/apisix/pull/13832) +- fix(ai-request-rewrite): stop forwarding the downstream client's headers to the configured LLM endpoint. The internal rewrite call now carries only the plugin's own credentials, so `Cookie` and other client headers (and `Authorization` when the provider authenticates by another mechanism) no longer reach the third-party endpoint [#13699](https://github.com/apache/apisix/pull/13699) +- refactor(cas-auth): drop the unnecessary raw Cookie header fallback [#13635](https://github.com/apache/apisix/pull/13635) +- perf(zipkin): skip span tag construction for unsampled requests [#13656](https://github.com/apache/apisix/pull/13656) +- perf(datadog): reuse one UDP socket per batch and coalesce metrics [#13653](https://github.com/apache/apisix/pull/13653) +- fix(loggly): bind the batch handler to its own route's config. The shared module-level closure was overwritten by whichever route logged last, so an asynchronous batch could be sent with another route's token and tags; hoisting it out of the log phase also drops a per-request allocation [#13648](https://github.com/apache/apisix/pull/13648) +- fix(ai-proxy): preserve the upstream 429/5xx error response body [#13565](https://github.com/apache/apisix/pull/13565) +- fix(ai-proxy): drop `tool_choice` without tools and stop hanging the Anthropic stream [#13583](https://github.com/apache/apisix/pull/13583) +- fix(ai-proxy): do not abort the Anthropic response on bad `tool_call` arguments [#13599](https://github.com/apache/apisix/pull/13599) +- fix(ai-proxy): correct the Anthropic Messages to OpenAI Chat request conversion [#13674](https://github.com/apache/apisix/pull/13674) +- fix(ai-proxy): report error-path latency vars in milliseconds [#13711](https://github.com/apache/apisix/pull/13711) +- fix(ai-proxy-multi): keep the client request body intact across fallback retries [#13793](https://github.com/apache/apisix/pull/13793) +- fix(ai-protocols): flatten structured message content in the protocol layer [#13634](https://github.com/apache/apisix/pull/13634) +- fix(ai-cache): preserve non-text content in the exact key and bypass L2 [#13654](https://github.com/apache/apisix/pull/13654) +- fix(ai-lakera-guard): update alert mode behavior with the `fail_open` option [#13622](https://github.com/apache/apisix/pull/13622) +- fix(ai-content-moderation): validate that `deny_code` is a valid HTTP status [#13692](https://github.com/apache/apisix/pull/13692) +- fix(ai-content-moderation): stop re-counting converted chunks in realtime batches [#13765](https://github.com/apache/apisix/pull/13765) +- fix(ai-content-moderation): moderate the OpenAI `developer` role [#13780](https://github.com/apache/apisix/pull/13780) +- fix(ai-aws-content-moderation): respect Comprehend's segment limits and reuse the client [#13767](https://github.com/apache/apisix/pull/13767) +- fix(ai-aliyun-content-moderation): return nil instead of `ngx.OK` in `lua_body_filter` [#13623](https://github.com/apache/apisix/pull/13623) +- fix(limit-count): make the sliding-window limiter check-and-increment atomic [#13574](https://github.com/apache/apisix/pull/13574) +- fix(limit-count): `commit()` must report the window-weighted remaining [#13704](https://github.com/apache/apisix/pull/13704) +- fix(limit-count): validate variable-resolved `count`/`time_window` bounds [#13573](https://github.com/apache/apisix/pull/13573) +- fix(limit-count): upgrade the redis-cluster library so NOSCRIPT is not treated as a node failure [#13579](https://github.com/apache/apisix/pull/13579) +- fix(limit-conn): isolate the counter per workflow action via the `_vid` key [#13591](https://github.com/apache/apisix/pull/13591) +- fix(limit-conn): use the parent resource key for consumer isolation [#13600](https://github.com/apache/apisix/pull/13600) +- fix(redis-schema): copy policy schemas instead of mutating shared tables [#13555](https://github.com/apache/apisix/pull/13555) +- fix(graphql-limit-count): measure each fragment once when computing query depth [#13809](https://github.com/apache/apisix/pull/13809) +- fix(key-auth): propagate the real auth error to the multi-auth orchestrator [#13693](https://github.com/apache/apisix/pull/13693) +- fix(basic-auth): validate `anonymous_consumer` against the schema [#13682](https://github.com/apache/apisix/pull/13682) +- fix(hmac-auth): pass ctx when hiding the Authorization header [#13820](https://github.com/apache/apisix/pull/13820) +- fix(jwe-decrypt): skip decrypt when the token is missing and `strict` is false [#13822](https://github.com/apache/apisix/pull/13822) +- fix(cas-auth): stop the SLO callback POST from being proxied upstream [#13610](https://github.com/apache/apisix/pull/13610) +- fix(openid-connect): redirect instead of 500 on a stale authorization callback [#13712](https://github.com/apache/apisix/pull/13712) +- fix(openid-connect): handle `temporarily_unavailable` error redirects from the ID provider [#13825](https://github.com/apache/apisix/pull/13825) +- fix(wolf-rbac): clear upstream identity headers when the auth response omits `userInfo` [#13696](https://github.com/apache/apisix/pull/13696) +- fix(attach-consumer-label): always drop client-supplied configured headers [#13590](https://github.com/apache/apisix/pull/13590) +- fix(forward-auth): re-frame the buffered POST body for the auth request [#13642](https://github.com/apache/apisix/pull/13642) +- fix(loki-logger): resolve log labels per request to avoid label leakage [#13562](https://github.com/apache/apisix/pull/13562) +- fix(loki-logger): encrypt the `headers` field [#13784](https://github.com/apache/apisix/pull/13784) +- fix(error-log-logger): do not log the kafka sasl password [#13786](https://github.com/apache/apisix/pull/13786) +- fix(datadog): cap the coalesced DogStatsD datagram size, fall back to per-metric sends [#13665](https://github.com/apache/apisix/pull/13665) +- fix(prometheus): truncate llm model-name labels to bound cardinality [#13637](https://github.com/apache/apisix/pull/13637) +- fix(prometheus): bump nginx-lua-prometheus-api7 to 0.20260623 to drop duplicate metrics [#13602](https://github.com/apache/apisix/pull/13602) +- fix(prometheus): bump nginx-lua-prometheus-api7 to 0.20260716 [#13708](https://github.com/apache/apisix/pull/13708) +- fix(prometheus): bump nginx-lua-prometheus-api7 to 1.0.0 [#13754](https://github.com/apache/apisix/pull/13754) +- fix(opentelemetry): recreate the tracer object after the plugin metadata changed [#13618](https://github.com/apache/apisix/pull/13618) +- fix(opentelemetry): give `inject_core_spans` its own tracer cache key [#13633](https://github.com/apache/apisix/pull/13633) +- fix(opentelemetry): validate `x-request-id` before using it as `trace_id` [#12990](https://github.com/apache/apisix/pull/12990) +- fix(opentelemetry): use `oneOf` for the metadata `additionalProperties` value type [#13690](https://github.com/apache/apisix/pull/13690) +- fix(log-rotate): reopen logs after partial rotation [#13375](https://github.com/apache/apisix/pull/13375) +- fix(workflow): skip the action plugin in the chain to avoid double execution [#13617](https://github.com/apache/apisix/pull/13617) +- fix(proxy-rewrite): query string discarded when `use_real_request_uri_unsafe` is set [#12843](https://github.com/apache/apisix/pull/12843) +- fix(proxy-cache): keep Vary variant keys out of reach of a crafted request [#13831](https://github.com/apache/apisix/pull/13831) +- fix(grpc-transcode): encode empty repeated fields as JSON arrays [#13678](https://github.com/apache/apisix/pull/13678) +- fix(request-validation): guard a non-string Content-Type before `lower()` [#13691](https://github.com/apache/apisix/pull/13691) +- fix(data-mask): compact the JSON array when removing an element [#13818](https://github.com/apache/apisix/pull/13818) +- fix: reframe the request body forwarded upstream in serverless plugins [#13798](https://github.com/apache/apisix/pull/13798) +- feat(limit-count): add Redis Sentinel backend, sliding window and delayed sync support [#13443](https://github.com/apache/apisix/pull/13443) +- feat(prometheus): support disabling labels via plugin metadata to reduce cardinality [#13202](https://github.com/apache/apisix/pull/13202) +- feat(ai-proxy): add built-in nginx variables for LLM observability [#13477](https://github.com/apache/apisix/pull/13477) +- fix(kafka-logger): support `api_version` so brokers can store message timestamps [#13521](https://github.com/apache/apisix/pull/13521) +- fix(ai-proxy-multi): refresh the cached server picker once health checkers are created [#13505](https://github.com/apache/apisix/pull/13505) +- fix(ai-proxy-multi): keep the existing query string in the health check path [#13506](https://github.com/apache/apisix/pull/13506) +- fix(ai-proxy): forward the client method and query string for passthrough [#13546](https://github.com/apache/apisix/pull/13546) +- fix(authz-casdoor): expire the session when the Casdoor token expires [#13500](https://github.com/apache/apisix/pull/13500) +- fix(request-id): generate nanoid with a CSPRNG to avoid duplicate and malformed ids [#13508](https://github.com/apache/apisix/pull/13508) +- fix(jwt-auth): reject a malformed JWT signature instead of erroring [#13518](https://github.com/apache/apisix/pull/13518) +- fix(workflow): tolerate a missing `_workflow_cache` in the log phase [#13512](https://github.com/apache/apisix/pull/13512) +- fix(body-transformer): rebuild the table in `remove_namespace` instead of mutating during traversal [#13522](https://github.com/apache/apisix/pull/13522) +- fix(aws-lambda): build the SigV4 canonical query string per spec [#13520](https://github.com/apache/apisix/pull/13520) +- fix(graphql-proxy-cache): clear all Vary variants on PURGE [#13523](https://github.com/apache/apisix/pull/13523) +- fix(limit-count): isolate redis-sentinel keepalive pools by database and credentials [#13553](https://github.com/apache/apisix/pull/13553) +- fix(brotli): do not log an expected non-standard ETag at error level [#13545](https://github.com/apache/apisix/pull/13545) +- fix(elasticsearch-logger): guard `os.date` against an invalid index template [#13542](https://github.com/apache/apisix/pull/13542) +- fix(acl): correctly evaluate multi-match JSONPath labels [#13527](https://github.com/apache/apisix/pull/13527) +- fix: remove credential-leaking debug logs in logger plugins [#13502](https://github.com/apache/apisix/pull/13502) +- fix: use `description` instead of `title` for field-level schema doc strings [#13547](https://github.com/apache/apisix/pull/13547) + ## 3.17.0 **The changes marked with :warning: are not backward compatible.** diff --git a/apisix/core/version.lua b/apisix/core/version.lua index 326e22e8baff..b02e89d44c29 100644 --- a/apisix/core/version.lua +++ b/apisix/core/version.lua @@ -20,5 +20,5 @@ -- @module core.version return { - VERSION = "3.17.0" + VERSION = "3.18.0" } diff --git a/ci/check_changelog_prs.ts b/ci/check_changelog_prs.ts index 50dd25d1f9b5..b69b20d73d6c 100755 --- a/ci/check_changelog_prs.ts +++ b/ci/check_changelog_prs.ts @@ -64,6 +64,11 @@ const IGNORE_PRS = [ // docs/chore/test/ci type filter but which do not belong in a user changelog. 13386, 13407, 13449, 13485, 13139, 13156, 13157, 13158, 13222, 13234, + // 3.18.0 + // test-only, CI-only and build-only changes whose subject prefix ("fix:", + // "fix(ci)", "fix(dev-image)", "build:") dodges the docs/chore/test/ci type + // filter but which do not belong in a user changelog. + 13526, 13554, 13679, 13709, 13815, 13824, ]; diff --git a/docs/en/latest/config.json b/docs/en/latest/config.json index 5fb645afa3a0..77c08ec0da94 100644 --- a/docs/en/latest/config.json +++ b/docs/en/latest/config.json @@ -1,5 +1,5 @@ { - "version": "3.17.0", + "version": "3.18.0", "sidebar": [ { "type": "category", diff --git a/docs/zh/latest/config.json b/docs/zh/latest/config.json index 5f1d682020a5..bbd0b3ba1104 100644 --- a/docs/zh/latest/config.json +++ b/docs/zh/latest/config.json @@ -1,5 +1,5 @@ { - "version": "3.17.0", + "version": "3.18.0", "sidebar": [ { "type": "category",