kayx23 commented on code in PR #13842: URL: https://github.com/apache/apisix/pull/13842#discussion_r3802529992
########## CHANGELOG.md: ########## @@ -85,6 +86,183 @@ title: Changelog - [0.7.0](#070) - [0.6.0](#060) +## 3.18.0 + +**The changes marked with :warning: are not backward compatible.** + +### Change + +- :warning: change(debug): report executed plugins with phase in execution order. The `Apisix-Plugins` debug header now carries `name#phase` entries in execution order instead of a de-duplicated plugin-name list [#13710](https://github.com/apache/apisix/pull/13710) +- :warning: feat: bound request and response body buffering in plugins. `max_req_body_size` / `max_resp_body_size` (default 64 MiB) added to ~19 plugins; larger bodies are now rejected or truncated instead of being buffered without limit [#13705](https://github.com/apache/apisix/pull/13705) +- :warning: fix(batch-processor): bound the pending entries backlog by default. Every batch-processor logger now defaults `max_pending_entries` to 8192 and discards entries above it [#13826](https://github.com/apache/apisix/pull/13826) +- :warning: refactor(ai-aws-content-moderation): moderate decoded LLM content in the access phase. Priority moved from 1050 to 1031, the plugin now requires ai-proxy/ai-proxy-multi, moderates the extracted prompt instead of the raw body, and denies with `deny_code` (default 200) instead of 400 [#13647](https://github.com/apache/apisix/pull/13647) +- :warning: feat(ai-aliyun-content-moderation): role-aware `request_check_mode` and O(n) content chunking. Request moderation now covers the user role of the latest turn by default instead of every message in the body [#13598](https://github.com/apache/apisix/pull/13598) +- :warning: fix(sls-logger): verify the TLS certificate of the log server. New `ssl_verify` option, default `true` [#13785](https://github.com/apache/apisix/pull/13785) +- :warning: fix(openid-connect): enforce audience, issuer and required scopes. Bearer introspection fails closed when the discovery document is unavailable, `claim_validator.audience.match_with_client_id` now implies `required`, and `required_scopes` is enforced on session (authorization code) flows [#13829](https://github.com/apache/apisix/pull/13829) +- :warning: fix(admin): reject duplicate consumer authentication keys instead of silently accepting them [#13529](https://github.com/apache/apisix/pull/13529) +- :warning: perf(core): sanitize the `X-Forwarded-*` headers in the NGINX config. The `$var_x_forwarded_proto/host/port` variables are gone, and a trusted peer that sends no `X-Forwarded-Host`/`X-Forwarded-Port` now receives the APISIX-observed values instead of falling through to `$host`/`$server_port` [#13803](https://github.com/apache/apisix/pull/13803) Review Comment: PR #13803 does not remove all three variables. Its merged NGINX template still defines `$var_x_forwarded_host` and `$var_x_forwarded_port` as `map` outputs; they are no longer writable from Lua. Only `$var_x_forwarded_proto` is removed. Please change this to something like: “`$var_x_forwarded_proto` is removed, while `$var_x_forwarded_host` and `$var_x_forwarded_port` are no longer writable.” -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
