kayx23 commented on code in PR #13842: URL: https://github.com/apache/apisix/pull/13842#discussion_r3802656105
########## CHANGELOG.md: ########## @@ -85,6 +86,183 @@ title: Changelog - [0.7.0](#070) - [0.6.0](#060) +## 3.18.0 + +**The changes marked with :warning: are not backward compatible.** + +### Change + +- :warning: change(debug): report executed plugins with phase in execution order. The `Apisix-Plugins` debug header now carries `name#phase` entries in execution order instead of a de-duplicated plugin-name list [#13710](https://github.com/apache/apisix/pull/13710) +- :warning: feat: bound request and response body buffering in plugins. `max_req_body_size` / `max_resp_body_size` (default 64 MiB) added to ~19 plugins; larger bodies are now rejected or truncated instead of being buffered without limit [#13705](https://github.com/apache/apisix/pull/13705) +- :warning: fix(batch-processor): bound the pending entries backlog by default. Every batch-processor logger now defaults `max_pending_entries` to 8192 and discards entries above it [#13826](https://github.com/apache/apisix/pull/13826) +- :warning: refactor(ai-aws-content-moderation): moderate decoded LLM content in the access phase. Priority moved from 1050 to 1031, the plugin now requires ai-proxy/ai-proxy-multi, moderates the extracted prompt instead of the raw body, and denies with `deny_code` (default 200) instead of 400 [#13647](https://github.com/apache/apisix/pull/13647) +- :warning: feat(ai-aliyun-content-moderation): role-aware `request_check_mode` and O(n) content chunking. Request moderation now covers the user role of the latest turn by default instead of every message in the body [#13598](https://github.com/apache/apisix/pull/13598) +- :warning: fix(sls-logger): verify the TLS certificate of the log server. New `ssl_verify` option, default `true` [#13785](https://github.com/apache/apisix/pull/13785) +- :warning: fix(openid-connect): enforce audience, issuer and required scopes. Bearer introspection fails closed when the discovery document is unavailable, `claim_validator.audience.match_with_client_id` now implies `required`, and `required_scopes` is enforced on session (authorization code) flows [#13829](https://github.com/apache/apisix/pull/13829) +- :warning: fix(admin): reject duplicate consumer authentication keys instead of silently accepting them [#13529](https://github.com/apache/apisix/pull/13529) +- :warning: perf(core): sanitize the `X-Forwarded-*` headers in the NGINX config. The `$var_x_forwarded_proto/host/port` variables are gone, and a trusted peer that sends no `X-Forwarded-Host`/`X-Forwarded-Port` now receives the APISIX-observed values instead of falling through to `$host`/`$server_port` [#13803](https://github.com/apache/apisix/pull/13803) + +### Core + +- feat: raise default sizes for non-evictable shared dicts: `prometheus-metrics` 15m/10m→128m, `nacos` 10m→64m, consul and kubernetes discovery `shared_size` 1m→64m, `tracing_buffer` 10m→32m [#13688](https://github.com/apache/apisix/pull/13688) +- chore(core): remove the dead `clean_handlers` mechanism. `core.config_util.add_clean_handler`, `cancel_clean_handler` and `fire_all_clean_handlers` no longer exist [#13761](https://github.com/apache/apisix/pull/13761) +- feat(ai-proxy): send LLM requests through `ngx_http_ffi_client`. New `plugin_attr.ai-proxy.http_client`, defaulting to the FFI client, which requires an APISIX-Runtime that ships `ngx_http_ffi_client` (set `lua-resty-http` to opt out) [#13778](https://github.com/apache/apisix/pull/13778) +- feat: support per-port PROXY protocol for stream TCP proxy [#13561](https://github.com/apache/apisix/pull/13561) +- feat(stream): support `set_real_ip_from` to trust an inbound PROXY protocol header [#13700](https://github.com/apache/apisix/pull/13700) +- feat(stream): support upstream client certificate (mTLS) in the L4 proxy [#13596](https://github.com/apache/apisix/pull/13596) +- feat(router): add `match_uri_encoded_slash` to keep `%2F` in path parameters [#13626](https://github.com/apache/apisix/pull/13626) +- feat: add `max_post_args_readable_size` to bound `post_arg.*` body reads [#13601](https://github.com/apache/apisix/pull/13601) +- feat: support `http_method` and `http_req_body` in active health checks [#13726](https://github.com/apache/apisix/pull/13726) +- feat(data_encryption): support AES-256 keys in the encryption keyring [#13756](https://github.com/apache/apisix/pull/13756) +- refactor: decouple generic data encryption from `ssl.lua` [#13564](https://github.com/apache/apisix/pull/13564) +- perf(plugin): reuse the filtered global-rule plugin set across phases [#13779](https://github.com/apache/apisix/pull/13779) +- fix: keep the chash ring stable during health changes [#13532](https://github.com/apache/apisix/pull/13532) +- fix(balancer): keep least_conn load state across upstream scaling [#13666](https://github.com/apache/apisix/pull/13666) +- fix(balancer): separate the keepalive pool by referenced client cert [#13587](https://github.com/apache/apisix/pull/13587) +- fix(healthcheck): reuse the checker on node-only upstream changes instead of destroy-and-rebuild [#13629](https://github.com/apache/apisix/pull/13629) +- fix(healthcheck): probe domain nodes by the node domain, not the resolved IP [#13743](https://github.com/apache/apisix/pull/13743) +- fix(healthcheck): purge stale targets and release the periodic lock [#13627](https://github.com/apache/apisix/pull/13627) +- fix(healthcheck): guard `construct_upstream` in healthcheck timers [#13592](https://github.com/apache/apisix/pull/13592) +- fix(stream): initialize env and secret for TLS cert resolution [#12935](https://github.com/apache/apisix/pull/12935) +- fix: fetch secrets from the upstream ssl config [#13062](https://github.com/apache/apisix/pull/13062) +- fix: invalidate the secret LRU cache on `/secrets` changes [#13668](https://github.com/apache/apisix/pull/13668) +- fix(secret): log an error when a secret reference cannot be resolved [#13737](https://github.com/apache/apisix/pull/13737) +- fix: reject consumer auth when a secret reference fails to resolve [#13667](https://github.com/apache/apisix/pull/13667) +- fix: encode control characters in `$upstream_uri` to prevent CRLF injection [#13787](https://github.com/apache/apisix/pull/13787) +- fix: reset `X-Forwarded-For` only for untrusted sources under `trusted_addresses` [#13611](https://github.com/apache/apisix/pull/13611) +- fix: normalize the case of hosts carried on a service [#13781](https://github.com/apache/apisix/pull/13781) +- fix(plugin): preserve plugin-conf state across the consumer route merge [#13757](https://github.com/apache/apisix/pull/13757) +- fix(resource): support all plugin-bearing resource types in `fetch_latest_conf` [#13663](https://github.com/apache/apisix/pull/13663) +- fix(config_etcd): keep the previous value when a full reload gets invalid data [#13717](https://github.com/apache/apisix/pull/13717) +- fix(etcd): do not advance the watch revision on a timeout, and make the recovery reload cheap [#13721](https://github.com/apache/apisix/pull/13721) +- fix(json): make cjson instances inherit APISIX's cjson options [#13680](https://github.com/apache/apisix/pull/13680) +- fix(env): resolve the `os.getenv` prefix collision for `env` directives [#13595](https://github.com/apache/apisix/pull/13595) +- fix(cli): remove the stale key after resolving an env var in config keys [#12885](https://github.com/apache/apisix/pull/12885) +- fix(cli): quote `nginx_config.envs` entries so values with spaces work [#13713](https://github.com/apache/apisix/pull/13713) +- fix(admin): harden stream_route `superior_id` dependency checks [#13672](https://github.com/apache/apisix/pull/13672) +- fix(admin): encrypt only after successful validation [#13729](https://github.com/apache/apisix/pull/13729) +- fix(admin): encrypt the inline upstream client key of a stream route [#13833](https://github.com/apache/apisix/pull/13833) +- fix(admin): reconcile the plugins reload instead of trusting the broadcast [#13714](https://github.com/apache/apisix/pull/13714) +- fix(control): reconcile `/v1/plugins/reload` like the admin reload path [#13745](https://github.com/apache/apisix/pull/13745) +- fix(log-sanitize): return raw tables to avoid double `delay_encode` [#13605](https://github.com/apache/apisix/pull/13605) +- fix(dns): correct the `error()` call in dns client initialization [#13358](https://github.com/apache/apisix/pull/13358) +- fix: avoid 503 error after dns service temporary fail [#13137](https://github.com/apache/apisix/pull/13137) +- fix(cli): add IPv6 listen support for the PROXY protocol [#12859](https://github.com/apache/apisix/pull/12859) +- fix(upstream): use `cert` and `key` instead of stale `ok` in mTLS error checks [#13442](https://github.com/apache/apisix/pull/13442) +- fix(core.request): `set_header` must update the cached headers with a normalized key [#13517](https://github.com/apache/apisix/pull/13517) +- fix(admin): `encrypt_fields` get double-encrypted on every PATCH [#13525](https://github.com/apache/apisix/pull/13525) +- fix(plugin): ignore `plugin_metadata` of disabled or unknown plugins [#13514](https://github.com/apache/apisix/pull/13514) +- fix(xrpc): stream routes with xRPC protocols fail `check_schema` in HTTP workers when the Admin API is disabled [#13515](https://github.com/apache/apisix/pull/13515) +- fix(secret): aws secret manager fails when the secret name contains a slash [#13519](https://github.com/apache/apisix/pull/13519) +- fix(consul): one invalid node should not discard the remaining nodes of the service [#13513](https://github.com/apache/apisix/pull/13513) +- fix(nacos): declare the `nacos-stream` shared dict in the stream subsystem [#13541](https://github.com/apache/apisix/pull/13541) +- fix: redis connections with different database/credentials must not share a keepalive pool [#13516](https://github.com/apache/apisix/pull/13516) + +### Plugins + +- feat: add ai-cache plugin [#13578](https://github.com/apache/apisix/pull/13578) +- feat(ai-cache): add the semantic (L2) cache layer [#13632](https://github.com/apache/apisix/pull/13632) +- feat(ai-cache): add streaming support with format tagging [#13644](https://github.com/apache/apisix/pull/13644) +- feat: add ai-lakera-guard plugin [#13570](https://github.com/apache/apisix/pull/13570) +- feat(ai-lakera-guard): scan LLM responses (direction output/both, non-streaming and streaming) [#13606](https://github.com/apache/apisix/pull/13606) +- feat: add ldap-auth-advanced plugin [#13762](https://github.com/apache/apisix/pull/13762) Review Comment: PR #13762 also introduces a backward-incompatible change for the existing `ldap-auth` plugin: the `lua-resty-ldap` upgrade makes `tls_verify: true` perform real certificate verification, whereas it was previously a silent no-op. Deployments using self-signed or hostname-mismatched LDAP certificates may start failing. Please add this impact under **Change** (with the migration action: install a trusted/matching certificate or explicitly disable verification where appropriate), while keeping the new `ldap-auth-advanced` plugin here as a feature. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
