Copilot commented on code in PR #2117: URL: https://github.com/apache/apisix-website/pull/2117#discussion_r3902321667
########## blog/en/blog/2026/08/31/2026-aug-monthly-report.md: ########## @@ -0,0 +1,127 @@ +--- +title: "2026 Monthly Report (August 01 - August 31)" +keywords: ["Apache APISIX", "API Gateway", "Monthly Report", "Contributor"] +description: Our monthly Apache APISIX community report generates insights into the project's monthly developments. The reports provide a pathway into the Apache APISIX community, ensuring that you stay well-informed and actively involved. +tags: [Community] +image: https://static.api7.ai/uploads/2026/09/01/fnMEaJFl_2026-aug-monthly-report-cover-en.webp +--- + +> Recently, we've introduced and updated some new features, including advanced LDAP and OIDC authentication, stronger encryption and upstream TLS verification, faster and more resilient AI traffic, and richer traffic governance and observability. For more details, please read this month's newsletter. + +<!--truncate--> + +## Introduction + +From its inception, the Apache APISIX project has embraced the ethos of open-source community collaboration, propelling it into the ranks of the most active global open-source API gateway projects. The proverbial wisdom of 'teamwork makes the dream work' rings true in our way and is made possible by the collective effort of our community. + +From August 1st to August 31st, 13 contributors made 117 commits to Apache APISIX. We sincerely appreciate your contributions to Apache APISIX. + +## Contributor Statistics + + + + + +## Feature Highlights + +Here are the key updates from this month, grouped by capability area. + +### Authentication and Credential Protection + +#### 1. Add the `ldap-auth-advanced` Plugin for Core Authentication + +PR: https://github.com/apache/apisix/pull/13762 + +Contributor: [janiussyafiq](https://github.com/janiussyafiq) + +This PR adds the `ldap-auth-advanced` plugin with LDAP search-then-bind, service-account or anonymous search, `user_dn` Consumer association, LDAPS/StartTLS, and protection against LDAP filter injection. It also upgrades `lua-resty-ldap` so `tls_verify: true` performs actual certificate verification and separates authentication failures from directory or transport errors. + +#### 2. Support PAR and DPoP Client Options in `openid-connect` + +PR: https://github.com/apache/apisix/pull/13649 + +Contributor: [kevinlzw](https://github.com/kevinlzw) + +This PR exposes OAuth 2.0 Pushed Authorization Requests, DPoP proof generation for token and userinfo requests, and client assertion algorithm and audience options through the `openid-connect` plugin. The new settings are opt-in, DPoP private keys are encrypted in etcd, and existing configurations retain their previous behavior. + +#### 3. Hide LDAP Credentials from Upstreams + +PR: https://github.com/apache/apisix/pull/13832 + +Contributor: [nic-6443](https://github.com/nic-6443) + +This PR adds a `hide_credentials` option to `ldap-auth`, allowing APISIX to remove the LDAP Basic Authentication header before proxying a request upstream. The option defaults to `false` for backward compatibility while helping operators avoid exposing reusable organization-wide credentials to backend services. + +### Encryption and Upstream Security + +#### 4. Support AES-256 Keys in the Encryption Keyring + +PR: https://github.com/apache/apisix/pull/13756 + +Contributor: [AlinsRan](https://github.com/AlinsRan) + +This PR lets APISIX data encryption use either 16-byte AES-128 keys or 32-byte AES-256 keys and rejects unsupported key lengths. A keyring can contain both sizes, enabling operators to rotate from AES-128 to AES-256 without losing access to data encrypted with an older key. + +#### 5. Verify Upstream Certificates Against Configurable CAs + +PR: https://github.com/apache/apisix/pull/13863 + +Contributor: [nic-6443](https://github.com/nic-6443) + +This PR makes `upstream.tls.verify` enforce certificate verification for HTTPS and gRPCS upstreams and introduces `upstream.tls.ca_certs` for per-upstream trust anchors. Leaving `verify` unset preserves the existing NGINX configuration behavior, while operators can now explicitly validate private or custom-CA upstreams. + +### AI Gateway Efficiency and Resilience + +#### 6. Select Which Request Content AWS Moderation Checks + +PR: https://github.com/apache/apisix/pull/13773 + +Contributor: [shreemaan-abhishek](https://github.com/shreemaan-abhishek) + +This PR adds `request_check_roles` and `request_check_mode` to `ai-aws-content-moderation`, so operators can choose which user, tool, and system content to moderate and whether to inspect all turns or only the latest relevant block. The defaults preserve the plugin's existing coverage, while selective checks can avoid repeatedly scoring and billing for conversation history. Review Comment: This overstates backward compatibility: the linked PR notes that assistant messages were previously included by `extract_request_content` but are dropped by the new role-specific extractors. Please state that exception so readers do not assume the moderation scope is completely unchanged. ########## blog/zh/blog/2026/08/31/2026-aug-monthly-report.md: ########## @@ -0,0 +1,127 @@ +--- +title: "2026 社区月报 (08.01 - 08.31)" +keywords: ["Apache APISIX", "API 网关", "社区月报", "贡献者"] +description: Apache APISIX 社区的月报旨在帮助社区成员更全面地了解社区的最新动态，方便大家参与到 Apache APISIX 社区中来。 +tags: [Community] +image: https://static.api7.ai/uploads/2026/09/01/rWYKjvhI_2026-aug-monthly-report-cover-cn.webp +--- + +> 最近，我们引入并更新了一些新功能，包括增强 LDAP 与 OIDC 身份认证、强化数据加密与上游 TLS 校验、提升 AI 流量处理效率与容错能力，以及完善流量治理和可观测性等。有关更多细节，请阅读本期月报。 + +<!--truncate--> + +## 导语 + +Apache APISIX 项目始终秉承着开源社区协作的精神，自问世起便崭露头角，如今已经成为全球最活跃的开源 API 网关项目之一。正如谚语所言，"众人拾柴火焰高"，这一辉煌成就，得益于整个社区伙伴的协同努力。 + +从 2026.08.01 至 2026.08.31，有 13 名开发者提交了 117 个 commits，为 Apache APISIX 做出了重要贡献。感谢这些伙伴们对 Apache APISIX 的无私支持！正是因为你们的付出，才能让 Apache APISIX 项目不断改进、提升和壮大。 + +## 贡献者统计 + + + + + +## 近期亮点功能 + +以下是本月的重点更新，并按功能方向进行归类。 + +### 身份认证与凭据保护 + +#### 1. 新增 `ldap-auth-advanced` 核心认证能力 + +相关 PR：https://github.com/apache/apisix/pull/13762 + +贡献者：[janiussyafiq](https://github.com/janiussyafiq) + +该 PR 新增 `ldap-auth-advanced` 插件，支持 LDAP 先搜索后绑定、服务账号或匿名搜索、通过 `user_dn` 关联 Consumer、LDAPS/StartTLS，并防范 LDAP 过滤器注入。此次更新还升级了 `lua-resty-ldap`，使 `tls_verify: true` 真正执行证书校验，并将认证失败与目录服务或传输异常明确区分。 + +#### 2. 为 `openid-connect` 支持 PAR 与 DPoP 客户端选项 + +相关 PR：https://github.com/apache/apisix/pull/13649 + +贡献者：[kevinlzw](https://github.com/kevinlzw) + +该 PR 在 `openid-connect` 插件中开放 OAuth 2.0 推送授权请求（PAR）、针对令牌和用户信息请求的 DPoP 证明生成，以及客户端断言算法和受众选项。新能力均需显式启用，DPoP 私钥会在 etcd 中加密存储，现有配置的行为保持不变。 + +#### 3. 避免将 LDAP 凭据转发给上游 + +相关 PR：https://github.com/apache/apisix/pull/13832 + +贡献者：[nic-6443](https://github.com/nic-6443) + +该 PR 为 `ldap-auth` 增加 `hide_credentials` 选项，可在请求转发至上游前移除携带 LDAP 用户名和密码的 Basic Authentication 请求头。该选项默认关闭以保持向后兼容，同时帮助用户避免将可在组织内复用的凭据暴露给后端服务。 + +### 数据加密与上游安全 + +#### 4. 加密密钥环支持 AES-256 密钥 + +相关 PR：https://github.com/apache/apisix/pull/13756 + +贡献者：[AlinsRan](https://github.com/AlinsRan) + +该 PR 让 APISIX 数据加密同时支持 16 字节的 AES-128 密钥和 32 字节的 AES-256 密钥，并拒绝其他不受支持的密钥长度。一个密钥环可混合使用两种长度，便于用户从 AES-128 平滑轮换至 AES-256，同时继续解密使用旧密钥保护的数据。 + +#### 5. 使用可配置 CA 校验上游证书 + +相关 PR：https://github.com/apache/apisix/pull/13863 + +贡献者：[nic-6443](https://github.com/nic-6443) + +该 PR 让 `upstream.tls.verify` 对 HTTPS 和 gRPCS 上游真正执行证书校验，并新增 `upstream.tls.ca_certs`，支持为每个上游单独配置可信 CA。未设置 `verify` 时仍沿用现有 NGINX 配置行为，显式启用后则可校验使用私有 CA 或自定义 CA 的上游服务。 + +### AI 网关效率与容错 + +#### 6. 精细选择 AWS 内容审核的请求范围 + +相关 PR：https://github.com/apache/apisix/pull/13773 + +贡献者：[shreemaan-abhishek](https://github.com/shreemaan-abhishek) + +该 PR 为 `ai-aws-content-moderation` 新增 `request_check_roles` 和 `request_check_mode`，可选择审核用户、工具及系统消息，并决定检查全部历史还是最近一组相关消息。默认配置保留插件原有的审核范围，而按需选择内容可避免在每轮对话中重复审核历史消息并产生额外费用。 Review Comment: 这里对向后兼容性的描述过于绝对：关联 PR 明确说明，原先由 `extract_request_content` 覆盖的 assistant 消息在新的按角色提取逻辑中不再审核。请注明这一例外，避免读者误以为审核范围完全不变。 ########## blog/en/blog/2026/08/31/2026-aug-monthly-report.md: ########## @@ -0,0 +1,127 @@ +--- +title: "2026 Monthly Report (August 01 - August 31)" +keywords: ["Apache APISIX", "API Gateway", "Monthly Report", "Contributor"] +description: Our monthly Apache APISIX community report generates insights into the project's monthly developments. The reports provide a pathway into the Apache APISIX community, ensuring that you stay well-informed and actively involved. +tags: [Community] +image: https://static.api7.ai/uploads/2026/09/01/fnMEaJFl_2026-aug-monthly-report-cover-en.webp +--- + +> Recently, we've introduced and updated some new features, including advanced LDAP and OIDC authentication, stronger encryption and upstream TLS verification, faster and more resilient AI traffic, and richer traffic governance and observability. For more details, please read this month's newsletter. + +<!--truncate--> + +## Introduction + +From its inception, the Apache APISIX project has embraced the ethos of open-source community collaboration, propelling it into the ranks of the most active global open-source API gateway projects. The proverbial wisdom of 'teamwork makes the dream work' rings true in our way and is made possible by the collective effort of our community. + +From August 1st to August 31st, 13 contributors made 117 commits to Apache APISIX. We sincerely appreciate your contributions to Apache APISIX. + +## Contributor Statistics + + + + + +## Feature Highlights + +Here are the key updates from this month, grouped by capability area. + +### Authentication and Credential Protection + +#### 1. Add the `ldap-auth-advanced` Plugin for Core Authentication + +PR: https://github.com/apache/apisix/pull/13762 + +Contributor: [janiussyafiq](https://github.com/janiussyafiq) + +This PR adds the `ldap-auth-advanced` plugin with LDAP search-then-bind, service-account or anonymous search, `user_dn` Consumer association, LDAPS/StartTLS, and protection against LDAP filter injection. It also upgrades `lua-resty-ldap` so `tls_verify: true` performs actual certificate verification and separates authentication failures from directory or transport errors. + +#### 2. Support PAR and DPoP Client Options in `openid-connect` + +PR: https://github.com/apache/apisix/pull/13649 + +Contributor: [kevinlzw](https://github.com/kevinlzw) + +This PR exposes OAuth 2.0 Pushed Authorization Requests, DPoP proof generation for token and userinfo requests, and client assertion algorithm and audience options through the `openid-connect` plugin. The new settings are opt-in, DPoP private keys are encrypted in etcd, and existing configurations retain their previous behavior. + +#### 3. Hide LDAP Credentials from Upstreams + +PR: https://github.com/apache/apisix/pull/13832 + +Contributor: [nic-6443](https://github.com/nic-6443) + +This PR adds a `hide_credentials` option to `ldap-auth`, allowing APISIX to remove the LDAP Basic Authentication header before proxying a request upstream. The option defaults to `false` for backward compatibility while helping operators avoid exposing reusable organization-wide credentials to backend services. + +### Encryption and Upstream Security + +#### 4. Support AES-256 Keys in the Encryption Keyring + +PR: https://github.com/apache/apisix/pull/13756 + +Contributor: [AlinsRan](https://github.com/AlinsRan) + +This PR lets APISIX data encryption use either 16-byte AES-128 keys or 32-byte AES-256 keys and rejects unsupported key lengths. A keyring can contain both sizes, enabling operators to rotate from AES-128 to AES-256 without losing access to data encrypted with an older key. + +#### 5. Verify Upstream Certificates Against Configurable CAs + +PR: https://github.com/apache/apisix/pull/13863 + +Contributor: [nic-6443](https://github.com/nic-6443) + +This PR makes `upstream.tls.verify` enforce certificate verification for HTTPS and gRPCS upstreams and introduces `upstream.tls.ca_certs` for per-upstream trust anchors. Leaving `verify` unset preserves the existing NGINX configuration behavior, while operators can now explicitly validate private or custom-CA upstreams. + +### AI Gateway Efficiency and Resilience + +#### 6. Select Which Request Content AWS Moderation Checks + +PR: https://github.com/apache/apisix/pull/13773 + +Contributor: [shreemaan-abhishek](https://github.com/shreemaan-abhishek) + +This PR adds `request_check_roles` and `request_check_mode` to `ai-aws-content-moderation`, so operators can choose which user, tool, and system content to moderate and whether to inspect all turns or only the latest relevant block. The defaults preserve the plugin's existing coverage, while selective checks can avoid repeatedly scoring and billing for conversation history. + +#### 7. Send LLM Requests Through `ngx_http_ffi_client` + +PR: https://github.com/apache/apisix/pull/13778 + +Contributor: [shreemaan-abhishek](https://github.com/shreemaan-abhishek) + +This PR makes the NGINX C-based `ngx_http_ffi_client` the default transport for outbound requests from `ai-proxy`, `ai-proxy-multi`, and `ai-request-rewrite`, reducing HTTP client CPU overhead. Operators can explicitly select the previous `lua-resty-http` transport, and both clients continue to honor APISIX's resolver, streaming, keepalive, and error-handling behavior. + +#### 8. Configure Status-Based AI Fallbacks + +PR: https://github.com/apache/apisix/pull/13852 + +Contributor: [nic-6443](https://github.com/nic-6443) + +This PR lets operators configure additional upstream HTTP statuses, such as 401 for an expired API key or 402 for exhausted quota, to trigger an in-flight `ai-proxy-multi` fallback. Retries remain bounded by the existing retry settings, and responses keep their previous behavior when no additional status is configured. + +### Traffic Governance and Observability + +#### 9. Add Stream Connection and Bandwidth Metrics + +PR: https://github.com/apache/apisix/pull/13796 + +Contributor: [AlinsRan](https://github.com/AlinsRan) + +This PR adds Prometheus metrics for active TCP and UDP connections, stream session outcomes, and bandwidth in both directions. Shared-memory counters update while sessions remain open, while a new session reason distinguishes clean closes from timeouts, resets, and plugin rejections that previously appeared as the same status. + +#### 10. Rate Limit GraphQL Requests by Query Cost + +PR: https://github.com/apache/apisix/pull/13840 + +Contributor: [AlinsRan](https://github.com/AlinsRan) + +This PR adds `complexity` and `node_quantifier` cost strategies to `graphql-limit-count`, allowing quotas to reflect query width, fan-out, pagination arguments, and per-field weights instead of only nesting depth. Service-scoped cost decorations, schema introspection, `max_cost`, and `score_factor` provide a configurable cost model, while `depth` remains the backward-compatible default. + +#### 11. Report Responses to Chaitin SafeLine WAF + +PR: https://github.com/apache/apisix/pull/13763 + +Contributor: [blaisewang](https://github.com/blaisewang) + +This PR allows `chaitin-waf` to report response status, headers, and a configurable amount of body content to SafeLine for detecting data leaks and successful exploit output. Reporting runs asynchronously after the client response, remains advisory rather than blocking, and skips responses whose content types are configured as binary or otherwise ignored. + +## Conclusion + +The [official website](https://apisix.apache.org/) and [GitHub Issues](https://github.com/apache/apisix/issues) of Apache APISIX provide a wealth of documentation of tutorials, and real-world use cases. If you encounter any issues, you can refer to the documentation, search for keywords in Issues, or participate in discussions on Issues to share your ideas and practical experiences. Review Comment: The list is grammatically malformed: “documentation of tutorials” incorrectly combines two separate items, and the comma before “and” lacks a parallel list. Rephrase it as a three-item series. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
