This is an automated email from the ASF dual-hosted git repository.
Yilialinn pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix-website.git
The following commit(s) were added to refs/heads/master by this push:
new 2cfb96d7234 blog: add 2026 September monthly report (#2132)
2cfb96d7234 is described below
commit 2cfb96d723432c129c58d417898787fd81e1b91e
Author: Yilia Lin <[email protected]>
AuthorDate: Wed Sep 30 17:49:03 2026 +0800
blog: add 2026 September monthly report (#2132)
---
blog/en/blog/2026/09/30/2026-sep-monthly-report.md | 127 +++++++++++++++++++++
blog/zh/blog/2026/09/30/2026-sep-monthly-report.md | 127 +++++++++++++++++++++
2 files changed, 254 insertions(+)
diff --git a/blog/en/blog/2026/09/30/2026-sep-monthly-report.md
b/blog/en/blog/2026/09/30/2026-sep-monthly-report.md
new file mode 100644
index 00000000000..18238036d36
--- /dev/null
+++ b/blog/en/blog/2026/09/30/2026-sep-monthly-report.md
@@ -0,0 +1,127 @@
+---
+title: "2026 Monthly Report (September 01 - September 30)"
+keywords: ["Apache APISIX", "API Gateway", "Monthly Report", "Contributor"]
+description: Our monthly Apache APISIX community report generates insights
into the project's monthly developments. The reports provide a pathway into the
Apache APISIX community, ensuring that you stay well-informed and actively
involved.
+tags: [Community]
+image:
https://static.api7.ai/uploads/2026/09/30/nIHKCxPD_2026-sep-monthly-report-cover-en.webp
+---
+
+> Recently, we've introduced and updated some new features, including
OpenAPI-to-MCP conversion, frame-aware WebSocket proxying, TLS stream
passthrough, more reliable standalone updates, and slow start for new upstream
nodes. For more details, please read this month's newsletter.
+
+<!--truncate-->
+
+## Introduction
+
+From its inception, the Apache APISIX project has embraced the ethos of
open-source community collaboration, propelling it into the ranks of the most
active global open-source API gateway projects. The proverbial wisdom of
'teamwork makes the dream work' rings true in our way and is made possible by
the collective effort of our community.
+
+From September 1st to September 30th, 13 contributors made 90 commits to
Apache APISIX. We sincerely appreciate your contributions to Apache APISIX.
+
+## Contributor Statistics
+
+<img
src="https://static.api7.ai/uploads/2026/09/30/iz0vGcyV_sep-contributor-list.webp";
alt="Apache APISIX Contributors List" />
+
+<img
src="https://static.api7.ai/uploads/2026/09/30/ngWZsnl2_2026-sep-new-contributors.webp";
alt="New Contributors List" />
+
+## Feature Highlights
+
+Here are the key updates from this month, grouped by capability area.
+
+### AI and MCP Operations
+
+#### 1. Expose Plugin-Owned Health Checks Through the Control API
+
+PR: https://github.com/apache/apisix/pull/13899
+
+Contributor: [AlinsRan](https://github.com/AlinsRan)
+
+This PR lets plugins declare their own health-check targets, enabling the
Control API to report directly configured `ai-proxy-multi` instances whose
request path creates a checker. A new
`/v1/healthcheck/{src_type}/{src_id}/checkers` endpoint returns every upstream-
and plugin-owned checker for a resource, while the existing single-checker
endpoint remains unchanged. The single-instance fast path does not create a
checker, and plugins inherited through `plugin_config` are not discovered [...]
+
+#### 2. Generate MCP Tools from OpenAPI Documents
+
+PR: https://github.com/apache/apisix/pull/13942
+
+Contributor: [AlinsRan](https://github.com/AlinsRan)
+
+The new `openapi-to-mcp` plugin turns operations from an OpenAPI document into
MCP tools and serves them over Streamable HTTP or HTTP+SSE without requiring a
separate MCP server. Authentication, rate limiting, response, and logging
plugins on the route still apply, while operators should note that SSE sessions
are local to one APISIX instance and outbound document and tool requests do not
use APISIX upstream load balancing or health checks.
+
+#### 3. Price Nested AI Usage Fields
+
+PR: https://github.com/apache/apisix/pull/13984
+
+Contributor: [shreemaan-abhishek](https://github.com/shreemaan-abhishek)
+
+This PR exposes nested numeric usage fields to `ai-rate-limiting` cost
expressions by joining each path with `__`, such as
`input_tokens_details__cached_tokens`. Existing top-level expressions keep
their current behavior, sibling fields remain distinct, arrays are skipped, and
missing fields continue to evaluate as zero.
+
+### WebSocket Observability and Extensibility
+
+#### 4. Distinguish WebSocket Sessions in Metrics
+
+PR: https://github.com/apache/apisix/pull/13909
+
+Contributor: [janiussyafiq](https://github.com/janiussyafiq)
+
+APISIX now labels requests that complete a `101 Switching Protocols` handshake
with `request_type="websocket"`, allowing operators to separate long-lived
sessions from ordinary HTTP latency, status, and bandwidth metrics. The
classification is based on the response rather than route configuration or
request headers, so refused upgrades remain labeled as `traditional_http`.
+
+#### 5. Add Frame-Aware WebSocket Proxying and Plugin Hooks
+
+PR: https://github.com/apache/apisix/pull/13939
+
+Contributor: [bzp2010](https://github.com/bzp2010)
+
+This PR adds `ws` and `wss` upstream schemes that let APISIX proxy WebSocket
connections itself and expose handshake, client-frame, upstream-frame, and
close phases to plugins. Plugins can inspect or rewrite individual frames,
while connection failures can be retried before the client handshake; after a
`101` response has been sent, a later upstream failure can only close the
connection rather than return another HTTP response.
+
+#### 6. Configure WebSocket Payload Limits per Route
+
+PR: https://github.com/apache/apisix/pull/13972
+
+Contributor: [bzp2010](https://github.com/bzp2010)
+
+The new `websocket-proxy` plugin configures client- and upstream-facing
`max_payload_len` values for routes that use the frame-aware `ws` or `wss`
proxy path. Leaving the settings unset preserves the 65,535-byte default, while
timeout and protocol-correctness options remain deliberately controlled by the
existing upstream behavior rather than exposed through this plugin.
+
+### TLS, Stream Routing, and Identity
+
+#### 7. Route TLS Streams Without Terminating Encryption
+
+PR: https://github.com/apache/apisix/pull/13912
+
+Contributor: [AlinsRan](https://github.com/AlinsRan)
+
+APISIX stream listeners can now select an upstream from the ClientHello SNI
and pass the encrypted TLS session through without terminating it, including
mixed listeners where each stream route chooses passthrough or termination.
Passthrough is explicit and keeps certificates at the backend, but gateway mTLS
and payload-inspecting stream plugins do not apply; an upstream using `scheme:
tls` is rejected to prevent accidental double encryption. Because a mixed
listener uses an internal hop, [...]
+
+#### 8. Match Stream Routes Against Multiple SNIs
+
+PR: https://github.com/apache/apisix/pull/13911
+
+Contributor: [AlinsRan](https://github.com/AlinsRan)
+
+The new `snis` field lets one stream route match several SNI hostnames,
including the existing wildcard suffix behavior, so one Gateway API TLSRoute
rule no longer needs to be duplicated for every hostname. `sni` and `snis` are
mutually exclusive, and a bare `*` or the absence of both fields keeps SNI
unrestricted.
+
+#### 9. Strengthen SAML Response Validation and Replay Protection
+
+PR: https://github.com/apache/apisix/pull/13964
+
+Contributor: [shreemaan-abhishek](https://github.com/shreemaan-abhishek)
+
+The `saml-auth` plugin now exposes `lua-resty-saml` 0.2.6 options for accepted
issuers and audiences, an externally visible ACS URL, clock skew, and optional
assertion replay protection. Existing configurations retain their previous
defaults; replay records are stored in a configured shared dictionary and
prevent reuse on the same APISIX node rather than across a distributed cluster.
+
+### Platform Reliability and Traffic Readiness
+
+#### 10. Make API-Driven Standalone Updates Observable
+
+PR: https://github.com/apache/apisix/pull/13904
+
+Contributor: [bzp2010](https://github.com/bzp2010)
+
+API-driven standalone mode now reports per-worker configuration digests by
subsystem and entity type, and `PUT /apisix/admin/configs` accepts a `wait`
duration for collecting the applied status. A `200` response means every worker
accepted and loaded the configuration, while `202` means it was accepted but
full loading could not be guaranteed within the wait period; clients that omit
`wait` retain the previous behavior.
+
+#### 11. Ramp Up Traffic to Newly Added Upstream Nodes
+
+PR: https://github.com/apache/apisix/pull/13941
+
+Contributor: [AlinsRan](https://github.com/AlinsRan)
+
+The new `warm_up_conf` gradually increases the effective weight of newly
observed HTTP round-robin upstream nodes, helping cold services warm caches,
connection pools, and runtimes before receiving their full traffic share. The
first implementation applies to single-priority HTTP round-robin upstreams,
leaves existing behavior unchanged when disabled, and fails open to configured
weights when runtime state cannot safely support the ramp. Slow start only
redistributes traffic among availa [...]
+
+## Conclusion
+
+The [official website](https://apisix.apache.org/) and [GitHub
Issues](https://github.com/apache/apisix/issues) of Apache APISIX offer
extensive documentation, tutorials, and real-world use cases. If you encounter
any issues, you can refer to the documentation, search for keywords in Issues,
or participate in discussions on Issues to share your ideas and practical
experiences.
diff --git a/blog/zh/blog/2026/09/30/2026-sep-monthly-report.md
b/blog/zh/blog/2026/09/30/2026-sep-monthly-report.md
new file mode 100644
index 00000000000..3ef65786c2a
--- /dev/null
+++ b/blog/zh/blog/2026/09/30/2026-sep-monthly-report.md
@@ -0,0 +1,127 @@
+---
+title: "2026 社区月报 (09.01 - 09.30)"
+keywords: ["Apache APISIX", "API 网关", "社区月报", "贡献者"]
+description: Apache APISIX 社区的月报旨在帮助社区成员更全面地了解社区的最新动态，方便大家参与到 Apache APISIX
社区中来。
+tags: [Community]
+image:
https://static.api7.ai/uploads/2026/09/30/y5UQhvX2_2026-sep-monthly-report-cover-cn.webp
+---
+
+> 最近，我们引入并更新了一些新功能，包括将 OpenAPI 转换为 MCP 工具、面向消息帧的 WebSocket 代理、TLS 流量透传、更可靠的
Standalone 配置更新，以及新增上游节点的慢启动等。有关更多细节，请阅读本期月报。
+
+<!--truncate-->
+
+## 导语
+
+Apache APISIX 项目始终秉承着开源社区协作的精神，自问世起便崭露头角，如今已经成为全球最活跃的开源 API
网关项目之一。正如谚语所言，“众人拾柴火焰高”，这一辉煌成就，得益于整个社区伙伴的协同努力。
+
+从 2026.09.01 至 2026.09.30，有 13 名开发者提交了 90 个 commits，为 Apache APISIX
做出了重要贡献。感谢这些伙伴们对 Apache APISIX 的无私支持！正是因为你们的付出，才能让 Apache APISIX 项目不断改进、提升和壮大。
+
+## 贡献者统计
+
+<img
src="https://static.api7.ai/uploads/2026/09/30/iz0vGcyV_sep-contributor-list.webp";
alt="贡献者名单" />
+
+<img
src="https://static.api7.ai/uploads/2026/09/30/ngWZsnl2_2026-sep-new-contributors.webp";
alt="新晋贡献者" />
+
+## 近期亮点功能
+
+以下是本月的重点更新，并按功能方向进行归类。
+
+### AI 与 MCP 运维能力
+
+#### 1. 通过 Control API 暴露插件持有的健康检查
+
+相关 PR：https://github.com/apache/apisix/pull/13899
+
+贡献者：[AlinsRan](https://github.com/AlinsRan)
+
+该 PR 支持插件声明自身持有的健康检查目标，使 Control API 能够展示直接配置且在请求路径中创建了检查器的 `ai-proxy-multi`
实例。新增的 `/v1/healthcheck/{src_type}/{src_id}/checkers`
接口会返回资源下全部由上游和插件持有的检查器，同时保持原有单检查器接口不变。单实例快捷路径不会创建检查器，该接口也不会发现通过 `plugin_config`
继承的插件。
+
+#### 2. 根据 OpenAPI 文档生成 MCP 工具
+
+相关 PR：https://github.com/apache/apisix/pull/13942
+
+贡献者：[AlinsRan](https://github.com/AlinsRan)
+
+新增的 `openapi-to-mcp` 插件可将 OpenAPI 文档中的操作转换为 MCP 工具，并通过 Streamable HTTP 或
HTTP+SSE 对外提供，无需另行部署 MCP Server。路由上的身份认证、限流、响应处理和日志插件仍然生效；需要注意的是，SSE 会话仅在单个
APISIX 实例内共享，文档获取和工具调用也不会经过 APISIX 上游的负载均衡与健康检查。
+
+#### 3. 根据嵌套的 AI 用量字段计费
+
+相关 PR：https://github.com/apache/apisix/pull/13984
+
+贡献者：[shreemaan-abhishek](https://github.com/shreemaan-abhishek)
+
+该 PR 通过 `__` 拼接字段路径，将嵌套的数值型用量数据暴露给 `ai-rate-limiting` 的成本表达式，例如
`input_tokens_details__cached_tokens`。现有顶层字段表达式保持原有行为，同名的兄弟字段不会冲突，数组会被跳过，缺失字段仍按零处理。
+
+### WebSocket 可观测性与扩展能力
+
+#### 4. 在指标中区分 WebSocket 会话
+
+相关 PR：https://github.com/apache/apisix/pull/13909
+
+贡献者：[janiussyafiq](https://github.com/janiussyafiq)
+
+APISIX 现在会将成功返回 `101 Switching Protocols` 的请求标记为
`request_type="websocket"`，便于从延迟、状态码和带宽指标中区分长连接会话与普通 HTTP
请求。该分类依据实际响应，而不是路由配置或请求头，因此升级失败的请求仍会标记为 `traditional_http`。
+
+#### 5. 新增面向消息帧的 WebSocket 代理与插件钩子
+
+相关 PR：https://github.com/apache/apisix/pull/13939
+
+贡献者：[bzp2010](https://github.com/bzp2010)
+
+该 PR 新增 `ws` 和 `wss` 上游协议，使 APISIX 能够自行代理 WebSocket
连接，并向插件开放握手、客户端消息帧、上游消息帧和连接关闭阶段。插件可以逐帧检查或改写内容；客户端握手完成前的连接失败可以触发上游重试，但在 `101`
响应发出后发生的故障只能关闭连接，无法再返回新的 HTTP 响应。
+
+#### 6. 按路由配置 WebSocket 负载大小限制
+
+相关 PR：https://github.com/apache/apisix/pull/13972
+
+贡献者：[bzp2010](https://github.com/bzp2010)
+
+新增的 `websocket-proxy` 插件可为使用消息帧代理路径的 `ws` 或 `wss` 路由分别配置客户端侧和上游侧的
`max_payload_len`。未配置时继续使用 65,535 字节的默认值；超时和协议正确性相关选项仍由现有上游行为管理，不通过该插件开放。
+
+### TLS、Stream 路由与身份安全
+
+#### 7. 在不终止加密的情况下路由 TLS 流量
+
+相关 PR：https://github.com/apache/apisix/pull/13912
+
+贡献者：[AlinsRan](https://github.com/AlinsRan)
+
+APISIX Stream 监听器现在可以根据 ClientHello 中的 SNI 选择上游，并在不终止 TLS
的情况下透传加密会话；混合监听端口还可由各条 Stream Route 决定执行透传还是终止 TLS。透传模式需要显式启用，并将证书保留在后端，但网关侧
mTLS 和需要检查负载内容的 Stream 插件不会生效；为避免意外的二次加密，使用 `scheme: tls`
的上游会被拒绝。由于混合监听端口需要经过内部跳转，`apisix_stream_metrics_zone` 会对该端口上的每个客户端连接计数两次。
+
+#### 8. 使用多个 SNI 匹配一条 Stream Route
+
+相关 PR：https://github.com/apache/apisix/pull/13911
+
+贡献者：[AlinsRan](https://github.com/AlinsRan)
+
+新增的 `snis` 字段允许一条 Stream Route 匹配多个 SNI 主机名，并沿用现有的通配符后缀语义，因此无需再为 Gateway API
TLSRoute 的每个主机名复制路由。`sni` 与 `snis` 不能同时使用；配置单独的 `*` 或不配置这两个字段时，SNI 不受限制。
+
+#### 9. 增强 SAML 响应校验与重放保护
+
+相关 PR：https://github.com/apache/apisix/pull/13964
+
+贡献者：[shreemaan-abhishek](https://github.com/shreemaan-abhishek)
+
+`saml-auth` 插件现已开放 `lua-resty-saml` 0.2.6 中的发行方、受众、外部 ACS
URL、时钟偏差和可选断言重放保护配置。现有配置继续沿用原有默认行为；重放记录保存在指定的共享字典中，只能阻止同一 APISIX
节点上的重复使用，而不是跨分布式集群共享。
+
+### 平台可靠性与流量就绪
+
+#### 10. 提升 API 驱动 Standalone 配置更新的可观测性
+
+相关 PR：https://github.com/apache/apisix/pull/13904
+
+贡献者：[bzp2010](https://github.com/bzp2010)
+
+API 驱动的 Standalone 模式现在会按子系统和实体类型上报各 Worker 的配置摘要，`PUT /apisix/admin/configs`
也可通过 `wait` 参数收集配置应用状态。返回 `200` 表示所有 Worker 都已接受并加载配置，返回 `202`
表示配置已被接受，但无法保证在等待期内全部加载完成；未传入 `wait` 的客户端保持原有行为。
+
+#### 11. 为新加入的上游节点逐步增加流量
+
+相关 PR：https://github.com/apache/apisix/pull/13941
+
+贡献者：[AlinsRan](https://github.com/AlinsRan)
+
+新增的 `warm_up_conf` 会逐步提高新识别到的 HTTP Round Robin
上游节点的有效权重，使冷启动服务能先预热缓存、连接池和运行时，再接收完整流量份额。首个版本适用于单优先级的 HTTP Round Robin
上游；未启用时保持现有行为，在运行时状态无法安全支持慢启动时则回退到配置权重。慢启动只会在可用节点之间重新分配流量，因此单节点上游或全部节点都是新节点的上游仍会把所有请求发送给这些节点。
+
+## 结语
+
+Apache APISIX 的项目[官网](https://apisix.apache.org/zh/)和 GitHub 上的
[Issues](https://github.com/apache/apisix/issues)
上已经积累了比较丰富的文档教程和使用经验，如果您遇到问题可以翻阅文档，用关键词在 Issues 中搜索，也可以参与 Issues
上的讨论，提出自己的想法和实践经验。
![https://static.api7.ai/uploads/2026/09/30/iz0vGcyV_sep-contributor-list.webp"](https://static.api7.ai/uploads/2026/09/30/iz0vGcyV_sep-contributor-list.webp"){kind=link}
![https://static.api7.ai/uploads/2026/09/30/ngWZsnl2_2026-sep-new-contributors.webp"](https://static.api7.ai/uploads/2026/09/30/ngWZsnl2_2026-sep-new-contributors.webp"){kind=link}
