shreemaan-abhishek commented on code in PR #14154: URL: https://github.com/apache/apisix/pull/14154#discussion_r4477493546
########## CHANGELOG.md: ########## @@ -93,6 +93,7 @@ title: Changelog ### Change +- :warning: fix(openapi-to-mcp): reject path parameter values that can change the operation's path. Encoded `/` and `\` separators are rejected by default; set `allow_encoded_path_separators: true` only for an upstream that intentionally treats them as data. Finished empty and dot path segments remain rejected, and the opt-in still rejects separator-delimited empty and dot components [#14154](https://github.com/apache/apisix/pull/14154) Review Comment: Addressed in 17448d38e. I removed the premature 3.19.0 changelog entry and refreshed the PR description to explain the secure-default separator policy, `allow_encoded_path_separators`, the remaining validation rules, and the compatibility impact. The backward-compatible checklist item is now unchecked. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
