shreemaan-abhishek commented on PR #14168: URL: https://github.com/apache/apisix/pull/14168#issuecomment-6680556274
Thanks, this was a careful review. I checked every point against the `release/3.20` tree and they all hold up factually. I have taken twelve of them and am leaving seven out, with reasons below, so the release notes stay release notes rather than a second copy of the plugin docs. ### Applied in d8315418 - **wolf-rbac (#13929)**: now distinguishes the two cases, a custom value is rejected and a stored `X-` keeps validating and is dropped for compatibility (`wolf-rbac.lua` `check_schema`). - **authz-keycloak (#14098)**: added the scope rewrite. `parse_permission` trims each scope, so `res#view, delete` now asks for `delete` where the untrimmed `" delete"` was dropped by Keycloak and never enforced. Also noted the 503 on a response that is not a permissions list. - **prometheus stream labels (#13992)**: replaced the aggregation advice with `sum without (service, service_id) (...)`. - **openapi-to-mcp (#13959)**: added the `headers` schema rejection, which fails a *stored* Route rather than dropping a header from a call, plus the new defaults that apply with no configuration change: `max_response_body_size` 1 MiB, `max_document_size` 4 MiB, `max_expanded_nodes` 50000, `allowed_ref_hosts` for off-origin `$ref`, `Origin` validation against `allowed_origins`, and SSE sessions bound to the Route and Consumer. - **forward-auth (#14144)**: corrected to "no default `User-Agent`" per `docs/en/latest/plugins/forward-auth.md`, and added that `timeout` now bounds the whole response read, so a slow auth service can reach `status_on_error` sooner. - **router (#14035)**: added the consequence of the rewrite path. Since the forwarded path is the decoded `$uri`, `/a/./b%2Fc` reaches the upstream as `/a/b/c`. - **request-decompress (#14016)**: the upstream receives the inflated body as well unless `forward_compressed: true`, and named `max_req_body_size` with its 1 MiB default. - **prometheus cleanup interval (#13981)**: added the 3600 cap, that a non-positive value disables cleanup, and that the interval is independent of `refresh_interval`. - **limit-count (#13996)**: added that a key carrying a quote or backslash no longer produces invalid JSON. - **ai-proxy (#14028)**: added the converter change, `input_tokens` as `max(0, prompt_tokens - cache_read - cache_write)` for an Anthropic client on an OpenAI-compatible upstream, buffered and streaming. ### Left out - **openid-connect 1.9.1 internals**: the entry already gives the caller-visible contract (401/503/500 and the non-boolean `active`). Revocation-store propagation and introspection coalescing are library behaviour the plugin docs own, and nothing an operator acts on at upgrade time. - **`grpc_ssl_trusted_certificate` overriding `http_configuration_snippet`**: correct, but it needs `ssl.ssl_trusted_certificate` set *and* a hand-written grpc directive in that snippet, and `http_server_configuration_snippet` renders after the server-block directive and still wins. - **request-decompress 415/400/413 and the hmac-auth priority note**: reference material for a new opt-in plugin. No one is affected by upgrading, and the plugin doc covers it. - **`dict:add` end time and `X-AI-RateLimit-Reset`**: needs `ai-rate-limiting`, the `local` policy, a fixed window and zero-cost checks together. - **empty `Host` through `extra_headers`**: that configuration was already getting a 400 from an nginx auth service, so the change only makes it work. - **`#` fragment stripped from the operation template**: fragments are not sent in HTTP requests, so there is no observable change. - **`core.lrucache` strong reference**: internal. The entry's point is already that a changing `spec_url` stops accumulating compiled specs in worker memory. Happy to revisit any of the seven if you think one has a real upgrade path behind it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
