kayx23 commented on code in PR #14168: URL: https://github.com/apache/apisix/pull/14168#discussion_r4490508042
########## CHANGELOG.md: ########## @@ -87,6 +88,67 @@ title: Changelog - [0.7.0](#070) - [0.6.0](#060) +## 3.20.0 + +**The changes marked with :warning: are not backward compatible.** + +### Change + +- :warning: feat!: remove the `mcp-bridge` plugin, which was deprecated in 3.18.0 with a note that it would be removed in a future release. A configuration that still lists `mcp-bridge` under `plugins` has to drop the entry, and `openapi-to-mcp` is the MCP plugin going forward [#14019](https://github.com/apache/apisix/pull/14019) +- :warning: refactor(wolf-rbac): move `header_prefix` to the Route or Service configuration, where it defaults to `X-`, so a Route owns its identity headers and clears `{prefix}UserId`, `{prefix}Username` and `{prefix}Nickname` before any authenticator runs. Move a custom `header_prefix` from each Consumer to every Route or Service using `wolf-rbac` (including inside `multi-auth`) before upgrading, because a Consumer carrying one is now rejected; `appid` (now required), `server` and `ssl_verify` stay on the Consumer [#13929](https://github.com/apache/apisix/pull/13929) +- :warning: fix(oas-validator): verify the TLS certificate of the `spec_url` host. `ssl_verify` now defaults to `true`, so an `https` spec served with a certificate outside the trust store fails the fetch and the route answers 500; set `ssl_verify: false` to keep the old behavior, which is now logged as an opt-out [#14146](https://github.com/apache/apisix/pull/14146) +- :warning: fix(authz-keycloak): require every requested permission to be granted. The plugin asks Keycloak for `response_mode=permissions` and checks each requested resource and scope against the granted list, so a route listing several permissions, a permission with several scopes, or `http_method_as_scope` on a scoped permission answers 403 unless all of them are granted. Each permission is also sent as `resource#scope1,scope2`, which is the form Keycloak splits on [#14098](https://github.com/apache/apisix/pull/14098) Review Comment: Addressed in d8315418. Verified that the current entry now covers the trimmed-scope rewrite and the 503 for a response that is not a permissions list. Resolving. ########## CHANGELOG.md: ########## @@ -87,6 +88,67 @@ title: Changelog - [0.7.0](#070) - [0.6.0](#060) +## 3.20.0 + +**The changes marked with :warning: are not backward compatible.** + +### Change + +- :warning: feat!: remove the `mcp-bridge` plugin, which was deprecated in 3.18.0 with a note that it would be removed in a future release. A configuration that still lists `mcp-bridge` under `plugins` has to drop the entry, and `openapi-to-mcp` is the MCP plugin going forward [#14019](https://github.com/apache/apisix/pull/14019) +- :warning: refactor(wolf-rbac): move `header_prefix` to the Route or Service configuration, where it defaults to `X-`, so a Route owns its identity headers and clears `{prefix}UserId`, `{prefix}Username` and `{prefix}Nickname` before any authenticator runs. Move a custom `header_prefix` from each Consumer to every Route or Service using `wolf-rbac` (including inside `multi-auth`) before upgrading, because a Consumer carrying one is now rejected; `appid` (now required), `server` and `ssl_verify` stay on the Consumer [#13929](https://github.com/apache/apisix/pull/13929) +- :warning: fix(oas-validator): verify the TLS certificate of the `spec_url` host. `ssl_verify` now defaults to `true`, so an `https` spec served with a certificate outside the trust store fails the fetch and the route answers 500; set `ssl_verify: false` to keep the old behavior, which is now logged as an opt-out [#14146](https://github.com/apache/apisix/pull/14146) +- :warning: fix(authz-keycloak): require every requested permission to be granted. The plugin asks Keycloak for `response_mode=permissions` and checks each requested resource and scope against the granted list, so a route listing several permissions, a permission with several scopes, or `http_method_as_scope` on a scoped permission answers 403 unless all of them are granted. Each permission is also sent as `resource#scope1,scope2`, which is the form Keycloak splits on [#14098](https://github.com/apache/apisix/pull/14098) +- :warning: feat(openid-connect): upgrade `lua-resty-openidc` to 1.9.3 and `lua-resty-session` to 4.2.0, so an introspection failure is reported for what it is: a confirmed inactive token returns 401, an endpoint, transport or response failure returns 503, and a configuration failure returns 500. An introspection response whose `active` claim is missing or is not a boolean is now rejected as an invalid upstream response instead of being read as truthy [#14088](https://github.com/apache/apisix/pull/14088) Review Comment: Partial. Leaving introspection coalescing in the plugin docs is reasonable, but session and revocation-store failure propagation is caller-visible. I restated the scoped upgrade guidance on the current line in discussion_r4490479704. Resolving this earlier thread in favor of the current one. ########## CHANGELOG.md: ########## @@ -87,6 +88,67 @@ title: Changelog - [0.7.0](#070) - [0.6.0](#060) +## 3.20.0 + +**The changes marked with :warning: are not backward compatible.** + +### Change + +- :warning: feat!: remove the `mcp-bridge` plugin, which was deprecated in 3.18.0 with a note that it would be removed in a future release. A configuration that still lists `mcp-bridge` under `plugins` has to drop the entry, and `openapi-to-mcp` is the MCP plugin going forward [#14019](https://github.com/apache/apisix/pull/14019) +- :warning: refactor(wolf-rbac): move `header_prefix` to the Route or Service configuration, where it defaults to `X-`, so a Route owns its identity headers and clears `{prefix}UserId`, `{prefix}Username` and `{prefix}Nickname` before any authenticator runs. Move a custom `header_prefix` from each Consumer to every Route or Service using `wolf-rbac` (including inside `multi-auth`) before upgrading, because a Consumer carrying one is now rejected; `appid` (now required), `server` and `ssl_verify` stay on the Consumer [#13929](https://github.com/apache/apisix/pull/13929) +- :warning: fix(oas-validator): verify the TLS certificate of the `spec_url` host. `ssl_verify` now defaults to `true`, so an `https` spec served with a certificate outside the trust store fails the fetch and the route answers 500; set `ssl_verify: false` to keep the old behavior, which is now logged as an opt-out [#14146](https://github.com/apache/apisix/pull/14146) +- :warning: fix(authz-keycloak): require every requested permission to be granted. The plugin asks Keycloak for `response_mode=permissions` and checks each requested resource and scope against the granted list, so a route listing several permissions, a permission with several scopes, or `http_method_as_scope` on a scoped permission answers 403 unless all of them are granted. Each permission is also sent as `resource#scope1,scope2`, which is the form Keycloak splits on [#14098](https://github.com/apache/apisix/pull/14098) +- :warning: feat(openid-connect): upgrade `lua-resty-openidc` to 1.9.3 and `lua-resty-session` to 4.2.0, so an introspection failure is reported for what it is: a confirmed inactive token returns 401, an endpoint, transport or response failure returns 503, and a configuration failure returns 500. An introspection response whose `active` claim is missing or is not a boolean is now rejected as an invalid upstream response instead of being read as truthy [#14088](https://github.com/apache/apisix/pull/14088) +- :warning: feat(prometheus): add `service` and `service_id` to all four stream metrics, so `apisix_stream_connection_total`, `apisix_stream_active_connections`, `apisix_stream_status` and `apisix_stream_bandwidth` gain two labels. Update PromQL selectors, recording rules, dashboards and alerts that match those series exactly; both labels are empty for a session that never reached a Stream Route with a Service, so summing over `service` reproduces the previous values [#13992](https://github.com/apache/apisix/pull/13992) +- :warning: fix(cli): don't capture openresty stdout in `apisix start`. With `access_log: /dev/stdout`, `apisix start` used to block forever while swallowing the logs, and it now returns once openresty has daemonized. A container whose only command is `apisix start` therefore exits, and should run openresty in the foreground with `daemon off;`, the way the official image entrypoint does [#14087](https://github.com/apache/apisix/pull/14087) +- :warning: fix: return 421 for SNI and Host mismatches on mTLS requests, so an HTTP/2 client that reused a connection opened for another origin can retry on a new connection with the target origin's SNI and client certificate. The mismatch check also moves ahead of the client certificate verification result; other verification failures keep returning 400 [#14013](https://github.com/apache/apisix/pull/14013) +- :warning: fix(router): forward the path the route was matched on whenever nginx normalized the request path, so the upstream receives the path the router matched rather than the raw request line. A request that differs from `$uri` only by percent-encoding or repeated slashes still forwards the original request line, and a plugin that sets `$upstream_uri` still takes precedence [#14035](https://github.com/apache/apisix/pull/14035) Review Comment: Addressed in d8315418. Verified the decoded-path consequence and example against the current entry. Resolving. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
