feat: release 3.3.0 (#9400)

diff --git a/.asf.yaml b/.asf.yaml
index 3b495a7..ea44bea 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -53,6 +53,10 @@
           dismiss_stale_reviews: true
           require_code_owner_reviews: true
           required_approving_review_count: 2
+      release/3.3:
+        required_pull_request_reviews:
+          require_code_owner_reviews: true
+          required_approving_review_count: 2
       release/3.2:
         required_pull_request_reviews:
           require_code_owner_reviews: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0097b2e..8b0e1b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@
 
 ## Table of Contents
 
+- [3.3.0](#330)
 - [3.2.0](#320)
 - [3.1.0](#310)
 - [3.0.0](#300)
@@ -68,6 +69,40 @@
 - [0.7.0](#070)
 - [0.6.0](#060)
 
+## 3.3.0
+
+**The changes marked with :warning: are not backward compatible.**
+
+### Change
+
+- :warning: Change the default router from `radixtree_uri` to `radixtree_host_uri`: [#9047](https://github.com/apache/apisix/pull/9047)
+- :warning: CORS plugin will add `Vary: Origin` header when `allow_origin` is not `*`: [#9010](https://github.com/apache/apisix/pull/9010)
+
+### Core
+
+- :sunrise: Support store route's cert in secrets manager: [#9247](https://github.com/apache/apisix/pull/9247)
+- :sunrise: Support bypassing Admin API Auth by configuration: [#9147](https://github.com/apache/apisix/pull/9147)
+
+### Plugins
+
+- :sunrise: Support header injection for `fault-injection` plugin: [#9039](https://github.com/apache/apisix/pull/9039)
+- :sunrise: Support variable when rewrite header in `proxy-rewrite` plugin: [#9112](https://github.com/apache/apisix/pull/9112)
+- :sunrise: `limit-count` plugin supports `username` and `ssl` for redis policy: [#9185](https://github.com/apache/apisix/pull/9185)
+
+### Bugfixes
+
+- Fix etcd data sync exception: [#8493](https://github.com/apache/apisix/pull/8493)
+- Fix invalidate cache in `core.request.add_header` and fix some calls: [#8824](https://github.com/apache/apisix/pull/8824)
+- Fix the high CPU and memory usage cause by healthcheck impl: [#9015](https://github.com/apache/apisix/pull/9015)
+- Consider using `allow_origins_by_regex` only when it is not `nil`: [#9028](https://github.com/apache/apisix/pull/9028)
+- Check upstream reference in `traffic-split` plugin when delete upstream: [#9044](https://github.com/apache/apisix/pull/9044)
+- Fix failing to connect to etcd at startup: [#9077](https://github.com/apache/apisix/pull/9077)
+- Fix health checker leak for domain nodes: [#9090](https://github.com/apache/apisix/pull/9090)
+- Prevent non `127.0.0.0/24` to access admin api with empty admin_key: [#9146](https://github.com/apache/apisix/pull/9146)
+- Ensure `hold_body_chunk` should use separate buffer for each plugin in case of pollution: [#9266](https://github.com/apache/apisix/pull/9266)
+- Ensure `batch-requests` plugin read trailer headers if existed: [#9289](https://github.com/apache/apisix/pull/9289)
+- Ensure `proxy-rewrite` should set `ngx.var.uri`: [#9309](https://github.com/apache/apisix/pull/9309)
+
 ## 3.2.0
 
 ### Change
diff --git a/apisix/core/version.lua b/apisix/core/version.lua
index d83cba5..b690175 100644
--- a/apisix/core/version.lua
+++ b/apisix/core/version.lua
@@ -20,5 +20,5 @@
 -- @module core.version
 
 return {
-    VERSION = "3.2.0"
+    VERSION = "3.3.0"
 }
diff --git a/docs/en/latest/building-apisix.md b/docs/en/latest/building-apisix.md
index a0a20b4..98973f2 100644
--- a/docs/en/latest/building-apisix.md
+++ b/docs/en/latest/building-apisix.md
@@ -52,7 +52,7 @@
 Then, create a directory and set the environment variable `APISIX_VERSION`:
 
 ```shell
-APISIX_VERSION='3.2.0'
+APISIX_VERSION='3.3.0'
 mkdir apisix-${APISIX_VERSION}
 ```
 
diff --git a/docs/en/latest/config.json b/docs/en/latest/config.json
index d9804a1..0986887 100644
--- a/docs/en/latest/config.json
+++ b/docs/en/latest/config.json
@@ -1,5 +1,5 @@
 {
-  "version": "3.2.0",
+  "version": "3.3.0",
   "sidebar": [
     {
       "type": "category",
diff --git a/docs/zh/latest/CHANGELOG.md b/docs/zh/latest/CHANGELOG.md
index f8f8cad..bf4e68f 100644
--- a/docs/zh/latest/CHANGELOG.md
+++ b/docs/zh/latest/CHANGELOG.md
@@ -23,6 +23,7 @@
 
 ## Table of Contents
 
+- [3.3.0](#330)
 - [3.2.0](#320)
 - [3.1.0](#310)
 - [3.0.0](#300)
@@ -68,6 +69,38 @@
 - [0.7.0](#070)
 - [0.6.0](#060)
 
+## 3.3.0
+
+### Change
+
+- 默认路由从 `radixtree_uri` 修改为 `radixtree_host_uri`: [#9047](https://github.com/apache/apisix/pull/9047)
+- CORS 插件将会在 `allow_origin` 不为 `*` 时默认添加 `Vary: Origin` 响应头: [#9010](https://github.com/apache/apisix/pull/9010)
+
+### Core
+
+- :sunrise: 支持将路由证书存储在 secrets manager 中: [#9247](https://github.com/apache/apisix/pull/9247)
+- :sunrise: 支持通过配置绕过 Admin API 身份验证: [#9147](https://github.com/apache/apisix/pull/9147)
+
+### Plugins
+
+- :sunrise: fault-injection 插件支持请求头注入: [#9039](https://github.com/apache/apisix/pull/9039)
+- :sunrise: 提供在其他插件中引用 proxy-rewrite 插件中路由改写捕捉到的变量支持: [#9112](https://github.com/apache/apisix/pull/9112)
+- :sunrise: limit-count 插件提供 `username` 与 `ssl` redis 认证方式: [#9185](https://github.com/apache/apisix/pull/9185)
+
+### Bugfixes
+
+- 修复 etcd 数据同步异常: [#8493](https://github.com/apache/apisix/pull/8493)
+- 修复在 `core.request.add_header` 中的无效缓存: [#8824](https://github.com/apache/apisix/pull/8824)
+- 修复由健康检查引起的高 CPU 和内存占用: [#9015](https://github.com/apache/apisix/pull/9015)
+- 仅当 `allow_origins_by_regex` 不为 `nil` 时生效: [#9028](https://github.com/apache/apisix/pull/9028)
+- 在删除 upstream 时,检查 `traffic-split` 插件中的引用: [#9044](https://github.com/apache/apisix/pull/9044)
+- 修复启动时无法连接到 etcd 的问题: [#9077](https://github.com/apache/apisix/pull/9077)
+- 修复域节点的健康检查泄漏问题: [#9090](https://github.com/apache/apisix/pull/9090)
+- 禁止非 `127.0.0.0/24` 的用户在没有 admin_key 的情况下访问 Admin API: [#9146](https://github.com/apache/apisix/pull/9146)
+- 确保 hold_body_chunk 函数对每个插件设置独立缓冲区,避免数据污染: [#9266](https://github.com/apache/apisix/pull/9266)
+- 确保 batch-requests 插件能够在尾部响应头存在时能够正确读取: [#9289](https://github.com/apache/apisix/pull/9289)
+- 确保 `proxy-rewrite` 改写 `ngx.var.uri`: [#9309](https://github.com/apache/apisix/pull/9309)
+
 ## 3.2.0
 
 ### Change
diff --git a/docs/zh/latest/building-apisix.md b/docs/zh/latest/building-apisix.md
index 39e3224..b897bf9 100644
--- a/docs/zh/latest/building-apisix.md
+++ b/docs/zh/latest/building-apisix.md
@@ -53,7 +53,7 @@
 然后,创建一个目录并设置环境变量 `APISIX_VERSION`:
 
 ```shell
-APISIX_VERSION='3.2.0'
+APISIX_VERSION='3.3.0'
 mkdir apisix-${APISIX_VERSION}
 ```
 
diff --git a/docs/zh/latest/config.json b/docs/zh/latest/config.json
index 5d13c4f..4119ba6 100644
--- a/docs/zh/latest/config.json
+++ b/docs/zh/latest/config.json
@@ -1,5 +1,5 @@
 {
-  "version": "3.2.0",
+  "version": "3.3.0",
   "sidebar": [
     {
       "type": "doc",
diff --git a/rockspec/apisix-3.3.0-0.rockspec b/rockspec/apisix-3.3.0-0.rockspec
new file mode 100644
index 0000000..7dbb009
--- /dev/null
+++ b/rockspec/apisix-3.3.0-0.rockspec
@@ -0,0 +1,103 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements.  See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License.  You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+package = "apisix"
+version = "3.3.0-0"
+supported_platforms = {"linux", "macosx"}
+
+source = {
+    url = "git://github.com/apache/apisix",
+    branch = "3.3.0",
+}
+
+description = {
+    summary = "Apache APISIX is a cloud-native microservices API gateway, delivering the ultimate performance, security, open source and scalable platform for all your APIs and microservices.",
+    homepage = "https://github.com/apache/apisix",
+    license = "Apache License 2.0",
+}
+
+dependencies = {
+    "lua-resty-ctxdump = 0.1-0",
+    "api7-lua-resty-dns-client = 7.0.1",
+    "lua-resty-template = 2.0",
+    "lua-resty-etcd = 1.10.4",
+    "api7-lua-resty-http = 0.2.0",
+    "lua-resty-balancer = 0.04",
+    "lua-resty-ngxvar = 0.5.2",
+    "lua-resty-jit-uuid = 0.0.7",
+    "lua-resty-healthcheck-api7 = 2.2.3",
+    "api7-lua-resty-jwt = 0.2.4",
+    "lua-resty-hmac-ffi = 0.05",
+    "lua-resty-cookie = 0.1.0",
+    "lua-resty-session = 3.10",
+    "opentracing-openresty = 0.1",
+    "lua-resty-radixtree = 2.8.2",
+    "lua-protobuf = 0.4.1",
+    "lua-resty-openidc = 1.7.5",
+    "luafilesystem = 1.7.0-2",
+    "api7-lua-tinyyaml = 0.4.2",
+    "nginx-lua-prometheus = 0.20220527",
+    "jsonschema = 0.9.8",
+    "lua-resty-ipmatcher = 0.6.1",
+    "lua-resty-kafka = 0.20-0",
+    "lua-resty-logger-socket = 2.0.1-0",
+    "skywalking-nginx-lua = 0.6.0",
+    "base64 = 1.5-2",
+    "binaryheap = 0.4",
+    "api7-dkjson = 0.1.1",
+    "resty-redis-cluster = 1.02-4",
+    "lua-resty-expr = 1.3.2",
+    "graphql = 0.0.2",
+    "argparse = 0.7.1-1",
+    "luasocket = 3.1.0-1",
+    "luasec = 0.9-1",
+    "lua-resty-consul = 0.3-2",
+    "penlight = 1.9.2-1",
+    "ext-plugin-proto = 0.6.0",
+    "casbin = 1.41.5",
+    "api7-snowflake = 2.0-1",
+    "inspect == 3.1.1",
+    "lualdap = 1.2.6-1",
+    "lua-resty-rocketmq = 0.3.0-0",
+    "opentelemetry-lua = 0.2-3",
+    "net-url = 0.9-1",
+    "xml2lua = 1.5-2",
+    "nanoid = 0.1-1",
+    "lua-resty-mediador = 0.1.2-1",
+    "lua-resty-ldap = 0.2.2-0"
+}
+
+build = {
+    type = "make",
+    build_variables = {
+        CFLAGS="$(CFLAGS)",
+        LIBFLAG="$(LIBFLAG)",
+        LUA_LIBDIR="$(LUA_LIBDIR)",
+        LUA_BINDIR="$(LUA_BINDIR)",
+        LUA_INCDIR="$(LUA_INCDIR)",
+        LUA="$(LUA)",
+        OPENSSL_INCDIR="$(OPENSSL_INCDIR)",
+        OPENSSL_LIBDIR="$(OPENSSL_LIBDIR)",
+    },
+    install_variables = {
+        ENV_INST_PREFIX="$(PREFIX)",
+        ENV_INST_BINDIR="$(BINDIR)",
+        ENV_INST_LIBDIR="$(LIBDIR)",
+        ENV_INST_LUADIR="$(LUADIR)",
+        ENV_INST_CONFDIR="$(CONFDIR)",
+    },
+}