1. 7f7b7a0 fix(syslog): return early when logger init fails (#13970) by Bhuvan Somisetty · 5 hours ago master
  2. 7577c31 fix(syslog): separate error cause from message in syslog errors (#13974) by Bhuvan Somisetty · 10 hours ago
  3. 7c7c8f9 perf(limit-count): cache parsed templates, local limiters and header names (#14141) by AlinsRan · 10 hours ago
  4. 377cb59 perf(request-id): read only the configured header and encode v4 ids through a table (#14140) by AlinsRan · 10 hours ago
  5. 4d736af perf(forward-auth): send auth requests through ngx_http_ffi_client (#14144) by AlinsRan · 11 hours ago
  6. 5222007 fix(prometheus): bump nginx-lua-prometheus-api7 to 1.1.1 (#14150) by AlinsRan · 13 hours ago
  7. 7db9dce docs: modularize the Admin API OpenAPI specification (#14147) by Traky Deng · 13 hours ago
  8. 37b6304 fix(csrf): safely validate decoded token table and fields (#14025) by Bhuvan Somisetty · 27 hours ago
  9. 79a87e5 feat(core): make the readable request header count configurable (#14136) by Shreemaan Abhishek · 2 days ago
  10. f4a4cb4 chore: bump brotli to 1.2.1 (#14138) by Shreemaan Abhishek · 2 days ago
  11. 6205e4a docs: add source-verified Control API contract (#14131) by Traky Deng · 3 days ago
  12. 83db779 chore: bump APISIX-Runtime to 1.4.2 (#14126) by Shreemaan Abhishek · 4 days ago
  13. 5300993 fix(limit-count): keep delayed sync counters per rule (#14064) by lordcheng10 · 7 days ago
  14. bf40a99 fix(ssl): match skip_mtls_uri_regex against the encoded-slash route uri (#14108) by Shreemaan Abhishek · 7 days ago
  15. f88e1d2 refactor(wolf-rbac): move header_prefix to route configuration (#13929) by Shreemaan Abhishek · 7 days ago
  16. a135515 docs(proxy-cache): clarify that the remote_user isolation fallback is unverified (#14115) by Shreemaan Abhishek · 7 days ago
  17. ef71358 fix(ai-prompt-guard): check embeddings string arrays before forwarding (#14073) by ruanweihong-aaa · 7 days ago
  18. 88a41b7 docs: add source-verified Admin API contract for master (#14084) by Traky Deng · 7 days ago
  19. ff1187e fix(upstream): verify against ssl_trusted_certificate when only tls.verify is set (#14113) by AlinsRan · 7 days ago
  20. 2e27e9b feat(openid-connect): upgrade lua-resty-openidc to 1.9.3 (#14088) by Shreemaan Abhishek · 8 days ago
  21. f3390e5 fix(consul): upgrade lua-resty-consul to 0.4.0 (#14118) by AlinsRan · 8 days ago
  22. 3b33a03 Handle missing resource config in node version helpers (#13986) by Nikolai · 8 days ago
  23. ae87b94 fix(authz-keycloak): require every requested permission to be granted (#14098) by Shreemaan Abhishek · 8 days ago
  24. 0e4242f docs: port source-verified terminology corrections (#14105) by Traky Deng · 8 days ago
  25. b31e828 feat(chaitin-waf): add allow_degradation option for fail-open behavior (#13311) by jlongWang · 9 days ago
  26. b6deb41 feat(openid-connect): map verified claims to upstream request headers (#14030) by Shreemaan Abhishek · 9 days ago
  27. f7139e2 fix(jwe-decrypt,forward-auth): clear forwarded headers when skipping (#14096) by Shreemaan Abhishek · 9 days ago
  28. 238aa9e feat(prometheus): configure expired metric cleanup interval (#13981) by AlinsRan · 9 days ago
  29. f77401f fix(cli): don't capture openresty stdout in apisix start (#14087) by Nic · 10 days ago
  30. a177234 test(prometheus): wait for stream session metrics to reach the exposition (#14092) by Nic · 10 days ago
  31. 4a080d0 fix(router): forward the matched path when nginx normalizes the request uri (#14035) by Shreemaan Abhishek · 10 days ago
  32. 96ba388 fix(ai-proxy): account for Bedrock prompt cache tokens (#14044) by AlinsRan · 10 days ago
  33. f2523f7 chore: bump APISIX-Runtime to 1.4.0 (#14041) by Shreemaan Abhishek · 10 days ago
  34. b6cefbf fix(openapi-to-mcp): harden the plugin against a hostile document and caller (#13959) by AlinsRan · 11 days ago
  35. a546e85 fix(router): keep the query string when normalize_uri_like_servlet is on (#13982) by AlinsRan · 11 days ago
  36. 5dccf0e fix(oas-validator): release remote specs unused for spec_url_ttl (#14061) by Nic · 11 days ago
  37. 6c700c5 fix(traffic-split): apply tls and keepalive_pool of the inline upstream (#14054) by Nic · 11 days ago
  38. cea64fb ci: make CI work on the Ubuntu 26.04 runner image (#14070) by Nic · 13 days ago
  39. 210943c fix: preserve client-control body limit for gRPC upstreams (#14036) by ruanweihong-aaa · 14 days ago
  40. c4f09e1 fix(secret): do not include secret values in aws and vault error messages (#14049) by Nic · 2 weeks ago
  41. 016dcd0 fix(kubernetes): fail the list when a later page fails (#14053) by Nimesh · 2 weeks ago
  42. b972ce4 fix(nacos): keep cached nodes when a per-service refresh fails (#13971) by lordcheng10 · 2 weeks ago
  43. 9326926 docs: clarify RPM package links after UBI 9 migration (#14039) by ruanweihong-aaa · 2 weeks ago
  44. de0782a fix: return 421 for SNI and Host mismatches on mTLS requests (#14013) by ruanweihong-aaa · 2 weeks ago
  45. e14c6e9 feat(prometheus): export per-process timers, connection slots and Lua memory (#14034) by Nic · 3 weeks ago
  46. 64a4afd fix(ai-proxy): include cache tokens in Anthropic prompt usage and read them from message_delta (#14028) by AlinsRan · 3 weeks ago
  47. 2e43b6c feat(consul): support https consul server addresses (#14018) by Nic · 3 weeks ago
  48. 6a3a766 fix(consul): run the catalog and health watchers as independent timers (#14032) by Nic · 3 weeks ago
  49. e79d377 docs(limit-count): correct when the delayed-sync snapshot is refreshed (#14017) by Nic · 3 weeks ago
  50. 3551401 feat: add the request-decompress plugin (#14016) by Shreemaan Abhishek · 3 weeks ago
  51. a5ddc1c feat!: remove the deprecated mcp-bridge plugin (#14019) by Shreemaan Abhishek · 4 weeks ago
  52. 323997d docs(forward-auth): clarify that X-Forwarded-* carry the client request (#13978) by Shreemaan Abhishek · 4 weeks ago
  53. 88c4b8c fix(limit-count): refresh the delayed-sync quota after the local delta expired (#14015) by Nic · 4 weeks ago
  54. 9bd84f4 chore: migrate branch protection to rulesets (#13955) by Shreemaan Abhishek · 4 weeks ago
  55. cbd07d0 feat(limit-count): report the counting window in $rate_limiting_info (#13996) by Nic · 4 weeks ago
  56. 2b98a71 feat(kubernetes): select clusters by discovery_args.cluster_ids (#13991) by AlinsRan · 4 weeks ago
  57. 2ee8dfa feat(prometheus): add service and service_id to the stream metrics (#13992) by AlinsRan · 4 weeks ago
  58. c6b2adc feat(ai-rate-limiting): expose nested usage fields to cost_expr (#13984) by Shreemaan Abhishek · 5 weeks ago
  59. ee7dc10 chore: release 3.19.0 (#13976) by Shreemaan Abhishek · 6 weeks ago
  60. d97d5f7 ci(test): migrate from jest to vitest (#13989) by Zeping Bai · 6 weeks ago
  61. 271e799 fix(websocket): address review findings on the ws/wss proxy path (#13977) by Zeping Bai · 6 weeks ago
  62. 97b6122 feat(websocket): add plugin to customize proxy behaviors (#13972) by Zeping Bai · 7 weeks ago
  63. 52eb4e3 feat(websocket): add enhanced proxy and plugin hook (#13939) by Zeping Bai · 7 weeks ago
  64. 3d64360 feat(saml-auth): add lua-resty-saml 0.2.6 validation options (#13964) by Shreemaan Abhishek · 7 weeks ago
  65. c4776e8 docs: fix traffic-split attribute table rendering (#13965) by Yilia Lin · 7 weeks ago
  66. 789d4b8 fix(openapi-to-mcp): apply defaults, keep SSE variables, reject non-OpenAPI documents (#13956) by AlinsRan · 7 weeks ago
  67. 694fd35 fix(ext-plugin-post-resp): set upstream_addr and upstream_response_time for loggers (#13940) by Mohammad Izzraff Janius · 7 weeks ago
  68. b172d64 ci: fix dev image push (#13930) by Zeping Bai · 7 weeks ago
  69. c525ae5 feat(upstream): slow start for newly observed upstream nodes (#13941) by AlinsRan · 7 weeks ago
  70. 0890d2d fix(feishu-auth, dingtalk-auth): bind the authorization code to the session that started the login (#13806) by Shreemaan Abhishek · 7 weeks ago
  71. e564adb feat: add openapi-to-mcp plugin (#13942) by AlinsRan · 7 weeks ago
  72. 32cdc62 feat(stream): match a stream route by several SNIs (#13911) by AlinsRan · 7 weeks ago
  73. 8615934 test: stabilize plugin tests and cover CI bailouts (#13948) by Nic · 7 weeks ago
  74. 5e784af fix(ai-proxy): avoid aborting streams on empty flushes (#13947) by Nic · 7 weeks ago
  75. 4278bc9 fix(redis): send the TLS SNI and add redis_server_name (#13938) by Mohammad Izzraff Janius · 7 weeks ago
  76. d5ea736 fix(etcd): check availability before starting watcher (#13934) by Shreemaan Abhishek · 7 weeks ago
  77. d13105e test(xds): wait for the privileged agent's startup sync before flush_all in TEST 4 (#13937) by Mohammad Izzraff Janius · 8 weeks ago
  78. a1e02b8 test(elasticsearch-logger): drop the max_pending_entries metadata after the discard test (#13924) by Mohammad Izzraff Janius · 8 weeks ago
  79. a508d83 fix(plugin): align unavailable plugin handling (#13928) by Shreemaan Abhishek · 8 weeks ago
  80. b956270 fix(openid-connect): validate introspection issuer (#13916) by Shreemaan Abhishek · 8 weeks ago
  81. c3141d4 fix(batch-requests): bound aggregated response bodies (#13906) by Shreemaan Abhishek · 8 weeks ago
  82. efef0e8 docs(changelog): add the 3.18.0 section to the Chinese changelog (#13843) by Shreemaan Abhishek · 8 weeks ago
  83. 9aee46a fix(workflow): reject invalid case expressions and missing action conf (#13862) by Arjen10 · 8 weeks ago
  84. 09b19c6 fix: preserve servlet upstream URI boundaries (#13914) by Shreemaan Abhishek · 8 weeks ago
  85. 1f6120d fix(ai-aliyun-content-moderation): report final results without usage (#13922) by Nic · 8 weeks ago
  86. 96a4e7c fix(ci): stop rerun_flaky_tests from turning unparsable failures into a pass (#13923) by Nic · 8 weeks ago
  87. 316aea7 fix(standalone): harden the declarative configuration paths (#13886) by AlinsRan · 8 weeks ago
  88. fae2704 fix(ci): unbreak CI under pnpm 12 (#13921) by Nic · 9 weeks ago
  89. 57b401d feat(stream): support TLS passthrough on the stream proxy (#13912) by AlinsRan · 9 weeks ago
  90. f362398 fix(etcd): watch from the revision the configuration was read at (#13917) by Nic · 9 weeks ago
  91. 978dfce fix: write request_type=websocket through ctx.var (#13915) by Mohammad Izzraff Janius · 9 weeks ago
  92. 494dc42 feat: label WebSocket sessions with request_type=websocket (#13909) by Mohammad Izzraff Janius · 9 weeks ago
  93. 15a4381 feat: improve API-driven standalone update reliability (#13904) by Zeping Bai · 9 weeks ago
  94. 9fc501f fix(aws-lambda): request "/" for a path-less function_uri and log function error responses (#13908) by Mohammad Izzraff Janius · 9 weeks ago
  95. f0bb251 fix(ai-cache): key the passthrough protocol on the client method, path and query (#13887) by Shreemaan Abhishek · 9 weeks ago
  96. 96a5b43 test(skywalking): remove worker-0 dependency in backend timer assertion (#13902) by Mohammad Izzraff Janius · 9 weeks ago
  97. 89e6273 feat(control-api): report the health checks a plugin owns (#13899) by AlinsRan · 9 weeks ago
  98. 385b80a fix(jwe-decrypt): accept JWE tokens that authenticate the protected header (#13889) by AlinsRan · 9 weeks ago
  99. 51fad8a fix(traffic-label): cache the compiled match expressions outside the plugin config (#13901) by Nic · 9 weeks ago
  100. bd8ac3a docs: add LocalAI integration tutorial (#13770) by Ming Wen · 9 weeks ago