1. 64a4afd fix(ai-proxy): include cache tokens in Anthropic prompt usage and read them from message_delta (#14028) by AlinsRan · 19 hours ago master
  2. 2e43b6c feat(consul): support https consul server addresses (#14018) by Nic · 2 days ago
  3. 6a3a766 fix(consul): run the catalog and health watchers as independent timers (#14032) by Nic · 2 days ago
  4. e79d377 docs(limit-count): correct when the delayed-sync snapshot is refreshed (#14017) by Nic · 3 days ago
  5. 3551401 feat: add the request-decompress plugin (#14016) by Shreemaan Abhishek · 4 days ago
  6. a5ddc1c feat!: remove the deprecated mcp-bridge plugin (#14019) by Shreemaan Abhishek · 7 days ago
  7. 323997d docs(forward-auth): clarify that X-Forwarded-* carry the client request (#13978) by Shreemaan Abhishek · 7 days ago
  8. 88c4b8c fix(limit-count): refresh the delayed-sync quota after the local delta expired (#14015) by Nic · 8 days ago
  9. 9bd84f4 chore: migrate branch protection to rulesets (#13955) by Shreemaan Abhishek · 8 days ago
  10. cbd07d0 feat(limit-count): report the counting window in $rate_limiting_info (#13996) by Nic · 8 days ago
  11. 2b98a71 feat(kubernetes): select clusters by discovery_args.cluster_ids (#13991) by AlinsRan · 8 days ago
  12. 2ee8dfa feat(prometheus): add service and service_id to the stream metrics (#13992) by AlinsRan · 8 days ago
  13. c6b2adc feat(ai-rate-limiting): expose nested usage fields to cost_expr (#13984) by Shreemaan Abhishek · 3 weeks ago
  14. ee7dc10 chore: release 3.19.0 (#13976) by Shreemaan Abhishek · 3 weeks ago
  15. d97d5f7 ci(test): migrate from jest to vitest (#13989) by Zeping Bai · 3 weeks ago
  16. 271e799 fix(websocket): address review findings on the ws/wss proxy path (#13977) by Zeping Bai · 3 weeks ago
  17. 97b6122 feat(websocket): add plugin to customize proxy behaviors (#13972) by Zeping Bai · 4 weeks ago
  18. 52eb4e3 feat(websocket): add enhanced proxy and plugin hook (#13939) by Zeping Bai · 4 weeks ago
  19. 3d64360 feat(saml-auth): add lua-resty-saml 0.2.6 validation options (#13964) by Shreemaan Abhishek · 4 weeks ago
  20. c4776e8 docs: fix traffic-split attribute table rendering (#13965) by Yilia Lin · 4 weeks ago
  21. 789d4b8 fix(openapi-to-mcp): apply defaults, keep SSE variables, reject non-OpenAPI documents (#13956) by AlinsRan · 4 weeks ago
  22. 694fd35 fix(ext-plugin-post-resp): set upstream_addr and upstream_response_time for loggers (#13940) by Mohammad Izzraff Janius · 4 weeks ago
  23. b172d64 ci: fix dev image push (#13930) by Zeping Bai · 4 weeks ago
  24. c525ae5 feat(upstream): slow start for newly observed upstream nodes (#13941) by AlinsRan · 4 weeks ago
  25. 0890d2d fix(feishu-auth, dingtalk-auth): bind the authorization code to the session that started the login (#13806) by Shreemaan Abhishek · 4 weeks ago
  26. e564adb feat: add openapi-to-mcp plugin (#13942) by AlinsRan · 4 weeks ago
  27. 32cdc62 feat(stream): match a stream route by several SNIs (#13911) by AlinsRan · 4 weeks ago
  28. 8615934 test: stabilize plugin tests and cover CI bailouts (#13948) by Nic · 4 weeks ago
  29. 5e784af fix(ai-proxy): avoid aborting streams on empty flushes (#13947) by Nic · 4 weeks ago
  30. 4278bc9 fix(redis): send the TLS SNI and add redis_server_name (#13938) by Mohammad Izzraff Janius · 4 weeks ago
  31. d5ea736 fix(etcd): check availability before starting watcher (#13934) by Shreemaan Abhishek · 5 weeks ago
  32. d13105e test(xds): wait for the privileged agent's startup sync before flush_all in TEST 4 (#13937) by Mohammad Izzraff Janius · 5 weeks ago
  33. a1e02b8 test(elasticsearch-logger): drop the max_pending_entries metadata after the discard test (#13924) by Mohammad Izzraff Janius · 5 weeks ago
  34. a508d83 fix(plugin): align unavailable plugin handling (#13928) by Shreemaan Abhishek · 5 weeks ago
  35. b956270 fix(openid-connect): validate introspection issuer (#13916) by Shreemaan Abhishek · 5 weeks ago
  36. c3141d4 fix(batch-requests): bound aggregated response bodies (#13906) by Shreemaan Abhishek · 5 weeks ago
  37. efef0e8 docs(changelog): add the 3.18.0 section to the Chinese changelog (#13843) by Shreemaan Abhishek · 5 weeks ago
  38. 9aee46a fix(workflow): reject invalid case expressions and missing action conf (#13862) by Arjen10 · 5 weeks ago
  39. 09b19c6 fix: preserve servlet upstream URI boundaries (#13914) by Shreemaan Abhishek · 5 weeks ago
  40. 1f6120d fix(ai-aliyun-content-moderation): report final results without usage (#13922) by Nic · 5 weeks ago
  41. 96a4e7c fix(ci): stop rerun_flaky_tests from turning unparsable failures into a pass (#13923) by Nic · 5 weeks ago
  42. 316aea7 fix(standalone): harden the declarative configuration paths (#13886) by AlinsRan · 5 weeks ago
  43. fae2704 fix(ci): unbreak CI under pnpm 12 (#13921) by Nic · 6 weeks ago
  44. 57b401d feat(stream): support TLS passthrough on the stream proxy (#13912) by AlinsRan · 6 weeks ago
  45. f362398 fix(etcd): watch from the revision the configuration was read at (#13917) by Nic · 6 weeks ago
  46. 978dfce fix: write request_type=websocket through ctx.var (#13915) by Mohammad Izzraff Janius · 6 weeks ago
  47. 494dc42 feat: label WebSocket sessions with request_type=websocket (#13909) by Mohammad Izzraff Janius · 6 weeks ago
  48. 15a4381 feat: improve API-driven standalone update reliability (#13904) by Zeping Bai · 6 weeks ago
  49. 9fc501f fix(aws-lambda): request "/" for a path-less function_uri and log function error responses (#13908) by Mohammad Izzraff Janius · 6 weeks ago
  50. f0bb251 fix(ai-cache): key the passthrough protocol on the client method, path and query (#13887) by Shreemaan Abhishek · 6 weeks ago
  51. 96a5b43 test(skywalking): remove worker-0 dependency in backend timer assertion (#13902) by Mohammad Izzraff Janius · 6 weeks ago
  52. 89e6273 feat(control-api): report the health checks a plugin owns (#13899) by AlinsRan · 6 weeks ago
  53. 385b80a fix(jwe-decrypt): accept JWE tokens that authenticate the protected header (#13889) by AlinsRan · 6 weeks ago
  54. 51fad8a fix(traffic-label): cache the compiled match expressions outside the plugin config (#13901) by Nic · 6 weeks ago
  55. bd8ac3a docs: add LocalAI integration tutorial (#13770) by Ming Wen · 6 weeks ago
  56. f80e42c fix(basic-auth): split credentials on the first colon only (#13836) by Arjen10 · 6 weeks ago
  57. 10e61e0 docs: improve gateway operations guidance (#13900) by Yilia Lin · 7 weeks ago
  58. d53d855 fix(ai-providers): encode Vertex AI model path segment (#13872) by Shreemaan Abhishek · 7 weeks ago
  59. 1caee4f docs(openid-connect): recommend setting redirect_uri to an absolute URL (#13879) by Shreemaan Abhishek · 7 weeks ago
  60. bc54a21 fix(control): always report healthcheck nodes as a JSON array (#13891) by AlinsRan · 7 weeks ago
  61. 127e6bb test: give the redis counter poll five seconds instead of one (#13892) by Nic · 7 weeks ago
  62. 9037ee5 chore: bump APISIX-Runtime to 1.3.18 (#13890) by Nic · 7 weeks ago
  63. f94b3c7 docs: clarify JWE and RAG plugin guidance (#13873) by Yilia Lin · 7 weeks ago
  64. a64f2ba fix(standalone): stop aborting stream connections before the first config arrives (#13855) by AlinsRan · 7 weeks ago
  65. 97e3800 feat: chaitin waf response logging (#13763) by Blaise Wang · 7 weeks ago
  66. 6dbdb93 fix(jwe-decrypt): reject malformed tokens instead of returning 500 (#13844) by AlinsRan · 7 weeks ago
  67. 89c782e fix(etcd): do not block writes when the deployment role cannot be read (#13885) by AlinsRan · 7 weeks ago
  68. a036f18 fix(basic-auth): reject an empty consumer password (#13884) by Mohammad Izzraff Janius · 7 weeks ago
  69. b9cfc05 feat(upstream): verify the upstream certificate against configurable CAs (#13863) by Nic · 7 weeks ago
  70. 76ff252 test(ai-proxy): cover the AWS moderation path in the truncated-stream suite (#13880) by Nic · 7 weeks ago
  71. cb7e781 chore: upgrade lua-resty-dns-client to 7.1.2 (#13875) by AlinsRan · 7 weeks ago
  72. d55f6d3 fix(ua-restriction): return false when UA matches the deny_list (#13869) by Arjen10 · 7 weeks ago
  73. 77086b0 fix(ai-proxy): do not turn a streaming read error after partial output into a 5xx (#13876) by Nic · 7 weeks ago
  74. 5abb66e fix(ai-proxy): return 502 when a streaming upstream produces no output (#13870) by AlinsRan · 8 weeks ago
  75. e056eac docs: align plugin references with current behavior (#13864) by Yilia Lin · 8 weeks ago
  76. 579e18e fix(redirect): compare X-Forwarded-Proto case-insensitively (#13865) by Nic · 8 weeks ago
  77. f519a0f docs(admin-api): correct the retry_timeout type to Number (#13860) by Nic · 8 weeks ago
  78. fa69297 chore: release 3.18.0 (#13842) by Shreemaan Abhishek · 8 weeks ago
  79. d755355 feat(graphql-limit-count): rate limit by GraphQL query cost (#13840) by AlinsRan · 8 weeks ago
  80. 6e51dcf test(cli): wait for the pid file before reading it (#13854) by Nic · 8 weeks ago
  81. 749a9bc test(basic-auth): store the vault secret before the consumer references it (#13853) by Nic · 8 weeks ago
  82. 1719001 fix(data-mask): keep request header masking effective in the log phase (#13839) by Shreemaan Abhishek · 8 weeks ago
  83. aa4472c feat(ai-proxy-multi): let configured HTTP statuses trigger a fallback (#13852) by Nic · 8 weeks ago
  84. d069213 fix(ai-proxy-multi): reject instances that share a name (#13851) by Nic · 8 weeks ago
  85. 5e3ad1f test(ai-rate-limiting): wait for token usage to reach redis between requests (#13841) by Nic · 8 weeks ago
  86. eee3214 fix(openid-connect): enforce audience, issuer and required scopes (#13829) by Nic · 8 weeks ago
  87. 280afdd ci: retry the MCP server download and fail on a bad HTTP status (#13838) by Nic · 8 weeks ago
  88. 7ea42d4 feat(ai-proxy): send LLM requests through ngx_http_ffi_client (#13778) by Shreemaan Abhishek · 8 weeks ago
  89. a4bacbd feat(ldap-auth): add hide_credentials (#13832) by Nic · 8 weeks ago
  90. 59ab7ef fix(admin): encrypt the inline upstream client key of a stream route (#13833) by Nic · 8 weeks ago
  91. 942a9d7 fix(proxy-cache): keep Vary variant keys out of reach of a crafted request (#13831) by Nic · 8 weeks ago
  92. 0392290 fix(graphql-limit-count): measure each fragment once when computing query depth (#13809) by Shreemaan Abhishek · 8 weeks ago
  93. f0270cd fix: reframe request body forwarded upstream in serverless plugins (#13798) by Shreemaan Abhishek · 9 weeks ago
  94. 7bae553 fix(ldap-auth): key the consumer lookup on the escaped bind DN (#13805) by Shreemaan Abhishek · 9 weeks ago
  95. abdac4b feat(prometheus): stream active connections, termination status and bandwidth (#13796) by AlinsRan · 9 weeks ago
  96. 54bbdc4 fix(batch-processor): bound the pending entries backlog by default (#13826) by Nic · 9 weeks ago
  97. 62feab1 test(healthcheck): stop counting probes that land after the threshold (#13834) by Nic · 9 weeks ago
  98. 211f8f6 build: depend on a rapidjson rock that is not tied to the build host CPU (#13824) by Nic · 9 weeks ago
  99. 5dd7b9f fix(openid-connect): handle temporarily_unavailable error redirects from the ID provider (#13825) by Mohammad Izzraff Janius · 9 weeks ago
  100. f17bcb2 fix(hmac-auth): pass ctx when hiding the Authorization header (#13820) by Arjen10 · 9 weeks ago