1. e4ace03 feat(limit-count): add Redis Sentinel backend, sliding window and delayed sync support (#13443) by AlinsRan · 3 hours ago master
  2. eb1af76 fix: avoid 503 error after dns service temporary fail (#13137) by Rafael Rivero García · 14 hours ago
  3. b509301 feat(ai-plugins): add fail_mode for Consumer-bound protocol handling (#13489) by AlinsRan · 20 hours ago
  4. cb72d0e fix(ai-proxy-multi): keep existing query string in health check path; cover construct_upstream mutation contract (#13506) by Nic · 23 hours ago
  5. 5270be1 fix(ai-proxy-multi): refresh cached server picker once health checkers are created (#13505) by Nic · 23 hours ago
  6. 9995d4c test(xrpc): fix first-run failures in redis.t and prometheus.t (#13507) by Nic · 24 hours ago
  7. f27d6f9 fix(request-id): generate nanoid with CSPRNG to avoid duplicate and malformed ids (#13508) by Nic · 24 hours ago
  8. 993ca77 fix(authz-casdoor): expire the session when the Casdoor token expires (#13500) by Nic · 24 hours ago
  9. 9d3c66d fix(upstream): use `cert` and `key` instead of stale `ok` in mTLS error checks (#13442) by okaybase · 24 hours ago
  10. bf9091a feat(ai-proxy): add built-in nginx variables for LLM observability (#13477) by AlinsRan · 2 days ago
  11. 418a8c6 feat(prometheus): add built-in LLM histograms for TTFT and token distribution (#13487) by AlinsRan · 2 days ago
  12. e2671c4 fix(dingtalk-auth): clear client-supplied X-Userinfo before authentication (#13491) by Shreemaan Abhishek · 2 days ago
  13. bf91696 fix(xrpc): bound redis command-line preallocation size (#13483) by Shreemaan Abhishek · 2 days ago
  14. dc4d52b feat(batch-requests): bound pipeline item count, timeout, and request schema (#13492) by Shreemaan Abhishek · 2 days ago
  15. 75bb631 fix(proxy-mirror): keep the original method path when mirroring gRPC requests (#13499) by Nic · 2 days ago
  16. 39eda84 test(openid-connect): cover session cookie_name and absolute_timeout end-to-end (#13496) by Nic · 2 days ago
  17. 7f2953e feat: add max_req_body_size to bound client request body in forward-auth and ai-proxy (#13466) by Shreemaan Abhishek · 2 days ago
  18. 1007366 feat(ai-proxy-multi): add max_retries and retry_on_failure_within_ms for fallback (#13495) by AlinsRan · 2 days ago
  19. b9c0c07 feat(openid-connect): update session config to support lua-resty-session, fixes deprecated session.cookie.lifetime (#13178) by Francesco De Domenico · 2 days ago
  20. b6f80f5 change(auth): require configured jwt claims, harden empty claims_to_verify and key-auth anonymous fallback (#13468) by Shreemaan Abhishek · 3 days ago
  21. 7f2eaa7 feat(hmac-auth): add max_req_body_size to bound request body during validation (#13478) by Shreemaan Abhishek · 3 days ago
  22. e99fb63 fix(ai-proxy): map upstream LLM timeouts to 504 instead of 500 (#13481) by Nic · 3 days ago
  23. 11a9dd1 fix test numbering and spacing in jwe-decrypt.t (#13485) by okaybase · 3 days ago
  24. 6e877eb fix(limit): atomic redis commits and resolved-var validation (#13467) by Shreemaan Abhishek · 4 days ago
  25. c730a74 feat(jwe-decrypt): remove server-side token generation endpoint (#13464) by Shreemaan Abhishek · 4 days ago
  26. 4cc1eaf feat(openid-connect): make client_secret optional for local JWT verification modes (#13472) by AlinsRan · 4 days ago
  27. fbf5106 fix: harden cors, multi-auth and body-transformer plugins against malformed requests (#13469) by Shreemaan Abhishek · 4 days ago
  28. 6d320c0 fix(cas-auth): return 400 instead of 500 for SLO POST with empty body (#13471) by Nic · 8 days ago
  29. 0048226 feat: add proxy-buffering plugin (#13446) by AlinsRan · 8 days ago
  30. 2330c09 fix(jwe-decrypt): reject tokens that fail to decrypt (#13404) by Shreemaan Abhishek · 8 days ago
  31. eb31ea4 docs: remove stale admin key default examples (#13448) by Traky Deng · 9 days ago
  32. 2d3d798 docs: update plugin examples for ingress controller 2.1.0 changes (#13462) by Traky Deng · 9 days ago
  33. 94f578a fix(cas-auth): harden session and callback handling (#13427) by Shreemaan Abhishek · 9 days ago
  34. 2c1771d docs: update AI plugin order in config example (#13383) by charliesheh · 10 days ago
  35. 473a189 fix(security): encrypt missing secret-like plugin fields at rest (#13389) by Shreemaan Abhishek · 10 days ago
  36. e1053fa fix(opa): apply send_headers_upstream for headers absent from OPA response (#13433) by Shreemaan Abhishek · 10 days ago
  37. 52d9d92 fix: sort AI proxy upstream request JSON keys (#13461) by Nic · 10 days ago
  38. 5f34568 revert: drop configurable request JSON libraries (#13449) by Nic · 11 days ago
  39. 1a3467b fix: isolate logger response body buffers (#13450) by Nic · 11 days ago
  40. 8e3e72b feat(plugin): add graphql-proxy-cache plugin (#13435) by AlinsRan · 11 days ago
  41. 37c29f8 feat: add saml-auth plugin (#13346) by AlinsRan · 11 days ago
  42. 6fe1cf0 test: fix standalone content type narrowing (#13459) by Nic · 11 days ago
  43. 30ab165 docs: add project security threat-model document + discoverability scaffold (#13457) by Jarek Potiuk · 12 days ago
  44. d5f5888 chore(deps-dev): bump axios from 1.15.2 to 1.16.0 in /t (#13455) by dependabot[bot] · 12 days ago
  45. e7fabc5 chore(deps-dev): bump axios from 1.13.5 to 1.15.2 in /t (#13341) by dependabot[bot] · 13 days ago
  46. 5d5613a feat(hmac-auth): default signed_headers to ["date"] (#13388) by Shreemaan Abhishek · 2 weeks ago
  47. 503e9f5 fix(authz-casdoor): scope session cookie per Casdoor client (#13387) by Shreemaan Abhishek · 2 weeks ago
  48. 4f40a46 fix(ai-proxy-multi): stabilize domain health checks (#13441) by Nic · 2 weeks ago
  49. 8cdb552 feat: add feishu-auth plugin (#13382) by AlinsRan · 2 weeks ago
  50. 77b328c feat(plugin): add graphql-limit-count plugin (#13372) by AlinsRan · 2 weeks ago
  51. 72c4eaf fix(authz-keycloak): copy permissions before appending http_method_as_scope (#13410) by Shreemaan Abhishek · 2 weeks ago
  52. 063d850 ci: use prebuilt apisix runtime (#13432) by Nic · 2 weeks ago
  53. 35a67f3 feat(plugin): add error-page plugin (#13380) by AlinsRan · 2 weeks ago
  54. 8048e74 fix: remove stale HTTP2 body guard (#13428) by Nic · 2 weeks ago
  55. cd32b79 feat: add dingtalk-auth plugin (#13381) by AlinsRan · 3 weeks ago
  56. 9166556 fix(gcp): report auth_file path instead of file contents in parse error (#13409) by Shreemaan Abhishek · 3 weeks ago
  57. e86c4fb feat(cas-auth): support configuring an absolute callback URL (#13413) by Shreemaan Abhishek · 3 weeks ago
  58. cd5f1ed feat(proxy-cache): honor Vary header for memory strategy (#13376) by Shreemaan Abhishek · 3 weeks ago
  59. c1fc58f perf(ai-proxy): optimize SSE decoder - remove PCRE, add decode_buf, fix comment lines (#13391) by AlinsRan · 3 weeks ago
  60. f434e1b chore: use apisix-runtime 1.3.6 (#13412) by Nic · 3 weeks ago
  61. 6dd6a34 perf(ai): reuse raw request body when unchanged (#13406) by Nic · 3 weeks ago
  62. 81dbc5b fix: preserve stream service plugin context (#13402) by Nic · 3 weeks ago
  63. ed5ca9e fix: normalize qjson errors in request json (#13407) by Nic · 3 weeks ago
  64. f06cba5 test: relax version assertions (#13403) by Nic · 3 weeks ago
  65. dc7a8d4 feat(cas-auth): sign request URI cookie and tighten cookie attributes (#13331) by Shreemaan Abhishek · 3 weeks ago
  66. d3f343d feat(ai): support configurable request JSON library (#13386) by Nic · 3 weeks ago
  67. 9f40d6c feat: add acl plugin (#13349) by AlinsRan · 3 weeks ago
  68. c57ee9c perf(core): cache parsed JSON request body to avoid redundant decoding (#13377) by AlinsRan · 4 weeks ago
  69. c205da9 docs(jwt-auth): fix missing TabItem tag in zh docs (#13378) by litesun · 4 weeks ago
  70. 173422c docs: fix documentation typos reported by codespell (#13365) by Arpit Jain · 4 weeks ago
  71. ece5cca feat: add data-mask plugin (#13347) by AlinsRan · 4 weeks ago
  72. ef1970a fix: replace module-level mutable tables with per-call allocation (#13369) by Nic · 4 weeks ago
  73. 06c15d3 perf(limit-count): use evalsha with NOSCRIPT fallback for Redis script execution (#13363) by Nic · 4 weeks ago
  74. c7b5618 feat(proxy-cache): add consumer_isolation and cache_set_cookie options (#13350) by Shreemaan Abhishek · 4 weeks ago
  75. f26baed fix(chaitin-waf): use trusted client IP source for WAF backend (#13339) by Shreemaan Abhishek · 4 weeks ago
  76. 5f028f3 perf(ctx): cache parsed request body to avoid repeated decode for post_arg.* (#13356) by AlinsRan · 4 weeks ago
  77. 6c988bc fix(core/etcd): nil-deref on response without header field (#13361) by Nic · 4 weeks ago
  78. 503f9eb fix: handle missing X-Etcd-Index header gracefully in config_etcd (#13364) by Nic · 4 weeks ago
  79. ba6035a docs(changelog): fix typos, version number, PR reference, and heading levels in v3.x sections (#13360) by YuanSheng Wang · 4 weeks ago
  80. 412d31d test(ai-aliyun-content-moderation): remove unused mock LLM location (#13354) by Mohammad Izzraff Janius · 4 weeks ago
  81. 4d4e0d4 feat: add exit-transformer plugin (#13343) by AlinsRan · 4 weeks ago
  82. 7539142 feat: add traffic-label plugin (#13342) by AlinsRan · 4 weeks ago
  83. f698d7e docs: update plugin docs with ADC and Ingress Controller examples (#13336) by Yilia Lin · 4 weeks ago
  84. 1b1ce5a fix(wolf-rbac): use trusted client IP source for access_check (#13329) by Shreemaan Abhishek · 5 weeks ago
  85. 9ef7709 fix: split global rules phase execution for client-control compatibility (#13345) by Nic · 5 weeks ago
  86. 026c0dc feat: add oas-validator plugin (#13344) by AlinsRan · 5 weeks ago
  87. 9908470 docs: update mqtt-proxy plugin docs (#13310) by Yilia Lin · 5 weeks ago
  88. 944512b feat(ai-proxy): support Bedrock ConverseStream streaming (#13307) by Shreemaan Abhishek · 5 weeks ago
  89. 8442977 fix(openid-connect): ensure identity headers reflect validated tokens (#13330) by Shreemaan Abhishek · 5 weeks ago
  90. 3a7f33a chore: update github labels (#13337) by Shreemaan Abhishek · 5 weeks ago
  91. 888ed6e feat(elasticsearch-logger): support dynamic index with time and variable resolution (#13334) by Nic · 5 weeks ago
  92. c808156 fix(tracer): prevent stale ctx.tracing crash on HTTPS keepalive connections (#13232) by Mohammad Izzraff Janius · 5 weeks ago
  93. 03a43df fix(admin): require admin key for schema validate endpoint (#13328) by Shreemaan Abhishek · 5 weeks ago
  94. 1dbf696 fix: rebuild stream router when services change (#13318) by Shreemaan Abhishek · 5 weeks ago
  95. e32ed3e test(ci): fix flaky tests (#13332) by Shreemaan Abhishek · 5 weeks ago
  96. 3586b2f fix(opentelemetry): preserve booleans, handle multi-value headers, tighten test (#13315) by Shreemaan Abhishek · 5 weeks ago
  97. adf0c7b feat(ai-proxy): rewrite Anthropic-to-OpenAI converter with whitelist body construction (#13321) by Nic · 5 weeks ago
  98. 90a3ad5 feat(ai-proxy): add passthrough protocol for unrecognized API formats (#13320) by Shreemaan Abhishek · 5 weeks ago
  99. bc5a74f docs: update attach-consumer-label plugin documentation (#13301) by Yilia Lin · 5 weeks ago
  100. 17b9b56 fix(ai-proxy): populate $upstream_response_length for cosocket transport (#13323) by Nic · 6 weeks ago