)]}'
{
  "log": [
    {
      "commit": "92c2197b1ab9451e0f0cf9a96e7534d908c7ba75",
      "tree": "65f97bd4549e481113731bcda2b663dd9a19ce59",
      "parents": [
        "ea4f1770676522e0f36ffd14b3c35ae9af0c212f"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Thu Jul 23 00:08:14 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 15:08:14 2026 +0800"
      },
      "message": "websocket sync handshakes (#6386)\n\n* Require trusted bootstrap nodes for websocket sync\n\nWebSocket sync currently exposes the full bootstrap data stream after an anonymous upgrade, including APP_AUTH records needed by gateway bootstrap. This change keeps the sync payload shape intact and moves the trust decision to the handshake by requiring a shared sync token from bootstrap clients.\n\nAdmin validates the X-Shenyu-Sync-Token header before copying session attributes into the endpoint context. Bootstrap clients read the same token from shenyu.sync.websocket.token and send it with each WebSocket connection. The token is masked from WebsocketConfig.toString() so operational logging does not reveal the secret.\n\nConstraint: APP_AUTH.appSecret must remain in sync payloads because bootstrap sign-plugin behavior depends on it\n\nRejected: Remove appSecret from APP_AUTH sync data | breaks bootstrap consumers that need the secret to verify signed requests\n\nRejected: Require admin-user JWT on websocket upgrade | couples bootstrap nodes to user login/session token lifecycle\n\nConfidence: high\n\nScope-risk: moderate\n\nDirective: Do not remove /websocket from the Shiro whitelist unless bootstrap has a non-user auth path through that filter\n\nTested: ./mvnw -pl shenyu-admin,shenyu-sync-data-center/shenyu-sync-data-websocket -am -DfailIfNoTests\u003dfalse -Dskip.checkstyle\u003dtrue -DskipLicense\u003dtrue -Dspotless.check.skip\u003dtrue -Djacoco.skip\u003dtrue -Dtest\u003dWebsocketConfiguratorTest,WebsocketSyncPropertiesTest,WebsocketConfigTest test\n\nTested: ./mvnw -pl shenyu-admin,shenyu-sync-data-center/shenyu-sync-data-websocket -am -DskipTests -DfailIfNoTests\u003dfalse -DskipLicense\u003dtrue -Dspotless.check.skip\u003dtrue -Djacoco.skip\u003dtrue package\n\nTested: git diff --check\n\nNot-tested: End-to-end admin/bootstrap websocket connection with a live shared token\n\n* Keep websocket sync auth usable in test runtimes\n\nWebsocket endpoint configurators can be created by the JSR-356 container outside Spring autowiring, so handshake auth now resolves sync properties through the same SpringBeanUtils fallback already used by origin checks. The test and e2e runtimes also configure the same sync token on both admin and bootstrap sides so the new mandatory handshake token does not break CI scenarios.\n\nConstraint: WebSocket handshake configurator instances are not guaranteed to be Spring-autowired.\n\nConstraint: The token is mandatory when websocket sync is enabled, so test runtimes must configure both admin and bootstrap.\n\nRejected: Make admin accept blank tokens in test runtimes | would weaken the security behavior being added by the PR.\n\nConfidence: high\n\nScope-risk: moderate\n\nDirective: Keep admin and bootstrap websocket sync token values paired in compose, k8s, and local integration-test resources.\n\nTested: ./mvnw -pl shenyu-admin,shenyu-sync-data-center/shenyu-sync-data-websocket -am -DfailIfNoTests\u003dfalse -Dskip.checkstyle\u003dtrue -DskipLicense\u003dtrue -Dspotless.check.skip\u003dtrue -Djacoco.skip\u003dtrue -Dtest\u003dWebsocketConfiguratorTest,WebsocketConfigTest test\n\nTested: ../mvnw -pl shenyu-integrated-test-sdk-http -am -DskipTests -DfailIfNoTests\u003dfalse -Dskip.checkstyle\u003dtrue -DskipLicense\u003dtrue -Dspotless.check.skip\u003dtrue -Djacoco.skip\u003dtrue package (from shenyu-integrated-test/)\n\nTested: docker compose config for shenyu-integrated-test-sdk-http and shenyu-sync-websocket compose files\n\nTested: ruby YAML parse for representative e2e k8s config files\n\nTested: git diff --check\n\nNot-tested: Full Docker e2e/IT containers locally\n\n---------\n\nCo-authored-by: xiaoyu \u003cxiaoyu@apache.org\u003e\nCo-authored-by: moremind \u003chefengen@apache.org\u003e"
    },
    {
      "commit": "ea4f1770676522e0f36ffd14b3c35ae9af0c212f",
      "tree": "ddb1a94e5f8bbbb09e0ae0fea595c93575f4c3ff",
      "parents": [
        "659da659efd93a8aeead627f3efc6d9668d3a396"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Thu Jul 23 10:48:21 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 10:48:21 2026 +0800"
      },
      "message": "fix:P2C LoadBalancer responseTrigger calculates wrong (#6428)\n\nCo-authored-by: Liming Deng \u003climing.d.pro@gmail.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "659da659efd93a8aeead627f3efc6d9668d3a396",
      "tree": "972f930e32354edba152eac9f9d34caa381bf5b1",
      "parents": [
        "924f06169cab7bb9c151d68e3079552886b6f78d"
      ],
      "author": {
        "name": "Honglei",
        "email": "jhonglei@gmail.com",
        "time": "Thu Jul 23 10:09:07 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 10:09:07 2026 +0800"
      },
      "message": "fix(admin): migrate dashboard passwords to bcrypt (#6380)\n\n* fix(admin): migrate dashboard passwords to bcrypt\n\n* fix(admin): address password hashing review feedback\n\n* fix(admin): align bcrypt encoder strength\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "924f06169cab7bb9c151d68e3079552886b6f78d",
      "tree": "d57cd72e6d598bf118dbf6f2b46e6a7e77190471",
      "parents": [
        "5f9f4b307f534d5defcf5a535f1333a02647a450"
      ],
      "author": {
        "name": "Duansg",
        "email": "siguoduan@gmail.com",
        "time": "Thu Jul 23 09:00:39 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 09:00:39 2026 +0800"
      },
      "message": "infra(ci): skip redundant disk cleanup in path-filter-only jobs (#6437)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "5f9f4b307f534d5defcf5a535f1333a02647a450",
      "tree": "02f4f2b42c0967d33290690f89dea05616fe1012",
      "parents": [
        "a1b6ae3290cec2b30a0c2c1accbbe4f1073bc8fb"
      ],
      "author": {
        "name": "BobSong",
        "email": "ivizeridapi24@gmail.com",
        "time": "Thu Jul 23 08:28:24 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 08:28:24 2026 +0800"
      },
      "message": "docs admin : document websocket network isolation. (#6419)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "a1b6ae3290cec2b30a0c2c1accbbe4f1073bc8fb",
      "tree": "d499c66d3473100c760c5f8b750c4a027c6d1748",
      "parents": [
        "96a4c946e64eb1df320d4e96b41481966c56e9c3"
      ],
      "author": {
        "name": "kanlon",
        "email": "Canlong2015@126.com",
        "time": "Thu Jul 23 07:27:37 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 07:27:37 2026 +0800"
      },
      "message": "fix: updateSk not publish event (#6434)\n\nEnhance updateAppSecretByAppKey to publish event on success.\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "96a4c946e64eb1df320d4e96b41481966c56e9c3",
      "tree": "c855402a17c350c6ee94447c34ea7581e6521d18",
      "parents": [
        "292b73b251ebc8c8afaa3c9474c0eb4e7be6e6db"
      ],
      "author": {
        "name": "lll-peanut",
        "email": "peanut_l@qq.com",
        "time": "Tue Jul 21 09:09:30 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 09:09:30 2026 +0800"
      },
      "message": "fix: update examples to consume independent shenyu-client-java artifacts (#6371) (#6424)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "292b73b251ebc8c8afaa3c9474c0eb4e7be6e6db",
      "tree": "74587964e6d19468b133b2e9376156b0546358ad",
      "parents": [
        "8a18ecab49ba7b733706108288e815f8436ad68e"
      ],
      "author": {
        "name": "Duansg",
        "email": "siguoduan@gmail.com",
        "time": "Tue Jul 21 08:37:36 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 08:37:36 2026 +0800"
      },
      "message": "infra(ci): use maven wrapper instead of mvnd on Windows to avoid daemon crash (#6436)"
    },
    {
      "commit": "8a18ecab49ba7b733706108288e815f8436ad68e",
      "tree": "690657792b6c5c13e88fd0b7ce5ddbeea2a30853",
      "parents": [
        "5926970c22ccf72e96d37c9196dd76141ffaf9ff"
      ],
      "author": {
        "name": "Duansg",
        "email": "siguoduan@gmail.com",
        "time": "Mon Jul 20 21:34:57 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 21:34:57 2026 +0800"
      },
      "message": "infra(ci): run paths-filter once in a dedicated changes job instead of per matrix runner (#6435)\n\n* infra(ci): run paths-filter once in a dedicated changes job instead of per matrix runner\n\n* infra(ci): run integration tests when workflow definitions change"
    },
    {
      "commit": "5926970c22ccf72e96d37c9196dd76141ffaf9ff",
      "tree": "0ab6d728a05241f81375f98ea2bccb61dacdce0d",
      "parents": [
        "bf909a878334fc0242e77d8580859b3817f54efb"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Thu Jul 16 16:25:40 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 16:25:40 2026 +0800"
      },
      "message": "fix: remove magic num in InstanceCheckSrevice (#6421)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "bf909a878334fc0242e77d8580859b3817f54efb",
      "tree": "39f7471e7a943f685745ec3d2d667cb277d21316",
      "parents": [
        "2974ec34a5a1e89883eeb5212ce48bea667ffe80"
      ],
      "author": {
        "name": "wy471x",
        "email": "wy471x@gmail.com",
        "time": "Thu Jul 16 15:43:03 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 15:43:03 2026 +0800"
      },
      "message": "chore: add security model document. (#6431)\n\n* chore: add security model document.\n\n* chore: update the security document and add a link to the specified security model document.\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "2974ec34a5a1e89883eeb5212ce48bea667ffe80",
      "tree": "60d9a44e4859e29a4b64caa6e171eb6a0cd038d3",
      "parents": [
        "79885c1bbbd8a0625e0fcffe251f7675d1cd2e0b"
      ],
      "author": {
        "name": "Duansg",
        "email": "siguoduan@gmail.com",
        "time": "Thu Jul 16 15:08:17 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 15:08:17 2026 +0800"
      },
      "message": "infra(ci): add concurrency to cancel superseded CI/test runs (#6432)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "79885c1bbbd8a0625e0fcffe251f7675d1cd2e0b",
      "tree": "da2af1624be9ec10ad9490c7d4e55f53c21fca24",
      "parents": [
        "b94a6997b697f7272fdf18cf7c9b080195e3fc75"
      ],
      "author": {
        "name": "Duansg",
        "email": "siguoduan@gmail.com",
        "time": "Thu Jul 16 14:30:02 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 14:30:02 2026 +0800"
      },
      "message": "infra(ci): remove sofa related workflow after sofa support removed (#6430)"
    },
    {
      "commit": "b94a6997b697f7272fdf18cf7c9b080195e3fc75",
      "tree": "eabdb3d6309bf144ea9057e2b9acefe035512ed6",
      "parents": [
        "d39e623b57677160d3b38a144a566a2ad798162b"
      ],
      "author": {
        "name": "Duansg",
        "email": "siguoduan@gmail.com",
        "time": "Wed Jul 15 16:30:20 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 15 16:30:20 2026 +0800"
      },
      "message": "fix: pin docker actions to approved commit SHA for ASF Actions policy (#6423)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "d39e623b57677160d3b38a144a566a2ad798162b",
      "tree": "cc428e04f2f3189f245647fba4aa360c923eb432",
      "parents": [
        "492bf473854b21f846c65b34719ecd31a1369f78"
      ],
      "author": {
        "name": "wy471x",
        "email": "wy471x@gmail.com",
        "time": "Wed Jul 15 15:36:09 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 15 15:36:09 2026 +0800"
      },
      "message": "feat(client):add many path register for spring mvc client. (#6348)\n\n* feat(client):add many path register for spring mvc client.\n\n* feat(client):improve code coverage for SpringMvcClientEventListener.\n\n* feat(client):add many path register for spring mvc client.\n\n* feat(client):add integrated test cases for SpringMvcClientEventListener.\n\n* feat(client):add integrated test cases for SpringMvcClientEventListener.\n\n* feat(client):add multipath register test controller.\n\n* fix: generate API docs for all super-paths on multi-path controllers\n\nPreviously buildApiDocDTO called buildApiSuperPath (singular), so only the\nfirst class-level prefix was used in generated API docs. Now iterates over\nbuildApiSuperPaths to produce ApiDocRegisterDTO for every prefix. Also fixes\na potential NPE in buildApiPath when a method annotation has an empty path\narray.\n\nCo-Authored-By: Claude Opus 4.7 \u003cnoreply@anthropic.com\u003e\n\n* fix: remove fragile endsWith heuristic from buildApiPath\n\nReplace the superPath.endsWith(formatPath(p)) deduplication check with\nexplicit annotation-provenance routing in handleMethod. When the method\nhas its own @ShenyuSpringMvcClient, the annotation path is used directly.\nWhen falling back to the class-level annotation, @RequestMapping path is\nused instead — avoiding both path duplication and false-positive suffix\nmatches. Also adds buildApiPathFromRequestMapping for the fallback path\nand 5 new unit tests covering buildApiPath edge cases.\n\nCo-Authored-By: Claude Opus 4.7 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e\nCo-authored-by: Claude Opus 4.7 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "492bf473854b21f846c65b34719ecd31a1369f78",
      "tree": "6a1f3acc3b92c6ebcadb416376a8d116b1cdf4ef",
      "parents": [
        "bc4f20dcbda70c0589e4121b4019d1d3bd848570"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Mon Jul 13 01:58:33 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 01:58:33 2026 -0700"
      },
      "message": "2.7.1 release (#6420)\n\n* [maven-release-plugin] prepare release y\n\n* [maven-release-plugin] prepare for next development iteration\n\n* [maven-release-plugin] prepare release v2.7.1\n\n* [maven-release-plugin] prepare for next development iteration\n\n* [maven-release-plugin] prepare release v2.7.1\n\n* [maven-release-plugin] prepare for next development iteration\n\n* fix: sync integrated-test and examples version to 2.7.2-SNAPSHOT\n\nThe shenyu-integrated-test and shenyu-examples modules were not included\nin the root pom\u0027s \u003cmodules\u003e, causing maven-release-plugin to skip version\nrewriting for these modules during release:prepare.\n\nThis left them at 2.7.1-SNAPSHOT while the root pom moved to 2.7.2-SNAPSHOT,\ncausing CI failures on release tags due to non-resolvable parent POM.\n\nBatch update all 58 pom files from 2.7.1-SNAPSHOT to 2.7.2-SNAPSHOT.\n\nCo-Authored-By: Claude \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "bc4f20dcbda70c0589e4121b4019d1d3bd848570",
      "tree": "c68c89de815e2cf6050bd35c0373b7082278975e",
      "parents": [
        "281bc61d80aeb73e32e16e84681314af2204646d"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Wed Jul 08 08:59:20 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 08:59:20 2026 +0800"
      },
      "message": "fix: Update LICENSE files to include additional dependencies and their licenses (#6418)"
    },
    {
      "commit": "281bc61d80aeb73e32e16e84681314af2204646d",
      "tree": "935bace8f23de1443ede3afdf84e589740066c6e",
      "parents": [
        "33e30336b4f03e27958289b1a417d4e8d413345b"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Tue Jul 07 19:17:58 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 19:17:58 2026 +0800"
      },
      "message": "fix: Remove appSecret from sandbox-beforesign response header[#6402] (#6417)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "33e30336b4f03e27958289b1a417d4e8d413345b",
      "tree": "b522058a3f2af5a3a5e4ab4dee8ee4926ff8606a",
      "parents": [
        "f158c08c09992554b2912f9978cb35c3096caf89"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Tue Jul 07 18:21:44 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 18:21:44 2026 +0800"
      },
      "message": "fix: use come.google.re2j replace java.util.regex in RegexPredicateJu… (#6410)\n\n* fix: use come.google.re2j replace java.util.regex in RegexPredicateJudge.java and add URIConditionValidation in SelectorService\n\n* fix: fix liscense"
    },
    {
      "commit": "f158c08c09992554b2912f9978cb35c3096caf89",
      "tree": "f16f05170b4c6e30e3e67ed127f35f21cb1c8b1c",
      "parents": [
        "9181fb155ebd721b875b77f9840b5ad281d42a99"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Jul 07 11:46:27 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 11:46:27 2026 +0800"
      },
      "message": "Require permission for namespace plugin sync (#6384)\n\n* goalx: snapshot before shenyu-analysis\n\n* chore(ci): optimize workflow build cache and mvnd parallelism\n\n* Require authorization for plugin data sync\n\nThe namespace plugin sync endpoint can publish uploaded plugin JAR data to connected gateway nodes, so it needs the same plugin modify permission already required by the bulk sync path. This adds the missing method-level Shiro permission and locks the contract with a focused controller regression test.\n\nConstraint: Existing Shiro method authorization depends on @RequiresPermissions annotations.\n\nRejected: Add a new permission name | existing syncPluginAll already uses system:plugin:modify for the same operation family.\n\nConfidence: high\n\nScope-risk: narrow\n\nDirective: Keep single-plugin and bulk plugin sync endpoints on equivalent plugin sync permissions.\n\nTested: ./mvnw -pl shenyu-admin -Dskip.checkstyle\u003dtrue -DskipLicense\u003dtrue -Dspotless.check.skip\u003dtrue -Djacoco.skip\u003dtrue -Dtest\u003dNamespacePluginControllerTest test -q\n\nTested: ./mvnw -pl shenyu-admin -Dskip.checkstyle\u003dtrue -DskipLicense\u003dtrue -Dspotless.check.skip\u003dtrue -Djacoco.skip\u003dtrue -Dtest\u003dNamespacePluginControllerTest,DataPermissionControllerTest,SelectorControllerTest test -q\n\nTested: ./mvnw -pl shenyu-admin -Dskip.checkstyle\u003dtrue -DskipLicense\u003dtrue -Dspotless.check.skip\u003dtrue -Djacoco.skip\u003dtrue test -q\n\nTested: ./mvnw -pl shenyu-admin -DskipTests -Djacoco.skip\u003dtrue verify -q\n\nNot-tested: End-to-end admin login and WebSocket sync against a running bootstrap."
    },
    {
      "commit": "9181fb155ebd721b875b77f9840b5ad281d42a99",
      "tree": "cf17839f6a1a019978c4d63a60ad30a95d8244a9",
      "parents": [
        "4e539dda59d7388d972f9309544fe4ddd8cef750"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Jul 07 10:27:26 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 10:27:26 2026 +0800"
      },
      "message": "[fix] Add missing permission annotations to /appAuth/updateSk and /sandbox/proxyGateway (#6388)\n\n* goalx: snapshot before shenyu-analysis\n\n* chore(ci): optimize workflow build cache and mvnd parallelism\n\n* chore: update LICENSE with new dependencies and versions\n\n* [fix] Add missing permission annotations to /appAuth/updateSk and /sandbox/proxyGateway\n\n- Add @RequiresPermissions(\"system:authen:edit\") to AppAuthController.updateSk()\n  This endpoint was the only one in the controller without a permission check,\n  allowing any authenticated user to rotate arbitrary appAuth secrets.\n- Change /appAuth/updateSk from GET to POST to prevent appSecret from\n  appearing in URLs, browser history, and server access logs.\n- Add @RequiresPermissions(\"system:authen:list\") to SandboxController.proxyGateway()\n  This endpoint generates server-side signed requests using stored appSecrets.\n  Without permission checks, any authenticated user could abuse it to forge\n  signed requests after compromising an appKey via the updateSk vulnerability.\n\nThese fixes address an authorization bypass where a low-privileged dashboard\nuser could chain updateSk + proxyGateway to impersonate arbitrary application\nidentities and send authenticated requests to allowlisted internal services.\n\nCo-Authored-By: Claude \u003cnoreply@anthropic.com\u003e\n\n* [fix] Address PR review: use request body for updateSk, fix sandbox permission, revert unrelated LICENSE changes\n\n- Change /appAuth/updateSk to accept UpdateSkDTO as @RequestBody instead\n  of @RequestParam, preventing appSecret from appearing in URLs, browser\n  history, and server access logs (Copilot review comment #1)\n- Change /sandbox/proxyGateway permission from system:authen:list to\n  system:authen:modify — a write/signing endpoint should not be guarded\n  by a read permission (Copilot review comment #3)\n- Revert unrelated LICENSE file changes that were accidentally included\n  (Copilot review comment #2 — re2j license issue is pre-existing)\n\nCo-Authored-By: Claude \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e\nCo-authored-by: xiaoyu \u003cxiaoyu@apache.org\u003e"
    },
    {
      "commit": "4e539dda59d7388d972f9309544fe4ddd8cef750",
      "tree": "e3c79a9f4bcc5d3f3363dac51f1596b844fea53e",
      "parents": [
        "74644fbf1a5873810fd5e4377f7690ca8a520c76"
      ],
      "author": {
        "name": "exyb",
        "email": "bobokaixin@gmail.com",
        "time": "Mon Jul 06 17:52:15 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 17:52:15 2026 +0800"
      },
      "message": "fix: add mounts for external libraries in docker-compose to prevent startup issues (missing database connector driver) when using an external database datasource other than H2 (#6389) (#6391)\n\nCo-authored-by: yuanbo7 \u003cyuanbo7@asiainfo.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "74644fbf1a5873810fd5e4377f7690ca8a520c76",
      "tree": "8a453ff48db93a72d19fcf5e4def98873969634c",
      "parents": [
        "d409a0429a9657b55474dd91014af7e989d04858"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Mon Jul 06 15:38:56 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 15:38:56 2026 +0800"
      },
      "message": "fix: Add decompression size limits to ZipUtil.unzip()[#6400] (#6416)\n\n* fix: Add decompression size limits to ZipUtil.unzip()[#6400]\n\n* fix: fix checkStyle\n\n* fix: fix test\n\n* fix: remove magic num in ConfigServiceTest.java\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "d409a0429a9657b55474dd91014af7e989d04858",
      "tree": "418357b85fa62c3a9613ac650fbc4914c221430c",
      "parents": [
        "9e7d5ffcf8357d1dce94f302e21cc007615c756e"
      ],
      "author": {
        "name": "SouthwestAsiaFloat",
        "email": "2034946972@qq.com",
        "time": "Sun Jul 05 22:51:13 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Jul 05 22:51:13 2026 +0800"
      },
      "message": "fix(admin): limit swagger import response body size (#6411)\n\n* fix(admin): limit swagger import response body size\n\n* fix:change to ShenyuAdminResult\n\n---------\n\nCo-authored-by: 西南亚瓢 \u003cxinanyapiao@xinanyapiaodeMacBook-Air.local\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "9e7d5ffcf8357d1dce94f302e21cc007615c756e",
      "tree": "99e073948472ebfbbdcfa8bb9370bc67fe84d635",
      "parents": [
        "d4db5e60d27c7ba35d583e10068e0f77deac2ed4"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Sun Jul 05 20:03:17 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Jul 05 20:03:17 2026 +0800"
      },
      "message": "fix: Enforce account enabled check on every authenticated request in ShiroRealm [#6399] (#6415)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "d4db5e60d27c7ba35d583e10068e0f77deac2ed4",
      "tree": "d1cd5535299ed6fc986898360f748219b887d3db",
      "parents": [
        "6e79c7b7c3f62163d82a7775593de49f95dae754"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Sun Jul 05 16:53:52 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Jul 05 16:53:52 2026 +0800"
      },
      "message": "fix: DividePlugin specify-domain header to prevent cache pollution and restrict to configured upstreams (#6412)"
    },
    {
      "commit": "6e79c7b7c3f62163d82a7775593de49f95dae754",
      "tree": "9f5f8079835c485deeb38a8dc6ae5d2cce576c21",
      "parents": [
        "6c3110fd1741c641703af388403cec9fdb3fb820"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Wed Jun 24 22:47:13 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 24 22:47:13 2026 +0800"
      },
      "message": "fix:fix local springmvc client cant register success (#6395)"
    },
    {
      "commit": "6c3110fd1741c641703af388403cec9fdb3fb820",
      "tree": "c434bf42366218e4cae8d37f29fdb411473d7505",
      "parents": [
        "470aefed12379970bcca16cf9c5571d0a3c8bc9b"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Jun 16 18:14:47 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 16 18:14:47 2026 +0800"
      },
      "message": "Prerelease/fix license (#6387)\n\n* goalx: snapshot before shenyu-analysis\n\n* chore(ci): optimize workflow build cache and mvnd parallelism\n\n* chore: update LICENSE with new dependencies and versions\n\n* fix: address license review feedback — standardize labels, fix URLs, remove stale versions\n\n- Standardize license labels to \u0027Apache 2.0\u0027 (was mixed with \u0027The Apache\n  License, Version 2.0\u0027, \u0027Apache License Version 2.0\u0027, etc.)\n- Fix project URLs: replace license-text URLs with actual project URLs\n  for itu, dubbo-dependencies-zookeeper, log4j-1.2-api, zookeeper\n- Fix lz4-java 1.10.1 URL: yawkat/lz4-java → canonical lz4/lz4-java\n- Fix bcprov-jdk18on 1.84 URL: bouncycastle download page → bcgit/bc-java\n- Remove stale oshi-core 6.10.0 entries (only 6.7.0 is shipped)\n- Move re2j 1.8 from Apache section to BSD 3-Clause section\n- Add re2j 1.8, wasmtime entries, jni-rs entry (missed in prior commit)\n\nCo-Authored-By: Claude \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "470aefed12379970bcca16cf9c5571d0a3c8bc9b",
      "tree": "dee838e01d34e3b9139cda58a4df1ba8e153b4ab",
      "parents": [
        "6d3605af9c3f8805f7ae08b048fe812b84fab5ea"
      ],
      "author": {
        "name": "eye-gu",
        "email": "734164350@qq.com",
        "time": "Tue Jun 16 15:12:13 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 16 15:12:13 2026 +0800"
      },
      "message": "[type:refactor] replace inactive wasmtime-java with chicory pure-Java WASM runtime (#6356)\n\n* [type:refactor] replace inactive wasmtime-java with chicory pure-Java WASM runtime\n\n* fix header\n\n* fix review\n\n* fix review\n\n* ci: trigger CI re-run\n\n* fix review\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "6d3605af9c3f8805f7ae08b048fe812b84fab5ea",
      "tree": "a9f84e022348004646a08221d33b5aa3c71faf95",
      "parents": [
        "e1530777cd108d809a638e9ae9c6e0d8683d14f6"
      ],
      "author": {
        "name": "eye-gu",
        "email": "734164350@qq.com",
        "time": "Tue Jun 16 10:34:04 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 16 10:34:04 2026 +0800"
      },
      "message": "fix(ci): remove maven cache save to avoid incomplete cache pollution (#6383)\n\n* fix(ci): remove maven cache save to avoid incomplete cache pollution\n\n* add websocket health check"
    },
    {
      "commit": "e1530777cd108d809a638e9ae9c6e0d8683d14f6",
      "tree": "90f1a97e6f0bc8205c59a08c245254e34c44a5cd",
      "parents": [
        "3be50376da5904f6c9195cf7670285a4bb019065"
      ],
      "author": {
        "name": "zongmingzhi",
        "email": "95121549+zongmingzhi@users.noreply.github.com",
        "time": "Sun Jun 14 17:37:05 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Jun 14 17:37:05 2026 +0800"
      },
      "message": "fix: skip request body for GET and HEAD requests (#6350)\n\nGET and HEAD requests should not forward a request body through the HTTP client plugins. Sending a body can cause Reactor Netty or WebClient to emit unexpected transfer encoding headers, which may break compatibility with upstream servers.\n\nAdd shared request-body eligibility logic in AbstractHttpClientPlugin and reuse it from both NettyHttpClientPlugin and WebClientPlugin.\n\nCo-authored-by: 宗杰 \u003c1491040549@qq.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "3be50376da5904f6c9195cf7670285a4bb019065",
      "tree": "7fd2d77186656efb92db8b6fd22cbbabe71515f0",
      "parents": [
        "ca83c6974d69e96c63f5a1d42272e9dcc738fd2b"
      ],
      "author": {
        "name": "SouthwestAsiaFloat",
        "email": "2034946972@qq.com",
        "time": "Fri Jun 12 23:25:26 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 12 23:25:26 2026 +0800"
      },
      "message": "fix(request): make add operations append existing values (#6375)\n\nCo-authored-by: 西南亚瓢 \u003cxinanyapiao@xinanyapiaodeMacBook-Air.local\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "ca83c6974d69e96c63f5a1d42272e9dcc738fd2b",
      "tree": "ca7e744462984c8fc0b0ed7558b80585203b864b",
      "parents": [
        "75a23bbd31c2af02102cdd9d85f685244c22dad5"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Fri Jun 12 14:53:29 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 12 14:53:29 2026 +0800"
      },
      "message": "Fix RocketMQ logging e2e bootstrap startup (#6379)\n\n* feat(api-doc): support request parameter parsing for RPC types (Dubbo/SOFA/TARS/gRPC)\n\n* fix license\n\n* fix checkstyle exclude generated source\n\n* fix checkstyle\n\n* fix review\n\n* Fix Protobuf field schema parsing logic\n\n* fix use common version\n\n* chore: trigger CI retest\n\n* Recover RocketMQ e2e bootstrap after delayed admin health\n\nThe RocketMQ logging e2e script runs three sync modes in sequence. In the zookeeper round, Docker Compose can return before shenyu-admin has recovered from an initial unhealthy state, leaving shenyu-bootstrap created but not started. The script previously ignored both that compose failure and later healthcheck failures, so Maven reported the gateway as unavailable instead of recovering the service stack first.\n\nConstraint: CI builds the required latest Docker images before this script runs\n\nRejected: Increase fixed sleeps only | it would hide the dependency failure without ensuring bootstrap starts\n\nConfidence: medium\n\nScope-risk: narrow\n\nDirective: Keep bootstrap startup gated on admin health for this e2e script\n\nTested: bash -n e2e-logging-rocketmq-compose.sh; e2e RocketMQ test-compile; RocketMQ logging plugin test-compile; docker compose config for zookeeper, RocketMQ, and HTTP example compose files; git diff --check\n\nNot-tested: Full Docker Compose e2e locally because CI-built apache/shenyu-admin:latest, apache/shenyu-bootstrap:latest, and shenyu-examples-http:latest images are not present\n\n---------\n\nCo-authored-by: eye-gu \u003c734164350@qq.com\u003e"
    },
    {
      "commit": "75a23bbd31c2af02102cdd9d85f685244c22dad5",
      "tree": "2fea7f5997467daceef01e57f9df62d12a01fdae",
      "parents": [
        "1ecc77c5117987d7bf775802e9dfb4586374fd6b"
      ],
      "author": {
        "name": "hqbhonker",
        "email": "hqbhonker@outlook.com",
        "time": "Thu Jun 11 10:46:30 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 11 10:46:30 2026 +0800"
      },
      "message": "fix(netty): support configurable httpRequestDecoder properties (#6378)\n\nAdd HTTP request decoder configuration support including:\n- maxInitialLineLength (default 4096)\n- maxHeaderSize (default 8192)\n- maxChunkSize (default 8192)\n\nUsers can now configure these properties via application.yml:\n  shenyu.netty.http.httpDecoder.maxInitialLineLength\u003d8192\n\nThis resolves the issue where HTTP requests with URLs exceeding\n4096 bytes are rejected by the gateway.\n\nCloses #5856\n\nCo-authored-by: ColinMark \u003cpagedev@163.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "1ecc77c5117987d7bf775802e9dfb4586374fd6b",
      "tree": "76566205a838a54d5852539205e08acc43c43a19",
      "parents": [
        "d17b29d42da729e1e5a8691c3fa19739b30811fb"
      ],
      "author": {
        "name": "hengyuss",
        "email": "81064732+hengyuss@users.noreply.github.com",
        "time": "Thu Jun 11 10:12:23 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 11 10:12:23 2026 +0800"
      },
      "message": "[ISSUE 6334] : Add uri validation for regex and other operators. (#6335)\n\n* fix admin : add uri validation for regex and other operators.\n\n* fix admin : fix url condition and add test\n\n* fix: add com.google.re2j dependency to resolve regex redos\n\n* fix: fix UriConditionValidateorTest\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e\nCo-authored-by: moremind \u003chefengen@apache.org\u003e"
    },
    {
      "commit": "d17b29d42da729e1e5a8691c3fa19739b30811fb",
      "tree": "8541c4829d79a0dc6b52681164ba8ab9f88ae155",
      "parents": [
        "0b16b58eb4bb1bbfd5e1182468f3fc87538d1c98"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Wed Jun 10 21:31:38 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 10 21:31:38 2026 +0800"
      },
      "message": "Stabilize Sentinel CI assertion for PR 6375 (#6377)\n\nThe failed Actions job showed both concurrent Sentinel requests returning pass, which made the test depend on a two-request race landing inside an initialized rate-limit window. The test now sends a small bounded burst and retries briefly until it observes both the allowed response and the expected Sentinel rejection or fallback response.\n\nConstraint: GitHub Actions job 80239368085 failed in shenyu-integrated-test-http at SentinelPluginTest.test:76\n\nRejected: Increase the assertion timeout with two requests | still depends on the same first-window race\n\nRejected: Change Sentinel production configuration | failure is a test timing assumption, not a production behavior regression\n\nConfidence: high\n\nScope-risk: narrow\n\nDirective: Keep this test asserting both pass and limited responses, but avoid exact request-count assumptions around Sentinel windows\n\nTested: ./mvnw -f ./shenyu-integrated-test/pom.xml -pl shenyu-integrated-test-http -am -Pit -DskipTests test-compile\n\nTested: ./mvnw -pl shenyu-plugin/shenyu-plugin-request -Dtest\u003dorg.apache.shenyu.plugin.request.RequestPluginTest test\n\nTested: git diff --check\n\nNot-tested: Full Docker Compose shenyu-integrated-test-http run; local machine lacks most required CI service images"
    },
    {
      "commit": "0b16b58eb4bb1bbfd5e1182468f3fc87538d1c98",
      "tree": "9c35c1dc3ed4b298e4f9034257ace21e6cd38d0d",
      "parents": [
        "86e544b074b010eb787e1e062a4d7048461b10f3"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Jun 09 12:08:54 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 09 12:08:54 2026 +0800"
      },
      "message": "Stabilize HTTP E2E compose startup readiness (#6363)\n\n* Stabilize HTTP E2E compose startup readiness\n\nThe HTTP compose E2E job could continue after docker compose returned from a transient dependency-health failure, leaving shenyu-bootstrap unavailable and surfacing the problem later as gateway test failures. The startup script now performs explicit admin and bootstrap readiness checks, restarts bootstrap after admin is confirmed, and prints focused compose logs on startup or test failure. MySQL healthchecks now verify TCP readiness on the same transport class used by admin JDBC connections.\n\nConstraint: The failing CI log showed shenyu-admin briefly failed JDBC startup even after the MySQL container healthcheck reported healthy.\n\nRejected: Only increasing sleep durations | fixed delays keep the race and make failures slower.\n\nConfidence: medium\n\nScope-risk: narrow\n\nDirective: Keep E2E startup gated on service readiness rather than fixed sleeps.\n\nTested: bash -n on e2e-http-sync-compose.sh and healthcheck.sh; docker compose config for websocket/http/zookeeper sync compose files; git diff --check.\n\nNot-tested: Full local E2E run, because Docker image pulls stayed in pulling state for over six minutes and never reached container startup.\n\n* Remove local progress notes from PR\n\nThe progress file was useful during local work but should not be part of the project diff. Removing it keeps the PR focused on E2E startup readiness changes only.\n\nRejected: Keep progress.md for context | PR reviewers should get context from the PR body and commit history, not workspace-local notes.\n\nConfidence: high\n\nScope-risk: narrow\n\nTested: git status\n\n---------\n\nCo-authored-by: xiaoyu \u003cxiaoyu@apache.org\u003e"
    },
    {
      "commit": "86e544b074b010eb787e1e062a4d7048461b10f3",
      "tree": "2759ab128f775d060810dfee610bfdc87ff877dc",
      "parents": [
        "48120c13668150b9e9b4c9f0786f671451d58ecc"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Jun 09 10:22:28 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 09 10:22:28 2026 +0800"
      },
      "message": "Stabilize Sentinel integrated rate-limit assertions (#6374)\n\nThe HTTP integrated Sentinel tests used back-to-back requests to prove one successful pass and one rate-limited response. On slow CI, sequential requests can cross Sentinel\u0027s one-second QPS window, leaving the expected limited response absent even though the gateway behavior is correct.\n\nThis changes the trigger to concurrent requests and asserts over the observed result set, preserving the same behavior coverage while removing timing dependence from the test.\n\nConstraint: Failure appeared in the master push for #6361 in build (shenyu-integrated-test-http), after Sentinel fallback coverage was added.\n\nRejected: Increase sleeps or timeouts | would make the timing window larger without making the assertion deterministic.\n\nRejected: Change Sentinel production cleanup | the failing surface is the test trigger timing, and production cleanup changes would broaden risk unnecessarily.\n\nConfidence: medium\n\nScope-risk: narrow\n\nDirective: Keep Sentinel rate-limit integration assertions concurrency-based; sequential requests can cross QPS windows on loaded runners.\n\nTested: ./mvnw -f shenyu-integrated-test/pom.xml -pl shenyu-integrated-test-http -am -DskipTests test-compile\n\nTested: git diff --check\n\nNot-tested: Full Docker integrated-test-http run locally; required CI images and supporting services were not prebuilt locally."
    },
    {
      "commit": "48120c13668150b9e9b4c9f0786f671451d58ecc",
      "tree": "6a1fb466dd4d95b81b2782067c07e12e83c149b0",
      "parents": [
        "0e41bcc4e46a561c3a942613b25409a5aa7b2a8d"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Mon Jun 08 16:55:11 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 16:55:11 2026 +0800"
      },
      "message": "Stabilize k8s ingress startup healthchecks (#6361)\n\n* goalx: snapshot before shenyu-analysis\n\n* chore(ci): optimize workflow build cache and mvnd parallelism\n\n* Stabilize integration startup healthchecks\n\nThe grpc ingress CI failure timed out while a healthcheck curl waited on a newly created kind deployment. The workflow now waits for shenyu-ingress deployments to roll out before HTTP probing, bounds each curl attempt, and preserves cluster diagnostics even when startup fails.\n\nThe HTTP integration workflow also exposed a Sentinel fallback flake where a POST request relied on an external redirect fallback and hung until the 180-second client timeout. The Sentinel test now uses internal fallback dispatch, and the example accepted endpoint supports POST for that fallback path.\n\nConstraint: GitHub-hosted kind and docker-compose startup can vary with runner load and JVM boot time\n\nRejected: Only increase the Actions timeout | leaves a hanging curl and no readiness boundary\n\nRejected: Only add diagnostic logging | improves evidence but still allows avoidable flakes\n\nRejected: Keep Sentinel fallback as a client-followed 302 redirect | keeps the flaky non-2xx fallback boundary\n\nConfidence: medium\n\nScope-risk: moderate\n\nDirective: Keep k8s ingress healthchecks bounded and rollout-aware; do not reintroduce unbounded curl startup waits\n\nTested: bash -n for helper and ingress healthcheck scripts\n\nTested: git diff --check\n\nTested: local fake kubectl plus HTTP 200 success path\n\nTested: local fake kubectl plus unreachable service failure path\n\nTested: ./mvnw -f shenyu-examples/shenyu-examples-http/pom.xml -DskipTests -Dmaven.javadoc.skip\u003dtrue compile\n\nTested: ./mvnw -f shenyu-integrated-test/pom.xml -pl shenyu-integrated-test-http -am -DskipTests -Pit -Dmaven.javadoc.skip\u003dtrue test-compile\n\nNot-tested: full GitHub Actions kind matrix run\n\nNot-tested: local docker-compose shenyu-integrated-test-http runtime\n\n* Keep ingress healthchecks compatible with CI kubectl\n\nThe k8s ingress startup helper must run on the kubectl v1.24 binary installed by the workflow. That binary rejects rollout status with deployment --all, so enumerate deployments first and wait on each named resource becoming Available before starting HTTP health probes.\n\nConstraint: CI installs kubectl v1.24.14\n\nRejected: Keep rollout status deployment --all | rejected by the linked PR 6361 CI job with unknown flag: --all\n\nConfidence: high\n\nScope-risk: narrow\n\nDirective: Keep this helper compatible with the kubectl version pinned in integrated-test-k8s-ingress.yml\n\nTested: bash -n for helper and ingress healthcheck scripts\n\nTested: git diff --check for helper\n\nTested: fake kubectl/curl success, failed service, and no-deployment helper paths\n\n* Stop k8s example probes from killing ready services\n\nThe k8s ingress apache-dubbo job reached the new bounded healthcheck path, then failed because the example service nodePort stayed unreachable. The diagnostic dump showed kubelet restarting the Dubbo example after liveness probes hit localhost:8081, while the application, containerPort, and service all use 8011. The SOFA example had the same stale probe port against an application that serves health on 28011, so align both probes with their real server ports.\n\nConstraint: The k8s ingress workflow now waits on deployment availability and then verifies the example NodePort health endpoints\n\nRejected: Increase healthcheck retries only | would leave kubelet repeatedly restarting a healthy app due to the wrong probe port\n\nConfidence: high\n\nScope-risk: narrow\n\nDirective: Keep k8s liveness probe ports aligned with each example application\u0027s server.port and service targetPort\n\nTested: git diff --check for changed manifests\n\nTested: Ruby YAML parser for changed manifests\n\nNot-tested: local kind run; CI job is the available end-to-end validation\n\n* Expose ingress healthcheck node ports in kind\n\nThe apache-dubbo ingress job now reaches healthy pods with zero restarts, but the host healthcheck still curls localhost:31187. In kind, localhost access requires explicit extraPortMappings; only the ingress controller port 30095 was mapped, so service NodePorts such as 31187 were unreachable from the runner even when Kubernetes reported the service and pod ready.\n\nMap each active ingress services.list localhost port through the case kind config. Also align the latent SOFA services.list port with its actual example service NodePort and map it for future activation.\n\nConstraint: GitHub Actions probes services from the host runner via localhost against a kind cluster\n\nRejected: Probe only Kubernetes deployment readiness | misses host-to-kind NodePort reachability that the tests depend on\n\nRejected: Increase curl retries | localhost can never reach unmapped kind NodePorts\n\nConfidence: high\n\nScope-risk: narrow\n\nDirective: Any localhost port added to an ingress services.list must also be present as a kind extraPortMappings hostPort\n\nTested: services.list localhost ports match kind hostPort mappings for http, grpc, websocket, apache-dubbo, and sofa\n\nTested: Ruby YAML parser for changed kind configs and related manifests\n\nTested: git diff --check for changed files\n\nNot-tested: local kind run; CI job is the available end-to-end validation\n\n* Align grpc ingress health probes with app path\n\nAfter NodePort mappings were fixed, apache-dubbo passed and the remaining k8s ingress failure moved to grpc. The grpc example was restarted by liveness because the probe hit /actuator/health while the app serves under the /grpc context path. The host healthcheck also probed NodePort 31184, which maps service port 8080, while the application HTTP server is 55290 exposed as NodePort 31183.\n\nUse the same health endpoint shape as the docker-compose grpc integration check: /grpc/actuator/health on port 55290, exposed to the runner as localhost:31183 in kind.\n\nConstraint: shenyu-examples-grpc sets server.servlet.context-path\u003d/grpc and server.port\u003d55290\n\nRejected: Keep probing 31184 | that NodePort maps port 8080 rather than the app health server\n\nRejected: Increase retries | the liveness path was wrong and caused restarts\n\nConfidence: high\n\nScope-risk: narrow\n\nDirective: Keep grpc k8s health probes consistent with server.servlet.context-path and service NodePort 31183\n\nTested: services.list localhost ports match kind hostPort mappings for all ingress cases\n\nTested: Ruby YAML parser for changed manifests\n\nTested: git diff --check\n\nNot-tested: local kind run; CI job is the available end-to-end validation\n\n* Use stable websocket ingress health endpoint\n\nThe websocket ingress preflight polled a historical HTTP path that is not implemented by the annotation websocket example. CI reached the service but received repeated 404 responses, so the cluster startup step failed before the real websocket test could run.\n\nUse the actuator health endpoint that the same example already exposes for Kubernetes liveness, and give the example a longer initial liveness delay to avoid startup probe restarts observed in CI diagnostics.\n\nConstraint: The preflight check must use an HTTP URL, while the actual integration coverage remains the ws://localhost:30095/myWs test.\n\nRejected: Add a dummy HTTP handler for /new/feature/get/mapping/path | it would preserve a stale health endpoint unrelated to websocket coverage.\n\nConfidence: high\n\nScope-risk: narrow\n\nTested: git diff --check\n\nTested: Ruby YAML parse for websocket Kubernetes manifest\n\nTested: kind hostPort mapping consistency check for ingress service lists\n\nTested: ./mvnw -f shenyu-integrated-test/pom.xml -pl shenyu-integrated-test-k8s-ingress-websocket -am -DskipTests -Pit -Dmaven.javadoc.skip\u003dtrue test-compile\n\nNot-tested: full Kubernetes ingress websocket workflow locally; requires CI kind/docker environment\n\n* Avoid invalid websocket ingress HTTP health probe\n\nThe websocket ingress preflight still failed after moving to the example actuator endpoint because the service is registered in the ingress controller as a websocket upstream. HTTP actuator probes against that path consistently returned 404, while the actual integration test only needs the shenyu ingress controller on port 30095 and then exercises ws://localhost:30095/myWs.\n\nUse the ingress controller\u0027s own actuator health endpoint for websocket preflight, remove the unused host mapping for the example NodePort, and add a startup probe so the example liveness check does not restart the app during slow startup.\n\nConstraint: Websocket ingress health preflight must not depend on an HTTP request flowing through a websocket upstream.\n\nRejected: Keep probing localhost:31188 | CI showed it returns 404 after websocket upstream registration and does not represent the test path.\n\nConfidence: high\n\nScope-risk: narrow\n\nTested: git diff --check\n\nTested: Ruby YAML parse for websocket Kubernetes manifest and kind config\n\nTested: kind hostPort mapping consistency check for ingress service lists\n\nTested: ./mvnw -f shenyu-integrated-test/pom.xml -pl shenyu-integrated-test-k8s-ingress-websocket -am -DskipTests -Pit -Dmaven.javadoc.skip\u003dtrue test-compile\n\nNot-tested: full Kubernetes ingress websocket workflow locally; requires CI kind/docker environment\n\n* Wait for ingress backend deployments before tests\n\nThe websocket ingress healthcheck now avoids probing the websocket upstream with an HTTP health path, which exposed a race where the CI test could start while the default namespace example deployment was still becoming available. In that state the ingress controller can observe empty websocket rule handles and the integration test fails even though gateway health passed. The shared helper now waits for deployments in both shenyu-ingress and default before polling service endpoints.\\n\\nConstraint: Websocket preflight should not restore an invalid HTTP probe through the websocket ingress path.\\nRejected: Restore the localhost:31188 backend HTTP healthcheck | CI already showed that path returns 404 for websocket ingress traffic.\\nConfidence: high\\nScope-risk: moderate\\nDirective: Keep backend readiness checks deployment-based unless each ingress example exposes a protocol-correct HTTP health endpoint.\\nTested: bash -n shenyu-integrated-test/k8s-ingress-healthcheck.sh shenyu-integrated-test/shenyu-integrated-test-k8s-ingress-http/script/healthcheck.sh shenyu-integrated-test/shenyu-integrated-test-k8s-ingress-websocket/script/healthcheck.sh \u0026\u0026 git diff --check\\nTested: fake kubectl/curl helper run confirmed shenyu-ingress and default deployment waits before websocket health polling\\nTested: verified every k8s ingress services.list localhost port has a matching kind hostPort mapping\\nNot-tested: full k8s ingress matrix locally\n\n* Allow optional ingress backend namespaces\n\nThe apache-dubbo ingress example deploys all workloads in shenyu-ingress, so requiring default namespace deployments made the shared readiness helper fail before it could poll the actual health endpoints. The helper now treats shenyu-ingress as required and default as optional, preserving the websocket backend readiness gate without breaking cases that do not use default.\\n\\nConstraint: Ingress examples do not all use the same namespace layout.\\nRejected: Remove default namespace waiting entirely | websocket CI showed a real race when its backend deployment was still starting.\\nConfidence: high\\nScope-risk: narrow\\nDirective: Keep namespace waits aligned with the namespaces each ingress example actually uses.\\nTested: bash -n shenyu-integrated-test/k8s-ingress-healthcheck.sh \u0026\u0026 git diff --check\\nTested: fake kubectl/curl helper run for apache-dubbo skipped empty default namespace and still polled 30095 plus 31187\\nTested: fake kubectl/curl helper run for websocket waited default deployment before polling 30095\\nTested: verified every k8s ingress services.list localhost port has a matching kind hostPort mapping\\nNot-tested: full k8s ingress matrix locally\n\n* Expose websocket example actuator health\n\nThe websocket ingress example deployment probes /actuator/health on port 8001, but the annotation websocket example did not include Spring Boot Actuator. In CI the pod stayed 0/1 Available for ten minutes, restarted after startupProbe failures, and blocked the shared ingress healthcheck. Adding the actuator starter makes the existing Kubernetes startup and liveness probes target a real endpoint.\\n\\nConstraint: The k8s manifest already uses /actuator/health as the readiness signal.\\nRejected: Remove the websocket backend deployment wait | that would hide a real backend startup failure and reintroduce ingress test races.\\nConfidence: high\\nScope-risk: narrow\\nDirective: Keep k8s health probes backed by dependencies in the corresponding example module.\\nTested: ./mvnw -B -f shenyu-examples/pom.xml -pl shenyu-examples-websocket/shenyu-example-spring-annotation-websocket -am -DskipTests -Dmaven.javadoc.skip\u003dtrue package\\nTested: bash -n shenyu-integrated-test/k8s-ingress-healthcheck.sh \u0026\u0026 git diff --check\\nTested: verified every k8s ingress services.list localhost port has a matching kind hostPort mapping\\nNot-tested: full k8s ingress matrix locally\n\n* Refresh websocket ingress upstreams from endpoints\n\nThe endpoint reconciler only looked up divide selectors for services mapped from an ingress. Websocket ingress services therefore had no matching selector ids, which produced addAll(null) NPEs and left the websocket selector handle empty after the backend endpoint became ready. The reconciler now skips missing selector caches and updates both divide and websocket selectors with plugin-appropriate upstream handles.\\n\\nConstraint: Kubernetes endpoint events can arrive after ingress parsing creates selectors with empty upstream handles.\\nRejected: Add sleeps before websocket tests | timing delays would not fix the reconciler NPE or empty selector handle.\\nConfidence: high\\nScope-risk: moderate\\nDirective: Endpoint-driven selector refresh must stay plugin-aware; do not assume divide handles for websocket routes.\\nTested: ./mvnw -B -pl shenyu-kubernetes-controller -DskipITs -DskipTests\u003dfalse -Dmaven.javadoc.skip\u003dtrue test\\nTested: bash -n shenyu-integrated-test/k8s-ingress-healthcheck.sh \u0026\u0026 git diff --check\\nNot-tested: full k8s ingress matrix locally\n\n* Use real sentinel fallback in HTTP integration test\n\nThe HTTP integrated matrix exposed that the sentinel fallback test was using an upstream /http route as a fallback: target. Fallback dispatch is gateway-local, so the test could return a backend 404 instead of proving the sentinel fallback path ran.\n\nThis points the test at the existing /fallback/sentinel controller and asserts the sentinel fallback enum code and message so a plain rate-limit response cannot satisfy the fallback URI case.\n\nConstraint: fallback: URIs are handled by the gateway DispatcherHandler, not as a fresh divide upstream request\n\nRejected: Keep /http/test/request/accepted | CI proved it can resolve as a missing backend static resource\n\nConfidence: high\n\nScope-risk: narrow\n\nTested: ./mvnw -B -f shenyu-integrated-test/pom.xml -pl shenyu-integrated-test-http -am -DskipTests -Dmaven.javadoc.skip\u003dtrue test-compile\n\nTested: git diff --check\n\nNot-tested: Full docker-compose HTTP integrated test locally; CI owns the full runtime environment\n\n* Allow fallback endpoints to preserve request methods\n\nSentinel fallback dispatch preserves the original request method. The HTTP integrated test uses POST, so the gateway-local /fallback/sentinel endpoint returned 405 while the fallback path itself was correct.\n\nThe default fallback endpoints are fallback targets rather than public method-specific APIs, so they now accept any method. A POST regression test covers the sentinel path that failed in CI.\n\nConstraint: FallbackHandler mutates only the URI and keeps the original HTTP method\n\nRejected: Change the sentinel test back to a 429-only assertion | it would not prove fallbackUri dispatch and could mask ordinary rate limiting\n\nConfidence: high\n\nScope-risk: narrow\n\nTested: ./mvnw -B -pl shenyu-web -DskipITs -DskipTests\u003dfalse -Dtest\u003dDefaultFallbackControllerTest -Dmaven.javadoc.skip\u003dtrue test\n\nTested: ./mvnw -B -f shenyu-integrated-test/pom.xml -pl shenyu-integrated-test-http -am -DskipTests -Dmaven.javadoc.skip\u003dtrue test-compile\n\nTested: git diff --check\n\nNot-tested: Full docker-compose HTTP integrated test locally; CI owns the full runtime environment\n\n* Retry docker base image pulls in integration CI\n\nThe integration workflow removes runner image caches to free disk, then docker-maven-plugin pulls Docker Hub base images during a large Maven build. Two consecutive runs failed before tests because alpine:latest and centos:7 timed out from registry-1.docker.io.\n\nPre-pulling the admin/bootstrap base images with retries warms the local Docker cache before Maven starts, reducing transient registry failures without changing the build artifacts.\n\nConstraint: it matrix jobs build docker images from Docker Hub bases after deleting runner caches\n\nRejected: Only rerun the failed workflow | repeated reruns hit the same registry timeout and leave the CI easy to fail\n\nConfidence: medium\n\nScope-risk: narrow\n\nTested: ruby -e \u0027require \"yaml\"; YAML.load_file(\".github/workflows/integrated-test.yml\")\u0027\n\nTested: git diff --check\n\nNot-tested: Full GitHub Actions workflow locally\n\n* Assert sentinel fallback response shape directly\n\nCI proved the sentinel fallback path now returns the intended fallback response, but the integration test deserialized it into ResultBean. That DTO uses msg while the fallback response exposes message, so the behavior was correct but the assertion read the wrong field.\n\nThe test now reads the fallback response as a map and asserts the actual code/message fields emitted by the fallback endpoint.\n\nConstraint: ShenyuResultWrap fallback responses use message, while integrated-test ResultBean uses msg\n\nRejected: Change ResultBean or fallback response shape | broader contract change not needed for this test\n\nConfidence: high\n\nScope-risk: narrow\n\nTested: ./mvnw -B -f shenyu-integrated-test/pom.xml -pl shenyu-integrated-test-http -am -DskipTests -Dmaven.javadoc.skip\u003dtrue test-compile\n\nTested: git diff --check\n\nNot-tested: Full docker-compose HTTP integrated test locally; CI owns the full runtime environment\n\n* Retry transient CI dependency downloads\n\nGitHub Actions runs failed before project code executed when Temurin JDK and k3s binaries returned transient 504/download errors. Add an in-repo setup-java retry wrapper for observed setup-java callers and retry k3s installation in the k8s examples workflow.\n\nConstraint: The failures happened before Maven or integration tests could run, so test-code changes cannot address them.\n\nRejected: Only rerun failed jobs | leaves the same external download point fragile on the next PR run\n\nConfidence: medium\n\nScope-risk: moderate\n\nDirective: Keep workflow download retries close to the failing external install step so real build/test failures remain visible.\n\nTested: Ruby YAML parse for changed workflow/action files; git diff --check\n\nNot-tested: actionlint is not installed locally; full GitHub Actions validation requires PR runs\n\n* Apply Java setup retries across CI workflows\n\nA later e2e job failed at the same pre-test Temurin download point as ci and it. Route the remaining workflow setup-java calls through the shared retry wrapper so transient GitHub release 504s do not fail unrelated test lanes before project code runs.\n\nConstraint: GitHub-hosted runners download some requested JDKs from GitHub releases at job runtime.\n\nRejected: Patch only the failed e2e job | leaves CodeQL, it-k8s, and publish workflows with the same single-attempt setup path\n\nConfidence: medium\n\nScope-risk: moderate\n\nDirective: Keep actions/setup-java@v4 usage centralized in actions/setup-java-with-retry unless a workflow has a documented reason to bypass retries.\n\nTested: Ruby YAML parse for changed workflows and retry action; git diff --check; rg confirms no direct workflow setup-java@v4 uses remain\n\nNot-tested: actionlint is not installed locally; full workflow execution requires GitHub Actions"
    },
    {
      "commit": "0e41bcc4e46a561c3a942613b25409a5aa7b2a8d",
      "tree": "5cda8fe80a3565634dcfa0bf72dde29f99b648d5",
      "parents": [
        "48e48df4ddde91938f4be3d11c91a8f21be8c0cc"
      ],
      "author": {
        "name": "SUPERSAIYAN",
        "email": "1714264078@qq.com",
        "time": "Mon Jun 08 11:09:13 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 11:09:13 2026 +0800"
      },
      "message": "Codex/fix sandbox response leak (#6359)\n\n* Fix sandbox proxy response leak\n\n* Restore static sandbox HTTP utility\n\n* Close sandbox test exchange\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "48e48df4ddde91938f4be3d11c91a8f21be8c0cc",
      "tree": "62e1a2ead2f1dd495a157ff0245b51447ab95327",
      "parents": [
        "7c8a67ddfc26ab6091c8112746592ebb11db7916"
      ],
      "author": {
        "name": "SUPERSAIYAN",
        "email": "1714264078@qq.com",
        "time": "Mon Jun 08 10:00:07 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 08 10:00:07 2026 +0800"
      },
      "message": "Fix README documentation links (#6357)\n\n* Fix README documentation links\n\n* Trigger README CI\n\n* Fix README docs link spacing\n\n* Trigger README CI"
    },
    {
      "commit": "7c8a67ddfc26ab6091c8112746592ebb11db7916",
      "tree": "76810dd8a87939e5dbaf824013fd16fc7eccd51e",
      "parents": [
        "7dc8ecc59d33b33f0ecaf0ac05976756a42d3f93"
      ],
      "author": {
        "name": "eye-gu",
        "email": "734164350@qq.com",
        "time": "Fri Jun 05 21:45:32 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 05 21:45:32 2026 +0800"
      },
      "message": "fix: eliminate race condition in UpstreamCheckServiceTest.testReplace (#6355)\n\n* fix: eliminate race condition in UpstreamCheckServiceTest.testReplace\n\n* chore: trigger CI\n\n* fix review\n\n* fix review"
    },
    {
      "commit": "7dc8ecc59d33b33f0ecaf0ac05976756a42d3f93",
      "tree": "2245acc65e5bcb609174801e36152218167c07ad",
      "parents": [
        "e3cf5ce54a4448ce246fba3d2bdfdb4a5e651cbd"
      ],
      "author": {
        "name": "eye-gu",
        "email": "734164350@qq.com",
        "time": "Tue Jun 02 10:05:45 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 02 10:05:45 2026 +0800"
      },
      "message": "fix: replace ArrayList with CopyOnWriteArrayList to avoid ConcurrentModificationException in URI heartbeat (#6352)"
    },
    {
      "commit": "e3cf5ce54a4448ce246fba3d2bdfdb4a5e651cbd",
      "tree": "32eeea49e64357050b129946fe2c5779eda1a493",
      "parents": [
        "73a4a06811e3ed1325a7e1af91a2247b12ee2b8b"
      ],
      "author": {
        "name": "eye-gu",
        "email": "734164350@qq.com",
        "time": "Mon Jun 01 14:50:06 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 01 14:50:06 2026 +0800"
      },
      "message": "fix(ai-prompt): preserve all original messages in decorateBody (#6343)\n\n* fix(ai-prompt): preserve all original messages in decorateBody\n\n* move SuppressWarnings\n\n---------\n\nCo-authored-by: moremind \u003chefengen@apache.org\u003e"
    },
    {
      "commit": "73a4a06811e3ed1325a7e1af91a2247b12ee2b8b",
      "tree": "bd4840c5ffa38699b7994e784026048b8009fc61",
      "parents": [
        "338ea9adaff36140c478cc6e2ef01dea8c3c46d8"
      ],
      "author": {
        "name": "eye-gu",
        "email": "734164350@qq.com",
        "time": "Sat May 16 23:02:20 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat May 16 23:02:20 2026 +0800"
      },
      "message": "fix: correct instanceof check in addFailureUriDataRegister (#6345)\n\n* fix: correct instanceof check in addFailureUriDataRegister\n\n* ci: trigger CI re-run for flaky k8s-ingress-grpc test"
    },
    {
      "commit": "338ea9adaff36140c478cc6e2ef01dea8c3c46d8",
      "tree": "848eea99075ad5aa934017d5393258f472c83f81",
      "parents": [
        "c8961528b72a2a7f81f0d1cd7525af1659a670bc"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Mon May 11 11:32:37 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon May 11 11:32:37 2026 +0800"
      },
      "message": "[type:refactor] remove motan support (#6307)\n\n* [type:refactor] remove motan support\n\n* test(common): drop motan schema sync check on remove-motan"
    },
    {
      "commit": "c8961528b72a2a7f81f0d1cd7525af1659a670bc",
      "tree": "d01e11b68c9f8448a281cdf0f82ae4f37f028534",
      "parents": [
        "73b580d3c07c74904d2d72ce3dc2b3a3aee44d2a"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Fri May 08 16:17:42 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri May 08 16:17:42 2026 +0800"
      },
      "message": "Prevent duplicate full-mode URI heartbeats after repeated context refresh (#6337)\n\nFull-mode client listeners published URI registration before the shared\none-time registration gate ran, so repeated ContextRefreshedEvent\ninvocations could enqueue the same URI multiple times and amplify\nheartbeat logging. This change routes full-mode registration through the\nsame gate as the standard listener flow and locks the behavior with\nSpring MVC and WebSocket regression tests.\n\nConstraint: Full-mode registration must preserve standard one-shot listener semantics\nRejected: Deduplicate in the heartbeat subscriber | leaves duplicate registration side effects in place\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Keep any full-mode registration path behind the shared registration gate\nTested: mvn -pl shenyu-client/shenyu-client-core,shenyu-client/shenyu-client-http/shenyu-client-springmvc,shenyu-client/shenyu-client-websocket/shenyu-client-spring-websocket -am -DfailIfNoTests\u003dfalse -Dtest\u003dShenyuClientURIExecutorSubscriberTest,SpringMvcClientEventListenerTest,SpringWebSocketClientEventListenerTest test\nNot-tested: Live expos-admin-server runtime verification"
    },
    {
      "commit": "73b580d3c07c74904d2d72ce3dc2b3a3aee44d2a",
      "tree": "319cfc8396c3079d22fb745f628cfcbfac653741",
      "parents": [
        "fb454de3cb21d5dae7a281a7aae492d5bbb26ebc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Apr 27 19:04:16 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Apr 27 19:04:16 2026 +0800"
      },
      "message": "chore(deps): bump com.sun.mail:jakarta.mail from 2.0.1 to 2.0.2 (#6329)\n\nBumps com.sun.mail:jakarta.mail from 2.0.1 to 2.0.2.\n\n---\nupdated-dependencies:\n- dependency-name: com.sun.mail:jakarta.mail\n  dependency-version: 2.0.2\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "fb454de3cb21d5dae7a281a7aae492d5bbb26ebc",
      "tree": "d7888f2b2e6d1890834b9024b5961d89c75c9ee9",
      "parents": [
        "e2c21ed11433e774fa341dd4a52ec369f9cdf98d"
      ],
      "author": {
        "name": "zhaoguhong",
        "email": "zhaobaymax@163.com",
        "time": "Fri Apr 24 22:57:27 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Apr 24 22:57:27 2026 +0800"
      },
      "message": "Fix websocket client spec builder reuse in plugin config (#6330)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "e2c21ed11433e774fa341dd4a52ec369f9cdf98d",
      "tree": "388f9cd032f1983f6f4c6928c9e259c640b8428b",
      "parents": [
        "4f346c577f79cf2391f14b46c7384250df9c2056"
      ],
      "author": {
        "name": "Oneday2333",
        "email": "wy471x@gmail.com",
        "time": "Fri Apr 24 14:42:07 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Apr 24 14:42:07 2026 +0800"
      },
      "message": "test(task#5161): improve test coverage for admin. (#6328)\n\n* test(admin):improve test case coverage for DashboardProperties.\n\n* test(admin):improve test case coverage for SuperAdminPasswordSafeAdvice.\n\n* test(admin):improve test case coverage for exception classes.\n\n* test(admin):improve test case coverage for exception classes.\n\n* test(admin):improve test case coverage for exception classes.\n\n* test(admin):improve test case coverage for utils classes.\n\n* test(admin):improve test case coverage under package org.apache.shenyu.admin.listener.\n\n* test(admin):improve test case coverage under package org.apache.shenyu.admin.disruptor.\n\n* test(admin):improve test case coverage for utils classes.\n\n* test(admin):improve test case coverage in package org.apache.shenyu.admin.service.\n\n* test(admin):improve test case coverage in package org.apache.shenyu.admin.service.\n\n* test(admin):improve test case coverage in package org.apache.shenyu.admin.service."
    },
    {
      "commit": "4f346c577f79cf2391f14b46c7384250df9c2056",
      "tree": "32d16272756292b6543b69d0a2c3c2efc85642f4",
      "parents": [
        "a19cb16ff67afaa58ed078390cd621be1c682229"
      ],
      "author": {
        "name": "Oneday2333",
        "email": "wy471x@gmail.com",
        "time": "Fri Apr 24 11:50:37 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Apr 24 11:50:37 2026 +0800"
      },
      "message": "test(task#5161): improve test coverage for sync. (#6333)\n\n* test(sync):improve test case coverage for ApolloDataService and PolarisSyncDataService classes.\n\n* test(sync):improve test case coverage for ApolloDataService and PolarisSyncDataService classes."
    },
    {
      "commit": "a19cb16ff67afaa58ed078390cd621be1c682229",
      "tree": "005f102bd8bbfbef34130c5f229fc4eba1e3cc24",
      "parents": [
        "31f0a4d8a7e2ae99beafcb2523e67419ac11b81a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Apr 24 09:28:06 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Apr 24 09:28:06 2026 +0800"
      },
      "message": "chore(deps): bump org.bouncycastle:bcprov-jdk18on from 1.78 to 1.84 (#6331)\n\nBumps [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) from 1.78 to 1.84.\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.bouncycastle:bcprov-jdk18on\n  dependency-version: \u00271.84\u0027\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "31f0a4d8a7e2ae99beafcb2523e67419ac11b81a",
      "tree": "e614c52ec9408be574ba8d4965b2537ac0d07c4f",
      "parents": [
        "e6298fab1054c4ddff79ed61c5ffed13956a924c"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Wed Apr 15 19:39:54 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Apr 15 19:39:54 2026 +0800"
      },
      "message": "Stop exposing login AES secrets to anonymous callers (#6323)\n\n* goalx: snapshot before shenyu-analysis\n\n* Stop exposing login AES secrets to anonymous callers\n\nThe login page was fetching /platform/secretInfo anonymously and receiving\nthe long-lived AES key material used for password encryption. This\nchange sanitizes the endpoint output so no real key/IV is returned and\nadds a server-side fallback to accept plain-text passwords when the\nclient no longer encrypts before login.\n\nConstraint: Preserve compatibility with the existing bundled login page without rebuilding the frontend assets\nRejected: Remove the endpoint or require auth only | would leave the current login bundle unable to encrypt and cause login failures without a backend fallback\nConfidence: medium\nScope-risk: moderate\nReversibility: clean\nDirective: Treat any future login bootstrap material as public-only data; never return reusable symmetric secrets to the client\nTested: mvn -pl shenyu-admin -Dtest\u003dSecretServiceTest,DashboardUserServiceTest,PlatformControllerTest test\nNot-tested: End-to-end browser login flow against a running admin instance and non-TLS deployment behavior\n\n* Refine login secret exposure fix after review\n\nThis follow-up removes an unused constructor dependency, fixes the\nsecret payload encoding charset explicitly, and narrows AES decrypt\nattempts to inputs that look like ciphertext so normal plain-text login\nfallback no longer produces avoidable decrypt failures.\n\nConstraint: Maintain compatibility with the current login bundle while reducing operational noise from the fallback path\nConfidence: high\nScope-risk: moderate\nReversibility: clean\nDirective: Avoid using exception-driven control flow for common login paths when ciphertext can be identified up front\nTested: mvn -pl shenyu-admin -Dtest\u003dSecretServiceTest,DashboardUserServiceTest,PlatformControllerTest test\nNot-tested: End-to-end browser login against a running admin instance\n\n* Reduce login fallback log noise after review\n\nThis follow-up removes the exception-driven decrypt path from normal\nplain-text login fallback and switches secret bootstrap encoding to an\nexplicit UTF-8 byte conversion while keeping the sanitized response.\n\nConstraint: Preserve compatibility with the current bundled login page while avoiding production error-log spam on valid fallback flows\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Do not route expected login fallback behavior through utilities that log hard failures by default\nTested: mvn -pl shenyu-admin -Dtest\u003dSecretServiceTest,DashboardUserServiceTest,PlatformControllerTest test\nNot-tested: End-to-end browser login against a running admin instance\n\n* Replace login secret magic values with named constants\n\nThis follow-up names the AES block size and the sanitized secret\nplaceholder in production code, and replaces repeated literal key/iv\nand credential strings in the related tests with explicit constants.\n\nConstraint: Keep the cleanup local to the active login-secret fix to avoid unrelated churn across other PR branches\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Prefer named constants for repeated protocol/security values even in tests when they carry semantic meaning\nTested: mvn -pl shenyu-admin -Dtest\u003dSecretServiceTest,DashboardUserServiceTest,PlatformControllerTest test\nNot-tested: Full shenyu-admin test suite\n\n* Refine login secret fixes after latest review\n\nThis follow-up removes the fully qualified SecretProperties usage in\nSecretServiceImpl and factors the login password normalization into a\nnamed helper so the plain-text fallback path reads clearly in the main\nlogin flow.\n\nConstraint: Keep the update local to the existing login-secret fix without changing the external API shape\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Keep security-sensitive fallback logic explicit and readable; avoid hiding behavior in dense Optional chains\nTested: mvn -pl shenyu-admin -Dtest\u003dSecretServiceTest,DashboardUserServiceTest,PlatformControllerTest test\nNot-tested: End-to-end browser login against a running admin instance"
    },
    {
      "commit": "e6298fab1054c4ddff79ed61c5ffed13956a924c",
      "tree": "edea78040cda356c891eaa45f15b94cb4cf4ac5d",
      "parents": [
        "33c79d19a2613fe1b64998c593f117d3cede3cbb"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Apr 15 13:26:15 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Apr 15 13:26:15 2026 +0800"
      },
      "message": "chore(deps): bump org.apache.kafka:kafka-clients from 3.9.1 to 3.9.2 (#6324)\n\nBumps org.apache.kafka:kafka-clients from 3.9.1 to 3.9.2.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.kafka:kafka-clients\n  dependency-version: 3.9.2\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "33c79d19a2613fe1b64998c593f117d3cede3cbb",
      "tree": "c89889a953795a18f22e9e9af119eadea310b4e9",
      "parents": [
        "f258aecad7328d7e0328f0c0d0f0a4254fcf66c6"
      ],
      "author": {
        "name": "L",
        "email": "54098507+2823602869@users.noreply.github.com",
        "time": "Wed Apr 15 09:16:13 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Apr 15 09:16:13 2026 +0800"
      },
      "message": "Ci update cache (#6325)\n\n* ci: optimize CI workflows with cache and concurrency\n\n* add github action cache speed ​​up ci exec\n\n---------\n\nCo-authored-by: moremind \u003chefengen@apache.org\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "f258aecad7328d7e0328f0c0d0f0a4254fcf66c6",
      "tree": "e915c54b041fb586d4e00d14405fdc78a04ba162",
      "parents": [
        "0e1cc3cb28b1996594b3a0ea27ce0452209bc58c"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Apr 14 23:39:30 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Apr 14 23:39:30 2026 +0800"
      },
      "message": "Fix missing RBAC on selector, rule, and data-permission endpoints (#6319)"
    },
    {
      "commit": "0e1cc3cb28b1996594b3a0ea27ce0452209bc58c",
      "tree": "fcc7219a7caa87e4fec7811e2c6b6a691a36617f",
      "parents": [
        "aceaf5b2aa1aff229f557c387e6aefbf46666380"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Apr 14 22:15:43 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Apr 14 22:15:43 2026 +0800"
      },
      "message": "Block redirect-based SSRF bypass in Swagger imports (#6320)\n\n* goalx: snapshot before shenyu-analysis\n\n* Block redirect-based SSRF bypass in Swagger imports\n\nSwagger import requests were validating only the initial URL while the\nshared OkHttp client silently followed redirects. Disabling redirect\nfollowing at the HTTP utility layer prevents callers from reaching\nunvalidated internal targets through 3xx responses.\n\nConstraint: Keep the fix in the shared HTTP client so all callers inherit the safer default\nRejected: Add Swagger-specific redirect validation only | leaves other HttpUtils callers exposed to the same redirect class\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Do not re-enable redirect following without validating every redirect target before the request is sent\nTested: mvn -pl shenyu-admin -Dtest\u003dHttpUtilsTest,SwaggerImportServiceTest test\nNot-tested: Full shenyu-admin test suite and end-to-end Swagger import against live remote servers\n\n* Scope redirect blocking to Swagger import requests\n\nThis follow-up preserves the default redirect-following behavior of the\nshared HttpUtils client and moves no-redirect handling onto the\nSwagger import path only. The regression tests now cover both the\nexplicit no-redirect mode and the original default behavior.\n\nConstraint: Avoid changing shared HTTP client semantics for unrelated admin features\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: SSRF hardening for one feature should not silently redefine shared client behavior without an explicit compatibility review\nTested: mvn -pl shenyu-admin -Dtest\u003dHttpUtilsTest,SwaggerImportServiceTest test\nNot-tested: Full shenyu-admin test suite\n\n* Replace redirect test literals with named constants\n\nThis follow-up removes repeated path, status, and body literals from the\nHttpUtils redirect tests so the cases read in terms of the HTTP behavior\nbeing verified instead of raw values.\n\nConstraint: Keep the cleanup test-only and local to the redirect SSRF fix\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Name repeated HTTP semantics in tests when they describe protocol behavior rather than incidental values\nTested: mvn -pl shenyu-admin -Dtest\u003dHttpUtilsTest,SwaggerImportServiceTest test\nNot-tested: Full shenyu-admin test suite\n\n* Fix redirect test URL construction\n\nThe no-redirect regression test was composing redirect URLs from a base\nstring that already ended with a slash, which produced invalid host/port\ncombinations in CI. This follow-up switches the test to a dedicated host\nprefix constant so the dynamically allocated port is embedded correctly.\n\nConstraint: Keep the fix limited to the test harness; production redirect handling is unchanged\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Avoid composing dynamic host:port URLs from request path fixtures that carry trailing slash semantics\nTested: mvn -pl shenyu-admin -Dtest\u003dHttpUtilsTest,SwaggerImportServiceTest test\nNot-tested: Full shenyu-admin test suite\n\n---------\n\nCo-authored-by: moremind \u003chefengen@apache.org\u003e"
    },
    {
      "commit": "aceaf5b2aa1aff229f557c387e6aefbf46666380",
      "tree": "af2a4c6376725d5d485330f048d6f30d0936dd87",
      "parents": [
        "bec32f355972e095ef57289e84a30578b71b60ee"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Apr 14 20:45:19 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Apr 14 20:45:19 2026 +0800"
      },
      "message": "Hide registry passwords from admin API responses (#6322)"
    },
    {
      "commit": "bec32f355972e095ef57289e84a30578b71b60ee",
      "tree": "dbc0a55eb6685cb29face4b15376dcce04d192af",
      "parents": [
        "2c44e7ef7e7bf1b5cb0a3adee68106547c810ee2"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Tue Apr 14 19:33:26 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Apr 14 19:33:26 2026 +0800"
      },
      "message": "Align SSRF URL validation with OkHttp parsing (#6321)\n\n* goalx: snapshot before shenyu-analysis\n\n* Align SSRF URL validation with the OkHttp request target\n\nThe Swagger import SSRF guard was parsing URLs with java.net.URL while\nthe actual request path was interpreted by OkHttp. This mismatch let\nparser-confusion payloads pass validation but resolve to internal\nhosts during request execution. The fix validates against OkHttp\u0027s\nHttpUrl semantics and adds regression coverage for the known payload.\n\nConstraint: Keep validation semantics aligned with the HTTP client actually used for outbound requests\nRejected: Add ad-hoc blacklist checks for backslash or @ combinations | brittle and would miss future parser edge cases\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Any future SSRF validation must use the same parser and canonicalization rules as the outbound HTTP client\nTested: mvn -pl shenyu-admin -Dtest\u003dUrlSecurityUtilsTest,SwaggerImportServiceTest test\nNot-tested: Full shenyu-admin test suite and live end-to-end Swagger import against a running admin instance\n\n* Name parser-confusion SSRF payload in tests\n\nThis follow-up replaces the repeated parser-confusion exploit string with\na single named constant in the SSRF regression tests.\n\nConstraint: Limit the cleanup to the dedicated parser-confusion test surface\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Keep security regression payloads named when reused across multiple assertions\nTested: mvn -pl shenyu-admin -Dtest\u003dUrlSecurityUtilsTest,SwaggerImportServiceTest test\nNot-tested: Full shenyu-admin test suite\n\n* Name allowed URL schemes in SSRF validation\n\nThis follow-up replaces the raw http/https string checks in\nUrlSecurityUtils with named protocol constants.\n\nConstraint: Keep the cleanup local to the SSRF validation utility without changing behavior\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Protocol allowlists should use named constants when shared across security-sensitive validation logic\nTested: mvn -pl shenyu-admin -Dtest\u003dUrlSecurityUtilsTest,SwaggerImportServiceTest test\nNot-tested: Full shenyu-admin test suite"
    },
    {
      "commit": "2c44e7ef7e7bf1b5cb0a3adee68106547c810ee2",
      "tree": "fb58a7adaadabfd24addd750cb038655f5274e24",
      "parents": [
        "d45cd7012b7ef708d767ce7ada346a3fadc72b81"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Thu Apr 02 10:03:33 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Apr 02 10:03:33 2026 +0800"
      },
      "message": "feat(mcp-server): enhance SDK compatibility with reflection caching and error handling (#6312)\n\n* feat(mcp-server): enhance SDK compatibility with reflection caching and error handling\n\n- Add reflection field caching in McpSessionHelper for better performance and reliability\n- Add SUPPORTED_SDK_VERSION constant for SDK compatibility tracking\n- Enhance error messages with SDK version information in ShenyuToolCallback\n- Add SDK compatibility notes in pom.xml documenting reflection usage\n- Update MCP_TOOL_EXAMPLES.md and MCP_TOOL_EXAMPLES_EN.md with SDK version compatibility table\n\nThis change improves compatibility with MCP SDK 0.17.0 by:\n- Caching reflection fields at class load time\n- Adding graceful degradation when reflection fails\n- Documenting known limitations and supported SDK versions\n\nCo-Authored-By: Claude Opus 4.6 \u003cnoreply@anthropic.com\u003e\n\n* fix mcp sdk compatibility error handling\n\n---------\n\nCo-authored-by: Claude Opus 4.6 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "d45cd7012b7ef708d767ce7ada346a3fadc72b81",
      "tree": "c35b17c4d52ec435e78b65be1c7686090be54b7d",
      "parents": [
        "2870eab95ed69700abd918f46a0cbc387b94dd74"
      ],
      "author": {
        "name": "shown",
        "email": "yuluo08290126@gmail.com",
        "time": "Thu Apr 02 06:36:10 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Apr 02 06:36:10 2026 +0800"
      },
      "message": "infra(ci): add CI action condition (#6316)"
    },
    {
      "commit": "2870eab95ed69700abd918f46a0cbc387b94dd74",
      "tree": "9a1b328e0c7af408b7a45da88dff3e37635d67cc",
      "parents": [
        "0a927fdd1663291185363dc37defbd231392037d"
      ],
      "author": {
        "name": "bwang",
        "email": "38982792+bwangll@users.noreply.github.com",
        "time": "Tue Mar 31 15:31:06 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Mar 31 15:31:06 2026 +0800"
      },
      "message": "fix(common): align PluginEnum sort values with DB schema.sql (#6310) (#6311)\n\n- Update PluginEnum.KEY_AUTH from 430 to 150 (Authentication phase)\n- Update PluginEnum.RESILIENCE4J from 150 to 310 (FaultTolerance phase)\n- Update PluginEnum.BASIC_AUTH from 35 to 150 (Authentication phase)\n- Update PluginEnum.TCP from 0 to 320 (Proxy phase)\n- Update PluginEnum.MQTT from 0 to 125 (Proxy phase)\n- Update PluginEnum.MOCK from 8 to 1 (Mock phase)\n- Fix H2 schema basicAuth sort from 500 to 150 to match other DBs\n- Add parameterized test to prevent future drift between enum and DB\n\nCo-authored-by: bwang \u003cwangbin_wang@youzan.com\u003e"
    },
    {
      "commit": "0a927fdd1663291185363dc37defbd231392037d",
      "tree": "a4975682894b2a430a1f276879f924d27f01a74a",
      "parents": [
        "87e0fe8604ec07eb0bb0ca243d92844eb4e8a51c"
      ],
      "author": {
        "name": "X.Bruce121",
        "email": "xbruce121@163.com",
        "time": "Sun Mar 29 21:41:34 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Mar 29 21:41:34 2026 +0800"
      },
      "message": "Fix: RuleServiceImpl#searchByPage() Selectors now populated from namespace only when condition selectors are null or empty. (#6305)\n\n* fix admin : only populate selectors from namespace when condition selectors are null or empty.\n\n* Update shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/RuleServiceImpl.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e"
    },
    {
      "commit": "87e0fe8604ec07eb0bb0ca243d92844eb4e8a51c",
      "tree": "831ffe17fa2a5f215092e2bb27f2e9e141bbb3ef",
      "parents": [
        "8e437489c9b90b9549c4ad2ae1a8ed6843abec53"
      ],
      "author": {
        "name": "Senrian",
        "email": "47714364+Senrian@users.noreply.github.com",
        "time": "Sat Mar 28 15:23:53 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Mar 28 15:23:53 2026 +0800"
      },
      "message": "fix: replace Collections.EMPTY_MAP with Collections.emptyMap() (#6299)\n\nReplace deprecated Collections.EMPTY_MAP with Collections.emptyMap() to avoid raw type warnings and improve type safety.\n\nCo-authored-by: Senrian \u003csen@senrian.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "8e437489c9b90b9549c4ad2ae1a8ed6843abec53",
      "tree": "d19fdbdc10f05b64cadcdaba6d7e06413c04bd8d",
      "parents": [
        "7248388da1796866be10af9cb68b5ebe1b70fe8b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Mar 27 22:01:17 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Mar 27 22:01:17 2026 +0800"
      },
      "message": "chore(deps): bump org.apache.zookeeper:zookeeper from 3.9.4 to 3.9.5 (#6302)\n\nBumps org.apache.zookeeper:zookeeper from 3.9.4 to 3.9.5.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.zookeeper:zookeeper\n  dependency-version: 3.9.5\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "7248388da1796866be10af9cb68b5ebe1b70fe8b",
      "tree": "b88a194aeec3b5047f2ae187f6e0f23144924600",
      "parents": [
        "295a12bb56539465ba3d979c0e8bbf13b2696fce"
      ],
      "author": {
        "name": "yangpixi",
        "email": "63222549+yangpixi@users.noreply.github.com",
        "time": "Fri Mar 27 13:07:56 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Mar 27 13:07:56 2026 +0800"
      },
      "message": "chore(deps): bump oshi from 6.7.0 to 6.10.0 (#6301)\n\n* chore(deps): bump oshi from 6.7.0 to 6.10.0\n\n* chore(deps): change oshi version in license file\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "295a12bb56539465ba3d979c0e8bbf13b2696fce",
      "tree": "8b451954cf4a03730f3d5644fc129c4c0d4735ea",
      "parents": [
        "5c2c3ed612e5bc7b6c87f45c8ceef65321f7948c"
      ],
      "author": {
        "name": "moremind",
        "email": "hefengen@apache.org",
        "time": "Fri Mar 27 09:23:34 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Mar 27 09:23:34 2026 +0800"
      },
      "message": "[type:refactor] remove shenyu trie cache (#6303)\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n* [type:refactor] remove trie cache\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "5c2c3ed612e5bc7b6c87f45c8ceef65321f7948c",
      "tree": "3f4221c29efbd98284f37316327e3cfc1ea8e6d7",
      "parents": [
        "c39506e97ceef9490a97c736fd5098ce97d6f3a0"
      ],
      "author": {
        "name": "moremind",
        "email": "hefengen@apache.org",
        "time": "Fri Mar 27 08:27:05 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Mar 27 08:27:05 2026 +0800"
      },
      "message": "[type:fix] remove java 18 ci (#6306)"
    },
    {
      "commit": "c39506e97ceef9490a97c736fd5098ce97d6f3a0",
      "tree": "6948288aae84a775e5a7b59c97455e9c4adb3ea4",
      "parents": [
        "c2efae14e795655f3ec37a9e9e78d33bfeedf5dc"
      ],
      "author": {
        "name": "yangyx107",
        "email": "1026244247@qq.com",
        "time": "Sat Feb 28 16:34:59 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Feb 28 16:34:59 2026 +0800"
      },
      "message": "Fix: loggion console add rule bug (#6291)\n\n* fix: loggionConsole-addRule-bug\n\n* fix: loggionConsole-addRule-bug\n\n* fix: loggionConsole-addRule-bug\n\n* fix: loggionConsole-addRule-bug\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "c2efae14e795655f3ec37a9e9e78d33bfeedf5dc",
      "tree": "46ed1a69ef0db627c71a6e85869018b509544d1e",
      "parents": [
        "7ff5ba3164da052b22ebbb1ae21c8c1975a5a8a8"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Wed Feb 25 19:37:25 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 25 19:37:25 2026 +0800"
      },
      "message": "fix: improve MCP server plugin path handling and backward compatibility for argsPosition (#6293)\n\n* fix: improve MCP server plugin path handling and backward compatibility for argsPosition\n\n* fix: enhance MCP server plugin path validation and improve handling of blank paths\n\n* Update shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/handler/McpServerPluginDataHandler.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/manager/ShenyuMcpServerManager.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* fix: streamline MCP server plugin path handling by removing redundant checks\n\n* fix: remove unused imports in ShenyuMcpServerManager\n\n---------\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\nCo-authored-by: Yu Siheng \u003c2874602095@qq.com\u003e"
    },
    {
      "commit": "7ff5ba3164da052b22ebbb1ae21c8c1975a5a8a8",
      "tree": "8ccfb83ff1c9be5b4f2adf6bf34cecd5e06e751b",
      "parents": [
        "6f828183710981cd5635b4bb38bc6229df9cfa5e"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Wed Feb 25 19:07:31 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 25 19:07:31 2026 +0800"
      },
      "message": "fix: improve upstream cache management and add recovery test for empty events (#6294)\n\n* fix: improve upstream cache management and add recovery test for empty events\n\n* fix: streamline upstream removal process and add test for empty event handling\n\n---------\n\nCo-authored-by: Yu Siheng \u003c2874602095@qq.com\u003e"
    },
    {
      "commit": "6f828183710981cd5635b4bb38bc6229df9cfa5e",
      "tree": "0199aa5c673b799cbd0f3ae0d7679b6eeab9aeb0",
      "parents": [
        "205fe32a3c06b654dcd03529c39c980b105a4492"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Wed Feb 25 18:11:20 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 25 18:11:20 2026 +0800"
      },
      "message": "feat: add CORS support with configurable allowed headers in MCP server (#6295)\n\n* feat: add CORS support with configurable allowed headers in MCP server\n\n* Update shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/McpServerPlugin.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* feat: enhance CORS support by refining allowed methods and headers handling\n\n---------\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e"
    },
    {
      "commit": "205fe32a3c06b654dcd03529c39c980b105a4492",
      "tree": "d5a0e4ef809c4703a39a53553464eb7a0e3f895d",
      "parents": [
        "c224816207e5f71cc5e9f8e0041d0cc0218f4c95"
      ],
      "author": {
        "name": "Yu Siheng",
        "email": "2874602095@qq.com",
        "time": "Sun Feb 15 22:32:01 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Feb 15 22:32:01 2026 +0800"
      },
      "message": "feat: refactor aiRequest and aiResponse models to support asynchronou… (#6296)\n\n* feat: refactor aiRequest and aiResponse models to support asynchronous operations\n\n* add:logging and illegal judgment\n\n* fix"
    },
    {
      "commit": "c224816207e5f71cc5e9f8e0041d0cc0218f4c95",
      "tree": "cc33f8bb7c06aff0df1adafaa90054b455f71578",
      "parents": [
        "29f9d5ff75b42a316ce7968845fab467ab62748c"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Sat Feb 07 13:24:41 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Feb 07 13:24:41 2026 +0800"
      },
      "message": "fix mcp streamable (#6289)\n\n* fix mcp streamable\n\n* fix ci\n\n* fix ci"
    },
    {
      "commit": "29f9d5ff75b42a316ce7968845fab467ab62748c",
      "tree": "2c03f876c4067dc2281396788d155eb3c986e4b9",
      "parents": [
        "e5c1db9f826a535969a41777ee8fc111af687544"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Wed Feb 04 16:51:10 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 04 16:51:10 2026 +0800"
      },
      "message": "fix: enhance logging and improve request handling in HTTP client plugins (#6288)\n\n* fix: enhance logging and improve request handling in HTTP client plugins\n\n* Update shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/NettyHttpClientPlugin.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/callback/ShenyuToolCallback.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/callback/ShenyuToolCallback.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/callback/ShenyuToolCallback.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* fix: improve null check for request body in ShenyuToolCallback\n\n---------\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e"
    },
    {
      "commit": "e5c1db9f826a535969a41777ee8fc111af687544",
      "tree": "38247fe3773551fc14db089de86ccf828c2961ee",
      "parents": [
        "1a92cca9a43196ba8dc32d5a8cc4f12a1f361451"
      ],
      "author": {
        "name": "fanpipi",
        "email": "50613743+fanpipi@users.noreply.github.com",
        "time": "Wed Feb 04 13:43:25 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 04 13:43:25 2026 +0800"
      },
      "message": "fix: fix GsonUtils concurrent serialization exceptions (#6286) (#6287)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "1a92cca9a43196ba8dc32d5a8cc4f12a1f361451",
      "tree": "08ddcc6e7617a57cedd8466af249e267126ea3c2",
      "parents": [
        "b94f2a242504306bca8574c4321efa7cb51337c7"
      ],
      "author": {
        "name": "VampireAchao",
        "email": "achao@apache.org",
        "time": "Wed Feb 04 12:55:10 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 04 12:55:10 2026 +0800"
      },
      "message": "replace stream().forEach() to forEach() (#6275)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e\nCo-authored-by: zhengpeng \u003c847850277@qq.com\u003e"
    },
    {
      "commit": "b94f2a242504306bca8574c4321efa7cb51337c7",
      "tree": "af965bf77ce9dd4fbd80b307879f644e556b8da9",
      "parents": [
        "556e840f373daa7b8ca5979c76b14270b9bd0989"
      ],
      "author": {
        "name": "yangyx107",
        "email": "1026244247@qq.com",
        "time": "Wed Feb 04 11:49:42 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 04 11:49:42 2026 +0800"
      },
      "message": "feat:modify instance createOrUpdate method log level (#6285)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "556e840f373daa7b8ca5979c76b14270b9bd0989",
      "tree": "c3c814437d4aca7f9a1b0a691a0512a8e15b70dd",
      "parents": [
        "75ade3625f5483a5848ccabe287235aea49e33a1"
      ],
      "author": {
        "name": "eye-gu",
        "email": "734164350@qq.com",
        "time": "Wed Feb 04 11:22:23 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 04 11:22:23 2026 +0800"
      },
      "message": "[type:fix] set open (#6280)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "75ade3625f5483a5848ccabe287235aea49e33a1",
      "tree": "861b3ee1b4c1f00cf28879d2ada20cdb66677277",
      "parents": [
        "dff154a7dc8349ab51649c9155261113e81facfd"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Wed Feb 04 08:53:12 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Feb 04 08:53:12 2026 +0800"
      },
      "message": "fix: handle tool not found error and update requestConfig type to JsonElement (#6284)\n\n"
    },
    {
      "commit": "dff154a7dc8349ab51649c9155261113e81facfd",
      "tree": "a61f9ef41b8d700a27e24b352af0028a90039683",
      "parents": [
        "1d8879a4a8b99ec667fe19fa3c8a8db20fd0d9a3"
      ],
      "author": {
        "name": "yangyx107",
        "email": "1026244247@qq.com",
        "time": "Tue Feb 03 17:58:56 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Feb 03 17:58:56 2026 +0800"
      },
      "message": "feat:sync dashboard (#6283)\n\n"
    },
    {
      "commit": "1d8879a4a8b99ec667fe19fa3c8a8db20fd0d9a3",
      "tree": "a290a0e2f074b113315691a3029a432c2bb0f808",
      "parents": [
        "64ad46fa44d6295d284660afbd12fe0080d4b963"
      ],
      "author": {
        "name": "yangyx107",
        "email": "1026244247@qq.com",
        "time": "Tue Feb 03 16:29:10 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Feb 03 16:29:10 2026 +0800"
      },
      "message": "feat: Add new role search criteria (#6282)\n\n* feat: Add new role search criteria\n\n* feat: Add new role search criteria\n\n* feat: Add new role search criteria\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "64ad46fa44d6295d284660afbd12fe0080d4b963",
      "tree": "eced78e69e434cf9baf3fc6a482c4567562939c3",
      "parents": [
        "cb3c582f4cf0457ddb8cbbc1d465083c237ed787"
      ],
      "author": {
        "name": "Rin",
        "email": "dangnhatrin90@gmail.com",
        "time": "Fri Jan 30 18:34:21 2026 +0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jan 30 19:34:21 2026 +0800"
      },
      "message": "[Security] Harden Docker images to run as non-root user (#6273)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e\nCo-authored-by: zhengpeng \u003c847850277@qq.com\u003e"
    },
    {
      "commit": "cb3c582f4cf0457ddb8cbbc1d465083c237ed787",
      "tree": "2ef66b0434d62d57b6a1fc842d10611ee1eb96f6",
      "parents": [
        "a6b8de170008aab26879952a797b5d8a85ae18d6"
      ],
      "author": {
        "name": "Jesen Kwan",
        "email": "guan.zhenxing@foxmail.com",
        "time": "Thu Jan 29 11:28:53 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jan 29 11:28:53 2026 +0800"
      },
      "message": " Fix: Preserve Gateway\u0027s independent upstream health check state when receiving config updates from Admin (#6274)\n\n* Fix: Preserve unhealthy upstream state when receiving config updates from admin\n\nWhen admin publishes configuration updates with upstreams marked as status\u003dfalse,\nthe gateway should preserve their unhealthy state and continue health checking\ninstead of completely removing them. This allows the gateway\u0027s independent health\ncheck to recover upstreams when they become healthy.\n\nChanges:\n- UpstreamCacheManager: Refactored submit() method to preserve unhealthy state\n  for both status\u003dtrue and status\u003dfalse upstreams\n- Added processOfflineUpstreams() to handle status\u003dfalse upstreams with health\n  check enabled, keeping them in unhealthy map for monitoring\n- Added processValidUpstreams() to check if valid upstreams were previously\n  unhealthy and preserve that status\n- UpstreamCheckTask: Made removeFromMap() public to support state preservation\n\nCo-Authored-By: Claude \u003cnoreply@anthropic.com\u003e\n\n* Test: Add tests for upstream unhealthy state preservation\n\nAdd comprehensive tests to verify the fix for preserving unhealthy upstream\nstate when receiving config updates from admin.\n\nUpstreamCacheManagerTest:\n- testSubmitWithStatusFalsePreservesUnhealthyState: Verify that upstreams\n  with status\u003dfalse that were previously unhealthy remain in unhealthy map\n- testSubmitWithNewOfflineUpstreamAddedToUnhealthy: Verify new upstreams\n  with status\u003dfalse are added to unhealthy map for monitoring\n- testSubmitPreservesUnhealthyForValidUpstream: Verify valid upstreams\n  that were previously unhealthy remain in unhealthy map\n- testSubmitWithHealthCheckDisabledAndStatusFalse: Verify upstreams with\n  healthCheckEnabled\u003dfalse are removed, not added to unhealthy map\n\nUpstreamCheckTaskTest:\n- testPutToMap: Test adding upstreams to healthy map\n- testPutToMapUnhealthy: Test adding upstreams to unhealthy map\n- testRemoveFromMap: Test removing upstreams from healthy map\n- testRemoveFromMapUnhealthy: Test removing upstreams from unhealthy map\n- testMoveUpstreamBetweenMaps: Test moving upstreams between maps\n\nCo-Authored-By: Claude \u003cnoreply@anthropic.com\u003e\n\n* Update shenyu-loadbalancer/src/test/java/org/apache/shenyu/loadbalancer/cache/UpstreamCheckTaskTest.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Opt: Move empty list check before initialization to avoid unnecessary processing\n\nMove the empty list check to the beginning of submit() method to avoid\ncalling initializeUpstreamHealthStatus() and stream partitioning when\nthe upstream list is empty.\n\nThis is a minor performance optimization that reduces unnecessary method\ncalls and stream operations when processing empty upstream lists.\n\nChanges:\n- Move isEmpty() check before initializeUpstreamHealthStatus()\n- Add early return for empty lists\n- Remove redundant isEmpty() check after partitioning\n\nCo-Authored-By: Claude \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\nCo-authored-by: zhengpeng \u003c847850277@qq.com\u003e"
    },
    {
      "commit": "a6b8de170008aab26879952a797b5d8a85ae18d6",
      "tree": "c9966e7380444a12011a25c8d32d2e36ae3d1b0c",
      "parents": [
        "74954fa2b9e5a8d0426929ad754a78048be32c9f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jan 28 09:35:37 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jan 28 09:35:37 2026 +0800"
      },
      "message": "chore(deps): bump org.assertj:assertj-core in /shenyu-e2e (#6278)\n\nBumps [org.assertj:assertj-core](https://github.com/assertj/assertj) from 3.22.0 to 3.27.7.\n- [Release notes](https://github.com/assertj/assertj/releases)\n- [Commits](https://github.com/assertj/assertj/compare/assertj-core-3.22.0...assertj-build-3.27.7)\n\n---\nupdated-dependencies:\n- dependency-name: org.assertj:assertj-core\n  dependency-version: 3.27.7\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "74954fa2b9e5a8d0426929ad754a78048be32c9f",
      "tree": "6cad40cb543136d2845a0968f6d941ba3de501d1",
      "parents": [
        "fbc3c4bf4975055da422b2d8ae9d0df52321925d"
      ],
      "author": {
        "name": "eye-gu",
        "email": "734164350@qq.com",
        "time": "Mon Jan 26 22:28:22 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jan 26 22:28:22 2026 +0800"
      },
      "message": "[type:fix] fix database init script (#6277)\n\n* [type:fix] fix database init script\n\n* Fix test unnecessary stubbing"
    },
    {
      "commit": "fbc3c4bf4975055da422b2d8ae9d0df52321925d",
      "tree": "7413c446775eb0b02c06311ab1a5d481af9edfed",
      "parents": [
        "71ff9d26e01e233fc571eac02e55f5ee86a65bb0"
      ],
      "author": {
        "name": "MaMengzhen",
        "email": "58206741+MaMengzhen@users.noreply.github.com",
        "time": "Mon Jan 19 18:06:13 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jan 19 18:06:13 2026 +0800"
      },
      "message": "fix mcp config shenyu context error (#6266)\n\n* fix mcp config shenyu context error\n\n* fix mcp config shenyu context error\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "71ff9d26e01e233fc571eac02e55f5ee86a65bb0",
      "tree": "630d46cd544198007954033ac47b63e86c29a2ca",
      "parents": [
        "3c29cc36c7f3948ec97b98a43fe00b094056c268"
      ],
      "author": {
        "name": "jonasHanhan",
        "email": "130035609+jonasHanhan@users.noreply.github.com",
        "time": "Fri Jan 16 11:06:56 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jan 16 11:06:56 2026 +0800"
      },
      "message": "[ISSUE #6235] Set upstream check for each upstream. (#6272)\n\n* fix common : support per-upstream health check.\n\n* fix admin : sanitize upstream url parsing.\n\n* fix common : align health check flag handling.\n\n---------\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "3c29cc36c7f3948ec97b98a43fe00b094056c268",
      "tree": "c21884790a7190bd16b2304c63f691ac23540f46",
      "parents": [
        "385f2b8a0f21dbd472d056f3c8f7244fedfec219"
      ],
      "author": {
        "name": "MaMengzhen",
        "email": "58206741+MaMengzhen@users.noreply.github.com",
        "time": "Fri Jan 16 09:43:29 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jan 16 09:43:29 2026 +0800"
      },
      "message": "fix add custom headers error (#6268)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "385f2b8a0f21dbd472d056f3c8f7244fedfec219",
      "tree": "bf2dde2c004fba63917bb6b818d6d5940ab373fc",
      "parents": [
        "b97c7db820e68cd052a9d9938eef33551d2a4ab6"
      ],
      "author": {
        "name": "Aira Jena",
        "email": "113255984+airajena@users.noreply.github.com",
        "time": "Thu Jan 15 16:40:06 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jan 15 19:10:06 2026 +0800"
      },
      "message": "Fix: Set isClosing flag in closeGracefully method as documented (#6263)\n\nThe FIXME comment noted that the javadoc claimed to use the isClosing\nflag but it wasn\u0027t actually being set. This commit:\n\n- Adds isClosing \u003d true at the start of closeGracefully()\n- Updates the javadoc to accurately reflect the behavior\n- Removes the outdated FIXME comment\n\nThis ensures new connections are properly rejected during graceful shutdown.\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "b97c7db820e68cd052a9d9938eef33551d2a4ab6",
      "tree": "036bd7f60d4cfe8a920809a3ea26071ece73fa3d",
      "parents": [
        "d8fbb5257efa53540e6410bec9f5fe65ba215399"
      ],
      "author": {
        "name": "Aira Jena",
        "email": "113255984+airajena@users.noreply.github.com",
        "time": "Mon Jan 05 12:13:57 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jan 05 14:43:57 2026 +0800"
      },
      "message": "[#6262] Fix OrderlyExecutor resource leak in shenyu-disruptor (#6269)\n\n"
    },
    {
      "commit": "d8fbb5257efa53540e6410bec9f5fe65ba215399",
      "tree": "d2ac32533457bdfe52c0e0220f86d5b59b98f886",
      "parents": [
        "1de8abb44639b68ac93b9d7e386df671ab1ec098"
      ],
      "author": {
        "name": "Aira Jena",
        "email": "113255984+airajena@users.noreply.github.com",
        "time": "Wed Dec 31 08:04:00 2025 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Dec 31 10:34:00 2025 +0800"
      },
      "message": "test(#5161): Improve test coverage for VersionUtils (#6264)\n\nAdded comprehensive tests for:\n- getVersion() with default fallback\n- getVersion() with null code source scenarios\n- checkDuplicate() method for normal classes\n- checkDuplicate() method for core Java classes\n- Version string non-empty validation\n\nThis addresses part of Issue #5161: Improve test case coverage\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "1de8abb44639b68ac93b9d7e386df671ab1ec098",
      "tree": "58bac5e05add84cca654e70c6c83353fec5f654d",
      "parents": [
        "d14a4238dc4710a9dc48f87804e7ac621c9bee19"
      ],
      "author": {
        "name": "Ann (Huei) Chen",
        "email": "chen.ann.h@gmail.com",
        "time": "Sun Dec 28 04:30:28 2025 -0600"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Dec 28 18:30:28 2025 +0800"
      },
      "message": "fix order dependent test (#6261)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e"
    },
    {
      "commit": "d14a4238dc4710a9dc48f87804e7ac621c9bee19",
      "tree": "8795dbcb074ba7d502430949416190dd62303d98",
      "parents": [
        "dcdd72788a5baa6d61ce1ae1d2351000d9d96485"
      ],
      "author": {
        "name": "MaMengzhen",
        "email": "58206741+MaMengzhen@users.noreply.github.com",
        "time": "Wed Dec 17 10:04:10 2025 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Dec 17 10:04:10 2025 +0800"
      },
      "message": "fix \u0027addCustomHeaders\u0027 header value replace bug (#6257)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e\nCo-authored-by: loongs-zhang \u003czhangzicheng@apache.org\u003e"
    },
    {
      "commit": "dcdd72788a5baa6d61ce1ae1d2351000d9d96485",
      "tree": "335be7b088bf49ba7afde1e8ba4be76af082f9db",
      "parents": [
        "cdd56c659577a12e1fd4952cfe15b40a860ba308"
      ],
      "author": {
        "name": "MaMengzhen",
        "email": "58206741+MaMengzhen@users.noreply.github.com",
        "time": "Sun Dec 14 21:57:05 2025 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Dec 14 21:57:05 2025 +0800"
      },
      "message": "fix NettyHttpClientPlugin doRequest response unique headers error (#6258)\n\nCo-authored-by: aias00 \u003cliuhongyu@apache.org\u003e\nCo-authored-by: loongs-zhang \u003czhangzicheng@apache.org\u003e"
    },
    {
      "commit": "cdd56c659577a12e1fd4952cfe15b40a860ba308",
      "tree": "55b66bd1a453150d0ac5278ad6a58b55e5ca133c",
      "parents": [
        "8df49049061f09217723a0afc3019d4cd123ee7d"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Fri Dec 12 11:16:34 2025 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Dec 12 11:16:34 2025 +0800"
      },
      "message": "feat: Rename ai proxy enhanced module to ai proxy and update related files (#6260)\n\n"
    },
    {
      "commit": "8df49049061f09217723a0afc3019d4cd123ee7d",
      "tree": "61c18432e57e5f920c73ade5f94d51436f03b0bb",
      "parents": [
        "0b3959ce52d8e7a6d38f8ffc6abfa238efdc447f"
      ],
      "author": {
        "name": "shown",
        "email": "yuluo08290126@gmail.com",
        "time": "Thu Dec 11 20:34:39 2025 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Dec 11 20:34:39 2025 +0800"
      },
      "message": "infra: refactor infra zk module (#6199)\n\n"
    },
    {
      "commit": "0b3959ce52d8e7a6d38f8ffc6abfa238efdc447f",
      "tree": "c7e2941ddd7c699d3edc5eec1f23e8e7c8bef1a3",
      "parents": [
        "47c958fa8108b75174723e50560a7b0678d1119c"
      ],
      "author": {
        "name": "MaMengzhen",
        "email": "58206741+MaMengzhen@users.noreply.github.com",
        "time": "Thu Dec 11 19:17:26 2025 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Dec 11 19:17:26 2025 +0800"
      },
      "message": "fix mcp tool sample error (#6259)\n\n"
    },
    {
      "commit": "47c958fa8108b75174723e50560a7b0678d1119c",
      "tree": "55874fffec49e10fa87e7572124a62ab49f13d37",
      "parents": [
        "b984ad2c6d62a269e6628da62954cc4d761beb28"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Thu Dec 11 12:01:00 2025 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Dec 11 12:01:00 2025 +0800"
      },
      "message": "feat: Enhance IpUtils with Docker support, improved IP filtering (#6253)\n\n* feat: Enhance IpUtils with Docker support, improved IP filtering, and logging\n\n* Update shenyu-common/src/main/java/org/apache/shenyu/common/utils/IpUtils.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-common/src/main/java/org/apache/shenyu/common/utils/IpUtils.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-common/src/main/java/org/apache/shenyu/common/utils/IpUtils.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-common/src/main/java/org/apache/shenyu/common/utils/IpUtils.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-common/src/main/java/org/apache/shenyu/common/utils/IpUtils.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Refactor IpUtils to improve null check for filterHost using Objects.nonNull\n\n---------\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e"
    },
    {
      "commit": "b984ad2c6d62a269e6628da62954cc4d761beb28",
      "tree": "6aecc1f81d228204fa7d2153a039e370a69b95cc",
      "parents": [
        "46281cda468d8c72b30ef8e5c2ed9a83e7132af2"
      ],
      "author": {
        "name": "aias00",
        "email": "liuhongyu@apache.org",
        "time": "Mon Dec 08 18:54:04 2025 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Dec 08 18:54:04 2025 +0800"
      },
      "message": "Refactor EtcdClient and RedisConnectionFactory for improved readability and maintainability (#6250)\n\n* Refactor EtcdClient and RedisConnectionFactory for improved readability and maintainability\n\n* Update shenyu-infra/shenyu-infra-redis/src/main/java/org/apache/shenyu/infra/redis/RedisConnectionFactory.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* Update shenyu-infra/shenyu-infra-redis/src/main/java/org/apache/shenyu/infra/redis/RedisConnectionFactory.java\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n* feat: integrate mvnd installation and usage in CI workflows\n\n* fix: handle InterruptedException in EtcdClient and update tests for proper exception throwing\n\n* feat: integrate mvnd installation and usage in CI workflows\n\n* feat: enhance keep-alive mechanism in EtcdClient with exponential backoff retries and add corresponding unit test\n\n* test: add unit tests for keep-alive mechanism in EtcdClient and validate RedisNode parsing\n\n* test: refactor observer registration assertion in EtcdClientTest for improved clarity and reliability\n\n* feat: integrate mvnd installation and usage in CI workflows\n\n* test: refactor RedisConnectionFactoryTest to improve invalid node assertions\n\n* test: enhance assertions in EtcdClientTest for better clarity and reliability\n\n---------\n\nCo-authored-by: Copilot \u003c175728472+Copilot@users.noreply.github.com\u003e"
    }
  ],
  "next": "46281cda468d8c72b30ef8e5c2ed9a83e7132af2"
}