Project: Kong (Orchestration & Management / API Gateway)
File: 3.6.0.md

Bumped the concurrency range of the lua-resty-timer-ng library from [32, 256] to [512, 2048]. Cooperatively yield when building statistics of routes to reduce the impact to proxy path latency. Bump `dnsstalettl` default to 1 hour so stale DNS record can be used for longer time in case of resolver downtime. Bumped default values of `nginxhttpkeepaliverequests` and `upstreamkeepalivemaxrequests` to `10000`. These changes are optimized to work better in systems with high throughput. In a low-throughput setting, these new settings may have visible effects in loadbalancing - it can take more requests to start using all the upstreams than before. Reuse match context between requests to avoid frequent memory allocation/deallocation Performance optimization to avoid unnecessary creations and garbage-collections of spans BREAKING: To avoid ambiguity with other Wasm-related nginx.conf directives, the prefix for Wasm `shmkv` nginx.conf directives was changed from `nginxwasmshm` to `nginxwasmshmkv` In OpenSSL 3.2, the default SSL/TLS security level has been changed from 1 to 2. Which means security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled. azure-functions: azure-functions plugin now eliminates upstream/request URI and only use `routeprefix` configuration field to construct request path when requesting Azure API ACME: Standardize redis configuration across plugins. The redis configuration right now follows common schema that is shared across other plugins. Rate Limiting: Standardize redis configuration across plugins. The redis configuration right now follows common schema that is shared across other plugins. Response-RateLimiting: Standardize redis configuration across plugins. The redis configuration right now follows common schema that is shared across other plugins. Bumped atc-router from 1.2.0 to 1.6.0 Bumped kong-lapis from 1.14.0.3 to 1.16.0.1 Bumped LPEG from 1.0.2 to 1.1.0 Bumped lua-messagepack from 0.5.2 to 0.5.3 Bumped lua-messagepack from 0.5.3 to 0.5.4 Bumped lua-resty-aws from 1.3.5 to 1.3.6 Bumped lua-resty-healthcheck from 3.0.0 to 3.0.1 Bumped lua-resty-lmdb from 1.3.0 to 1.4.1 Bumped lua-resty-timer-ng from 0.2.5 to 0.2.6 Bumped OpenResty from 1.21.4.2 to 1.25.3.1 Bumped OpenSSL from 3.1.4 to 3.2.1 Bump resty-openssl from 0.8.25 to 1.2.0 Bumped ngx_brotli to master branch, and disabled it on rhel7 rhel9-arm64 and amazonlinux-2023-arm64 due to toolchain issues Bumped lua-resty-healthcheck from 1.6.3 to 3.0.0 Bump `ngxwasmmodule` to `a7087a37f0d423707366a694630f1e09f4c21728` Bump `Wasmtime` version to

display a warning message when Kong Manager is enabled but the Admin API is not enabled add DHE-RSA-CHACHA20-POLY1305 cipher to the intermediate configuration The default value of `dnsnosync` option has been changed to `off` Allow to inject Nginx directives into Kong's proxy location block Validate LMDB cache by Kong's version (major + minor), wiping the content if tag mismatch to avoid compatibility issues during minor version upgrade. Adds telemetry collection for AI Proxy, AI Request Transformer, and AI Response Transformer, pertaining to model and provider usage. add ngx_brotli module to kong prebuild nginx Allow primary key passed as a full entity to DAO functions. Build deb packages for Debian 12. The debian variant of kong docker image is built using Debian 12 now. The expressions route now supports the `!` (not) operator, which allows creating routes like `!(http.path =^ "/a")` and `!(http.path == "/a" || http.path == "/b")` Add `source` property to log serializer, indicating the response is generated by `kong` or `upstream`. Ensure Kong-owned directories are cleaned up after an uninstall using the system's package manager. Support `http.path.segments.len` and `http.path.segments.*` fields in the expressions router which allows matching incoming (normalized) request path by individual segment or ranges of segments, plus checking the total number of segments. `net.src.` and `net.dst.` match fields are now accessible in HTTP routes defined using expressions. Extend support for getting and setting Gateway values via proxy-wasm properties in the `kong.*` namespace. Increase the precision of JSON number encoding from 14 to 16 decimals Introduced the new AI Prompt Decorator plugin that enables prepending and appending llm/v1/chat messages onto consumer LLM requests, for prompt tuning. Introduced the new AI Prompt Guard which can allow and/or block LLM requests based on pattern matching. Introduced the new AI Prompt Template which can offer consumers and array of LLM prompt templates, with variable substitutions. Introduced the new AI Proxy plugin that enables simplified integration with various AI provider Large Language Models. Introduced the new AI Request Transformer plugin that enables passing mid-flight consumer requests to an LLM for transformation or sanitization. Introduced the new AI Response Transformer plugin that enables passing mid-flight upstream responses to an LLM for transformation or sanitization. Tracing Sampling Rate can now be set via the `config.sampling_rate` property of the OpenTelemetry plugin instead of it just being a global setting for the gateway. add gateway edition to the root endpoint of the admin api Enable `status_listen` on `127.0.0.1:8007` by default Clustering: Expose data plane certificate expiry date on the control plane

fix error data loss caused by weakly typed of function in declarativeconfigflattened function respect custom `proxyaccesslog` prevent ca to be deleted when it's still referenced by other entities and invalidate the related ca store caches when a ca cert is updated. Now cookie names are validated against RFC 6265, which allows more characters than the previous validation. Remove nulls only if the schema has transformations definitions. Improve performance as most schemas does not define transformations. Fix a bug that the error_handler can not provide the meaningful response body when the internal error code 494 is triggered. Header value matching (`http.headers.*`) in `expressions` router flavor are now case sensitive. This change does not affect on `traditional_compatible` mode where header value match are always performed ignoring the case. print error message correctly when plugin fails fix ldoc intermittent failure caused by LuaJIT error. use NGXWASMMODULEBRANCH environment variable to set ngxwasm_module repository branch when building Kong. Eliminate asynchronous timer in syncQuery() to prevent hang risk tracing: Fixed an issue where a DNS query failure would cause a tracing failure. Expressions route in `http` and `stream` subsystem now have stricter validation. Previously they share the same validation schema which means admin can configure expressions route using fields like `http.path` even for stream routes. This is no longer allowed. Tracing: dns spans are now correctly generated for upstream dns queries (in addition to cosocket ones) Validate private and public key for `keys` entity to ensure they match each other. proxy-wasm: Fixed "previous plan already attached" error thrown when a filter triggers re-entrancy of the access handler. response.set_header support header argument with table array of string Fix an issue that when using kong.response.exit, the Transfer-Encoding header set by user is not removed Plugin Server: fix an issue where every request causes a new plugin instance to be created Add missing WWW-Authenticate headers to 401 response in basic auth plugin. Enhance error responses for authentication failures in the Admin API Expose metrics for serviceless routes Rate Limiting: fix to provide better accuracy in counters when sync_rate is used with the redis policy. Rate Limiting: fix an issuer where all counters are synced to the same DB at the same rate. Datadog: Fix a bug that datadog plugin is not triggered for serviceless routes. In this fix, datadog plugin is always triggered, and the value of tag `name`(service_name) is set as an empty value. Fix a bug causing data-plane status updates to fail when an empty PING frame is received from a data-plane Added a JSON/YAML format preview for all entity forms. Adopted resigned basic components for better UI/UX. Kong Manager and Konnect now share the same UI for plugin selection page and plugin form page. Standardized notification text format.