Project: Kong (Orchestration & Management / API Gateway)
File: 3.5.0.md

Bumped the default value of `upstreamkeepalivepoolsize` to `512` and `upstreamkeepalivemaxrequests` to `1000` refactor workspace id and name retrieval Session: a new configuration field `readbodyforlogout` was added with a default value of `false`, that changes behavior of `logoutpostarg` in a way that it is not anymore considered if the `readbodyforlogout` is not explicitly set to `true`. This is to avoid session plugin from reading request bodies by default on e.g. `POST` request for logout detection. Bumped resty.openssl from 0.8.23 to 0.8.25 Fix incorrect LuaJIT register allocation for IR_*LOAD on ARM64 Fix LDP/STP fusing for unaligned accesses on ARM64 Bump lua-kong-nginx-module from 0.6.0 to 0.8.0 Fix incorrect LuaJIT LDP/STP fusion on ARM64 which may sometimes cause incorrect logic Bumped lua-resty-healthcheck from 1.6.2 to 1.6.3 Bumped OpenResty from 1.21.4.1 to 1.21.4.2 Bumped LuaSec from 1.3.1 to 1.3.2 Bumped lua-resty-aws from 1.3.1 to 1.3.5 bump OpenSSL from 3.1.1 to 3.1.4 Bumped kong-lapis from 1.14.0.2 to 1.14.0.3 Bumped ngxwasmmodule to latest rolling release version. Bump Wasmtime version to 12.0.2 Bumped lua-resty-aws from 1.3.0 to 1.3.1 Bumped lua-resty-session from 4.0.4 to 4.0.5 Add a new endpoint `/schemas/vaults/:name` to retrieve the schema of a vault. rename `privilegedagent` to `dedicatedconfigprocessing. Enable `dedicatedconfig_processing` by default Support observing the time consumed by some components in the given request. Plugins can now implement `Plugin:configure(configs)` function that is called whenever there is a change in plugin entities. An array of current plugin configurations is passed to the function, or `nil` in case there is no active configurations for the plugin. Add a request-aware table able to detect accesses from different requests. A unique Request ID is now populated in the error log, access log, error templates, log serializer, and in a new X-Kong-Request-Id header (configurable for upstream/downstream using the `headers` and `headers_upstream` configuration options). Add support for optional Wasm filter configuration schemas Support JSON in Wasm filter configuration Support HTTP query parameters in expression routes. response-ratelimiting: add support for secret rotation with redis connection CORS: Support the `Access-Control-Request-Private-Network` header in crossing-origin pre-light requests add scan_count to redis storage schema AWS-Lambda: the AWS-Lambda plugin has been refactored by using `lua-resty-aws` as an underlying AWS library. The refactor simplifies the AWS-Lambda plugin code base and adding support for multiple IAM authenticating scenarios. OpenTelemetry and Zipkin: Support GCP X-Cloud-Trace-Context header The field `header_type` now accepts the value `gcp` to propagate the Google Cloud trace header Clustering: Allow configuring DP metadata labels for on-premise CP Gateway The default value of `dnsnosync` option has been changed to `on` Fix an issue that the TTL of the key-auth plugin didnt work in DB-less and Hybrid mode. Fix a problem that abnormal socket connection will be reused when querying Postgres database. Fix upstream ssl failure when plugins use response handler Fix an issue that protocol `tls_passthrough` can not work with expressions flavor Fix a bug that will cause a failure of sending tracing data to datadog when value of x-datadog-parent-id header in requests is a short dec string Apply Nginx patch for detecting HTTP/2 stream reset attacks early (CVE-2023-44487) fix the building failure when applying patches Vault references can be used in Dbless mode in declarative config Properly warmup Vault caches on init Vault resurrect time is respected in case a vault secret is deleted from a vault Fixed critical level logs when starting external plugin

Those logs cannot be suppressed due to the limitation of OpenResty. We choose to remove the socket availability detection feature. Fix an issue where a crashing Go plugin server process would cause subsequent requests proxied through Kong to execute Go plugins with inconsistent configurations. The issue only affects scenarios where the same Go plugin is applied to different Route or Service entities. Fix an issue where clustercert or clustercacert is inserted into luassltrustedcertificate before being base64 decoded. Fix cache warmup mechanism not working in `acls` plugin groups config entity scenario. Fix an issue that queue stops processing when a hard error is encountered in the handler function. Fix an issue that query parameters are not forwarded in proxied request. Thanks for contributing this change. Fix an issue that response status code is not real upstream status when using kong.response function. Removed a hardcoded proxy-wasm isolation level setting that was preventing the `nginxhttpproxywasmisolation` configuration value from taking effect. Fix several issues in Vault and refactor the Vault code base: - Make DAOs to fallback to empty string when resolving Vault references fail - Use node level mutex when rotation references - Refresh references on config changes - Update plugin referenced values only once per request - Pass only the valid config options to vault implementations - Resolve multi-value secrets only once when rotating them - Do not start vault secrets rotation timer on control planes - Re-enable negative caching - Reimplement the kong.vault.try function - Remove references from rotation in case their configuration has changed Fix response body gets repeated when `kong.response.getrawbody()` is called multiple times in a request lifecycle. Tracing: fix an issue that resulted in some parent spans to end before their children due to different precision of their timestamps Fix a bug related to data interference between requests in the kong.log.serialize function. Opentelemetry: fix an issue that resulted in invalid parent IDs in the propagated tracing headers AWS-Lambda: let plugin-level proxy take effect on EKS IRSA credential provider Cache the AWS lambda service by those lambda service related fields Opentelemetry: fix an issue that resulted in traces with invalid parent IDs when `balancer` instrumentation was enabled tcp-log: fix an issue of unnecessary handshakes when reusing TLS connection OAuth2: For OAuth2 plugin, `scope` has been taken into account as a new criterion of the request validation. When refreshing token with `refreshtoken`, the scopes associated with the `refreshtoken` provided in the request must be same with or a subset of the scopes configured in the OAuth2 plugin instance hit by the request. When the worker is in shutdown mode and more data is immediately available without waiting for `maxcoalescingdelay`, queues are now cleared in batches. Thanks for contributing this change. A race condition in the plugin queue could potentially crash the worker when `maxentries` was set to `maxbatch_size`. AWS-Lambda: fix an issue that the AWS-Lambda plugin cannot extract a json encoded proxy integration response. Restore lapis & luarocks-admin bins Add `JSON` and `YAML` formats in entity config cards. Plugin form fields now display descriptions from backend schema. Add the `protocols` field in plugin form. The upstream target list shows the `Mark Healthy` and `Mark Unhealthy` action items when certain conditions are met. Fix incorrect port number in Port Details. Fix a bug where the `proxy-cache` plugin cannot be installed.