kong

Kong

Fixes

Core

• Applied upstream nginx security patches for limiting the maximum number of headers (CVE-2026-49975). #14895

Kong

Dependencies

Core

• Bumped luarocks from 3.11.1 to 3.12.2. #14672

Fixes

Core

• Applied upstream nginx security patches for CVE-2026-40701, CVE-2026-40460, CVE-2026-42934, CVE-2026-42946, CVE-2026-42945, and CVE-2026-9256. #14882

Kong

Dependencies

Core

• Bumped libexpat from 2.6.2 to 2.6.4 to fix a crash in the XML_ResumeParser function caused by XML_StopParser stopping an uninitialized parser. #14208

• Bump lua-kong-nginx-module from 0.13.0 to 0.13.2 #14047

Features

Plugin

• ai: Added support for boto3 SDKs for the Bedrock provider, and for Google GenAI SDKs for the Gemini provider. #14579

Fixes

Core

• Added support for the new Ollama streaming content type in AI driver. #14579

Plugin

• ai-proxy: Fixed a bug in the Azure provider where model.options.upstream_path overrides would always return a 404 error. #14185

• ai-proxy: Fixed a bug where Azure streaming responses would be missing individual tokens. #14172

• ai-proxy: Fixed a bug where response streaming in Gemini and Bedrock providers was returning whole chat responses in one chunk. #14579

• ai-proxy: Fixed a bug where multimodal requests (in OpenAI format) would not transform properly, when using the Gemini provider. #14579

• ai-proxy: Fixed Gemini streaming responses getting truncated and/or missing tokens. #14579

• ai-proxy: Fixed an incorrect error thrown when trying to log streaming responses. #14579

• ai-proxy: Fixed a issue where tool calls weren't working in streaming mode for the Bedrock and Gemini providers. #14579

• ai-proxy: Fixed an issue where AI Proxy would use corrupted plugin config. #14579

• ai-proxy: Fixed preserve mode. #14579

• AI Plugins: Fixed AI upstream URL trailing being empty. #14578

• AI Plugins: Fixed an issue where the template wasn't being resolved correctly and supported nested fields. #14579

Kong

Deprecations

Core

• node_id in configuration has been deprecated. #13687

Dependencies

Core

• Bumped lua-kong-nginx-module from 0.11.0 to 0.11.1 to fix an issue where the upstream cert chain wasn't properly set. #12752

• Bumped lua-resty-events to 0.3.1. Optimized the memory usage. #13097

• Bumped lua-resty-lmdb to 1.6.0. Allowing page_size to be 1. #13908

• Bumped lua-resty-lmdb to 1.5.0. Added page_size parameter to allow overriding page size from caller side. #12786

Default

• Kong Gateway now supports Ubuntu 24.04 (Noble Numbat) with both open-source and Enterprise packages. #13626

• Bumped rpm dockerfile default base UBI 8 -> 9 #13574

• Bumped lua-resty-aws to 1.5.4 to fix a bug inside region prefix generation. #12846

• Bumped lua-resty-ljsonschema to 1.2.0, adding support for null as a valid option in enum types and properly calculation of utf8 string length instead of byte count #13783

• Bumped ngx_wasm_module to 9136e463a6f1d80755ce66c88c3ddecd0eb5e25d #12011

• Bumped Wasmtime version to 26.0.0 #12011

• Bumped OpenSSL to 3.2.3 to fix unbounded memory growth with session handling in TLSv1.3 and other CVEs. #13448

• Wasm: Removed the experimental datakit Wasm filter #14012

Features

CLI Command

• Added the kong drain CLI command to make the /status/ready endpoint return a 503 Service Unavailable response. #13838

Core

• Added a new feature for Kong Manager that supports multiple domains, enabling dynamic cross-origin access for Admin API requests. #13664

• Added an ADA dependency: WHATWG-compliant and fast URL parser. #13120

• Addded a new LLM driver for interfacing with the Hugging Face inference API. The driver supports both serverless and dedicated LLM instances hosted by Hugging Face for conversational and text generation tasks. #13484

• Increased the priority order of the correlation id to 100001 from 1 so that the plugin can be used with other plugins especially custom auth plugins. #13581

• Added a tls.disable_http2_alpn() function patch for disabling HTTP/2 ALPN when performing a TLS handshake. #13709

• Improved the output of the request debugger:

  • The resolution of field total_time is now in microseconds.
  • A new field, total_time_without_upstream, shows the latency only introduced by Kong. #13460

• proxy-wasm: Added support for Wasm filters to be configured via the /plugins Admin API. #13843

PDK

• Added kong.service.request.clear_query_arg(name) to PDK. #13619

• Array and Map type span attributes are now supported by the tracing PDK #13818

Plugin

• Prometheus: Increased the upper limit of KONG_LATENCY_BUCKETS to 6000 to enhance latency tracking precision. #13588

• ai-proxy: Disabled HTTP/2 ALPN handshake for connections on routes configured with AI-proxy. #13735

• Redirect: Added a new plugin to redirect requests to another location. #13900

• Prometheus: Added support for Proxy-Wasm metrics. #13681

Admin API

• Admin API: Added support for official YAML media-type (application/yaml) to the /config endpoint. #13713

Clustering

• Added a remote procedure call (RPC) framework for Hybrid mode deployments. #12320

Fixes

Core

• Fixed an issue where the ngx.balancer.recreate_request API did not refresh the body buffer when ngx.req.set_body_data is used in the balancer phase. #13882

• Fix to always pass ngx.ctx to log_init_worker_errors as otherwise it may runtime crash. #13731

• Fixed an issue where the workspace ID was not included in the plugin config in the plugins iterator. #13377

• Fixed an issue where the workspace id was not included in the plugin config in the plugins iterator. #13872

• Fixed a 500 error triggered by unhandled nil fields during schema validation. #13861

• Vault: Fixed an issue where array-like configuration fields cannot contain vault reference. #13953

• Vault: Fixed an issue where updating a vault entity in a non-default workspace wouldn't take effect. #13610

• Vault: Fixed an issue where vault reference in kong configuration cannot be dereferenced when both http and stream subsystems are enabled. #13953

• proxy-wasm: Added a check that prevents Kong from starting when the database contains invalid Wasm filters. #13764

• Fixed an issue where the kong.request.enable_buffering couldn't be used when the downstream used HTTP/2. #13614

PDK

• Lined up the kong.log.inspect function to log at notice level as documented #13642

• Fix error message for invalid retries variable #13605

Plugin

• ai-proxy: Fixed a bug where tools (function) calls to Anthropic would return empty results. #13760

• ai-proxy: Fixed a bug where tools (function) calls to Bedrock would return empty results. #13760

• ai-proxy: Fixed a bug where Bedrock Guardrail config was ignored. #13760

• ai-proxy: Fixed a bug where tools (function) calls to Cohere would return empty results. #13760

• ai-proxy: Fixed a bug where Gemini provider would return an error if content safety failed in AI Proxy. #13760

• ai-proxy: Fixed a bug where tools (function) calls to Gemini (or via Vertex) would return empty results. #13760

• ai-proxy: Fixed an issue where AI Transformer plugins always returned a 404 error when using 'Google One' Gemini subscriptions. #13703

• ai-transformers: Fixed a bug where the correct LLM error message was not propagated to the caller. #13703

• AI-Proxy: Fixed an issue where multi-modal requests were blocked on the Azure AI provider. #13702

• Fixed an bug that AI semantic cache can't use request provided models #13627

• AWS-Lambda: Fixed an issue in proxy integration mode that caused an internal server error when the multiValueHeaders was null. #13533

• jwt: ensure rsa_public_key isn't base64-decoded. #13717

• key-auth: Fixed an issue with the order of query arguments, ensuring that arguments retain order when hiding the credentials. #13619

• rate-limiting: Fixed a bug where the returned values from get_redis_connection() were incorrect. #13613

• rate-limiting: Fixed an issue that caused an HTTP 500 error when hide_client_headers was set to true and the request exceeded the rate limit. #13722

Admin API

• Fix for querying admin API entities with empty tags #13723

• Fixed an issue where nested parameters couldn't be parsed correctly when using form-urlencoded requests. #13668

Clustering

• Clustering: Adjusted error log levels for control plane connections. #13863

Default

• Loggly: Fixed an issue where /bin/hostname missing caused an error warning on startup. #13788

Kong-Manager

Fixes

Default

• Kong Manager will now hide the scope change field when creating/editing a scoped plugin from another entity. #297

• Improved the user experience in Kong Manager by fixing various UI-related issues. #277 #283 #286 #287 #288 #291 #293 #295 #298 #302 #304 #306 #309 #317 #319 #322 #325 #329 #330

• Unified the redirection logic in Kong Manager upon entity operations. #289

Kong

Performance

Performance

• Fixed an inefficiency issue in the Luajit hashing algorithm #13240

Core

• Removed unnecessary DNS client initialization #13479

• Improved latency performance when gzipping/gunzipping large data (such as CP/DP config data). #13338

Deprecations

Default

• Debian 10, CentOS 7, and RHEL 7 reached their End of Life (EOL) dates on June 30, 2024. As of version 3.8.0.0 onward, Kong is not building installation packages or Docker images for these operating systems. Kong is no longer providing official support for any Kong version running on these systems. #13468

Dependencies

Core

• Bumped lua-resty-acme to 0.15.0 to support username/password auth with redis. #12909

• Bumped lua-resty-aws to 1.5.3 to fix a bug related to STS regional endpoint. #12846

• Bumped lua-resty-healthcheck from 3.0.1 to 3.1.0 to fix an issue that was causing high memory usage #13038

• Bumped lua-resty-lmdb to 1.4.3 to get fixes from the upstream (lmdb 0.9.33), which resolved numerous race conditions and fixed a cursor issue. #12786

• Bumped lua-resty-openssl to 1.5.1 to fix some issues including a potential use-after-free issue. #12665

• Bumped OpenResty to 1.25.3.2 to improve the performance of the LuaJIT hash computation. #12327

• Bumped PCRE2 to 10.44 to fix some bugs and tidy-up the release (nothing important) #12366

• Introduced a yieldable JSON library lua-resty-simdjson, which would improve the latency significantly. #13421

Default

• Bumped lua-protobuf 0.5.2 #12834

• Bumped LuaRocks from 3.11.0 to 3.11.1 #12662

• Bumped ngx_wasm_module to 96b4e27e10c63b07ed40ea88a91c22f23981db35 #12011

• Bumped Wasmtime version to 23.0.2 #13567

• Made the RPM package relocatable with the default prefix set to /. #13468

Features

Configuration

• Configure Wasmtime module cache when Wasm is enabled #12930

Core

• prometheus: Added ai_requests_total, ai_cost_total and ai_tokens_total metrics in the Prometheus plugin to start counting AI usage. #13148

• Added a new configuration concurrency_limit(integer, default to 1) for Queue to specify the number of delivery timers. Note that setting concurrency_limit to -1 means no limit at all, and each HTTP log entry would create an individual timer for sending. #13332

• Append gateway info to upstream Via header like 1.1 kong/3.8.0, and optionally to response Via header if it is present in the headers config of "kong.conf", like 2 kong/3.8.0, according to RFC7230 and RFC9110. #12733

• Starting from this version, a new DNS client library has been implemented and added into Kong, which is disabled by default. The new DNS client library has the following changes - Introduced global caching for DNS records across workers, significantly reducing the query load on DNS servers. - Introduced observable statistics for the new DNS client, and a new Status API /status/dns to retrieve them. - Simplified the logic and make it more standardized #12305

PDK

• Added 0 to support unlimited body size. When parameter max_allowed_file_size is 0, get_raw_body will return the entire body, but the size of this body will still be limited by Nginx's client_max_body_size. #13431

• Extend kong.request.get_body and kong.request.get_raw_body to read from buffered file #13158

• Added a new PDK module kong.telemetry and function: kong.telemetry.log to generate log entries to be reported via the OpenTelemetry plugin. #13329

Plugin

• acl: Added a new config always_use_authenticated_groups to support using authenticated groups even when an authenticated consumer already exists. #13184

• AI plugins: retrieved latency data and pushed it to logs and metrics. #13428

• Allow AI plugin to read request from buffered file #13158

• AI-proxy-plugin: Add allow_override option to allow overriding the upstream model auth parameter or header from the caller's request. #13158

• AI-proxy-plugin: Replace the lib and use cycle_aware_deep_copy for the request_table object. #13582

• Kong AI Gateway (AI Proxy and associated plugin family) now supports all AWS Bedrock "Converse API" models. #12948

• Kong AI Gateway (AI Proxy and associated plugin family) now supports the Google Gemini "chat" (generateContent) interface. #12948

• ai-proxy: Allowed mistral provider to use mistral.ai managed service by omitting upstream_url #13481

• ai-proxy: Added a new response header X-Kong-LLM-Model that displays the name of the language model used in the AI-Proxy plugin. #13472

• AI-Prompt-Guard: add match_all_roles option to allow match all roles in addition to user. #13183

• "AWS-Lambda: Added support for a configurable STS endpoint with the new configuration field aws_sts_endpoint_url. #13388

• AWS-Lambda: A new configuration field empty_arrays_mode is now added to control whether Kong should send [] empty arrays (returned by Lambda function) as [] empty arrays or {} empty objects in JSON responses.` #13084

• Added support for json_body rename in response-transformer plugin #13131

• OpenTelemetry: Added support for OpenTelemetry formatted logs. #13291

• standard-webhooks: Added standard webhooks plugin. #12757

• Request-Transformer: Fixed an issue where renamed query parameters, url-encoded body parameters, and json body parameters were not handled properly when target name is the same as the source name in the request. #13358

Admin API

• Added support for brackets syntax for map fields configuration via the Admin API #13313

Fixes

CLI Command

• Fixed an issue where some debug level error logs were not being displayed by the CLI. #13143

Configuration

• Re-enabled the Lua DNS resolver from proxy-wasm by default. #13424

Core

• Fixed an issue where luarocks-admin was not available in /usr/local/bin. #13372

• Fixed an issue where 'read' was not always passed to Postgres read-only database operations. #13530

• Deprecated shorthand fields don't take precedence over replacement fields when both are specified. #13486

• Fixed an issue where lua-nginx-module context was cleared when ngx.send_header() triggered filter_finalize openresty/lua-nginx-module#2323. #13316

• Changed the way deprecated shorthand fields are used with new fields. If the new field contains null it allows for deprecated field to overwrite it if both are present in the request. #13592

• Fixed an issue where unnecessary uninitialized variable error log is reported when 400 bad requests were received. #13201

• Fixed an issue where the URI captures are unavailable when the first capture group is absent. #13024

• Fixed an issue where the priority field can be set in a traditional mode route When 'router_flavor' is configured as 'expressions'. #13142

• Fixed an issue where setting tls_verify to false didn't override the global level proxy_ssl_verify. #13470

• Fixed an issue where the sni cache isn't invalidated when a sni is updated. #13165

• The kong.logrotate configuration file will no longer be overwritten during upgrade. When upgrading, set the environment variable DEBIAN_FRONTEND=noninteractive on Debian/Ubuntu to avoid any interactive prompts and enable fully automatic upgrades. #13348

• Fixed an issue where the Vault secret cache got refreshed during resurrect_ttl time and could not be fetched by other workers. #13561

• Error logs during Vault secret rotation are now logged at the notice level instead of warn. #13540

• Fix a bug that the host_header attribute of upstream entity can not be set correctly in requests to upstream as Host header when retries to upstream happen. #13135

• Moved internal Unix sockets to a subdirectory (sockets) of the Kong prefix. #13409

• Changed the behaviour of shorthand fields that are used to describe deprecated fields. If both fields are sent in the request and their values mismatch - the request will be rejected. #13594

• Reverted DNS client to original behaviour of ignoring ADDITIONAL SECTION in DNS responses. #13278

• Shortened names of internal Unix sockets to avoid exceeding the socket name limit. #13571

PDK

• PDK: Fixed a bug that log serializer will log upstream_status as nil in the requests that contains subrequest #12953

• Vault: Reference ending with slash when parsed should not return a key. #13538

• Fixed an issue that pdk.log.serialize() will throw an error when JSON entity set by serialize_value contains json.null #13376

Plugin

• AI-proxy-plugin: Fixed a bug where certain Azure models would return partial tokens/words when in response-streaming mode. #13000

• AI-Transformer-Plugins: Fixed a bug where cloud identity authentication …

Kong

Performance

Performance

• Fixed an inefficiency issue in the Luajit hashing algorithm #13240

Kong

Performance

Performance

• Improved proxy performance by refactoring internal hooking mechanism. #12784

• Sped up the router matching when the router_flavor is traditional_compatible or expressions. #12467

Plugin

• Opentelemetry: Increased queue max batch size to 200. #12488

Breaking Changes

Plugin

• AI Proxy: To support the new messages API of Anthropic, the upstream path of the Anthropic for llm/v1/chat route type has changed from /v1/complete to /v1/messages. #12699

Dependencies

Core

• Bumped atc-router from v1.6.0 to v1.6.2 #12231

• Bumped libexpat to 2.6.2 #12910

• Bumped lua-kong-nginx-module from 0.8.0 to 0.11.0 #12752

• Bumped lua-protobuf to 0.5.1 #12834

• Bumped lua-resty-acme to 0.13.0 #12909

• Bumped lua-resty-aws from 1.3.6 to 1.4.1 #12846

• Bumped lua-resty-lmdb from 1.4.1 to 1.4.2 #12786

• Bumped lua-resty-openssl from 1.2.0 to 1.3.1 #12665

• Bumped lua-resty-timer-ng to 0.2.7 #12756

• Bumped PCRE from the legacy libpcre 8.45 to libpcre2 10.43 #12366

• Bumped penlight to 1.14.0 #12862

Default

• Added package tzdata to DEB Docker image for convenient timezone setting. #12609

• Bumped lua-resty-http to 0.17.2. #12908

• Bumped LuaRocks from 3.9.2 to 3.11.0 #12662

• Bumped ngx_wasm_module to 91d447ffd0e9bb08f11cc69d1aa9128ec36b4526 #12011

• Bumped V8 version to 12.0.267.17 #12704

• Bumped Wasmtime version to 19.0.0 #12011

• Improved the robustness of lua-cjson when handling unexpected input. #12904

Features

Configuration

• TLSv1.1 and lower versions are disabled by default in OpenSSL 3.x. #12420

• Introduced nginx_wasm_main_shm_kv configuration parameter, which enables Wasm filters to use the Proxy-Wasm operations get_shared_data and set_shared_data without namespaced keys. #12663

• Schema: Added a deprecation field attribute to identify deprecated fields #12686

• Added the wasm_filters configuration parameter for enabling individual filters #12843

Core

• Added events:ai:response_tokens, events:ai:prompt_tokens and events:ai:requests to the anonymous report to start counting AI usage #12924

• Improved config handling when the CP runs with the router set to the expressions flavor:

  • If mixed config is detected and a lower DP is attached to the CP, no config will be sent at all
  • If the expression is invalid on the CP, no config will be sent at all
  • If the expression is invalid on a lower DP, it will be sent to the DP and DP validation will catch this and communicate back to the CP (this could result in partial config application) #12967

• The route entity now supports the following fields when the router_flavor is expressions: methods, hosts, paths, headers, snis, sources, destinations, and regex_priority. The meaning of these fields are consistent with the traditional route entity. #12667

PDK

• Added the latencies.receive property to the log serializer #12730

Plugin

• AI Proxy now reads most prompt tuning parameters from the client, while the plugin config parameters under model_options are now just defaults. This fixes support for using the respective provider's native SDK. #12903

• AI Proxy now has a preserve option for route_type, where the requests and responses are passed directly to the upstream LLM. This is to enable compatibility with any and all models and SDKs that may be used when calling the AI services. #12903

• Prometheus: Added workspace label to Prometheus plugin metrics. #12836

• AI Proxy: Added support for streaming event-by-event responses back to the client on supported providers. #12792

• AI Prompt Guard: Increased the maximum length of regex expressions to 500 for the allow and deny parameters. #12731

• Addded support for EdDSA algorithms in JWT plugin #12726

• Added support for ES512, PS256, PS384, PS512 algorithms in JWT plugin #12638

• OpenTelemetry, Zipkin: The propagation module has been reworked. The new options allow better control over the configuration of tracing headers propagation. #12670

Default

• Added support for debugging with EmmyLuaDebugger. This feature is a tech preview and not officially supported by Kong Inc. for now. #12899

Fixes

CLI Command

• Fixed an issue where the pg_timeout was overridden to 60s even if --db-timeout was not explicitly passed in CLI arguments. #12981

Configuration

• Fixed the default value in kong.conf.default documentation from 1000 to 10000 for the upstream_keepalive_max_requests option. #12643

• Fixed an issue where an external plugin (Go, Javascript, or Python) would fail to apply a change to the plugin config via the Admin API. #12718

• Disabled usage of the Lua DNS resolver from proxy-wasm by default. #12825

• Set security level of gRPC's TLS to 0 when ssl_cipher_suite is set to old. #12613

Core

• Fixed an issue where POST /config?flatten_errors=1 could not return a proper response if the input included duplicate upstream targets. #12797

• DNS Client: Ignore a non-positive values on resolv.conf for options timeout, and use a default value of 2 seconds instead. #12640

• Updated the file permission of kong.logrotate to 644. #12629

• Fixed a problem on hybrid mode DPs, where a certificate entity configured with a vault reference may not get refreshed on time. #12868

• Fixed the missing router section for the output of the request-debugging. #12234

• Fixed an issue in the internal caching logic where mutexes could get never unlocked. #12743

• Fixed an issue where the router didn't work correctly when the route's configuration changed. #12654

• Fixed an issue where SNI-based routing didn't work using tls_passthrough and the traditional_compatible router flavor. #12681

• Fixed a bug that X-Kong-Upstream-Status didn't appear in the response headers even if it was set in the headers parameter in the kong.conf file when the response was hit and returned by the Proxy Cache plugin. #12744

• Fixed vault initialization by postponing vault reference resolving on init_worker #12554

• Fixed a bug that allowed vault secrets to refresh even when they had no TTL set. #12877

• Vault: do not use incorrect (default) workspace identifier when retrieving vault entity by prefix #12572

• Core: Fixed unexpected table nil panic in the balancer's stop_healthchecks function #12865

• Use -1 as the worker ID of privileged agent to avoid access issues. #12385

• Plugin Server: Fixed an issue where Kong failed to properly restart MessagePack-based pluginservers (used in Python and Javascript plugins, for example). #12582

• Reverted the hard-coded limitation of the ngx.read_body() API in OpenResty upstreams' new versions when downstream connections are in HTTP/2 or HTTP/3 stream modes. #12658

• Each Kong cache instance now utilizes its own cluster event channel. This approach isolates cache invalidation events and reducing the generation of unnecessary worker events. #12321

• Updated telemetry collection for AI Plugins to allow multiple plugins data to be set for the same request. #12583

PDK

• PDK: Fixed kong.request.get_forwarded_port to always return a number, which was caused by an incorrectly stored string value in ngx.ctx.host_port. #12806

• The value of latencies.kong in the log serializer payload no longer includes the response receive time, so it now has the same value as the X-Kong-Proxy-Latency response header. Response receive time is recorded in the new latencies.receive metric, so if desired, the old value can be calculated as latencies.kong + latencies.receive. Note: this also affects payloads from all logging plugins that use the log serializer: file-log, tcp-log, udp-log,http-log, syslog, and loggly, e.g. descriptions of JSON objects for the HTTP Log Plugin's log format. #12795

• Tracing: enhanced robustness of trace ID parsing #12848

Plugin

• AI-proxy-plugin: Fixed the bug that the route_type /llm/v1/chat didn't include the analytics in the responses. #12781

• ACME: Fixed an issue where the certificate was not successfully renewed during ACME renewal. #12773

• AWS-Lambda: Fixed an issue where the latency attributed to AWS Lambda API requests was counted as part of the latency in Kong. #12835

• Jwt: Fixed an issue where the plugin would fail when using invalid public keys for ES384 and ES512 algorithms. #12724

• Added WWW-Authenticate headers to all 401 responses in the Key Auth plugin. #11794 …

Kong

Performance

Plugin

• Opentelemetry: increase queue max batch size to 200 #12542

Dependencies

Core

• Bumped lua-resty-openssl to 1.2.1 #12669

Features

Configuration

• now TLSv1.1 and lower is by default disabled in OpenSSL 3.x #12556

Fixes

Configuration

• Fixed default value in kong.conf.default documentation from 1000 to 10000 for upstream_keepalive_max_requests option. #12648

• Set security level of gRPC's TLS to 0 when ssl_cipher_suite is set to old #12616

Core

• Fix the missing router section for the output of the request-debugging #12649

• revert the hard-coded limitation of the ngx.read_body() API in OpenResty upstreams' new versions when downstream connections are in HTTP/2 or HTTP/3 stream modes. #12666

Default

• Fix a bug where the ulimit setting (open files) is low Kong will fail to start as the lua-resty-timer-ng exhausts the available worker_connections. Decrease the concurrency range of the lua-resty-timer-ng library from [512, 2048] to [256, 1024] to fix this bug. #12608

Kong-Manager