kong 3.7.0

Kong

Performance

Performance

• Improved proxy performance by refactoring internal hooking mechanism. #12784

• Sped up the router matching when the router_flavor is traditional_compatible or expressions. #12467

Plugin

• Opentelemetry: Increased queue max batch size to 200. #12488

Breaking Changes

Plugin

• AI Proxy: To support the new messages API of Anthropic, the upstream path of the Anthropic for llm/v1/chat route type has changed from /v1/complete to /v1/messages. #12699

Dependencies

Core

• Bumped atc-router from v1.6.0 to v1.6.2 #12231

• Bumped libexpat to 2.6.2 #12910

• Bumped lua-kong-nginx-module from 0.8.0 to 0.11.0 #12752

• Bumped lua-protobuf to 0.5.1 #12834

• Bumped lua-resty-acme to 0.13.0 #12909

• Bumped lua-resty-aws from 1.3.6 to 1.4.1 #12846

• Bumped lua-resty-lmdb from 1.4.1 to 1.4.2 #12786

• Bumped lua-resty-openssl from 1.2.0 to 1.3.1 #12665

• Bumped lua-resty-timer-ng to 0.2.7 #12756

• Bumped PCRE from the legacy libpcre 8.45 to libpcre2 10.43 #12366

• Bumped penlight to 1.14.0 #12862

Default

• Added package tzdata to DEB Docker image for convenient timezone setting. #12609

• Bumped lua-resty-http to 0.17.2. #12908

• Bumped LuaRocks from 3.9.2 to 3.11.0 #12662

• Bumped ngx_wasm_module to 91d447ffd0e9bb08f11cc69d1aa9128ec36b4526 #12011

• Bumped V8 version to 12.0.267.17 #12704

• Bumped Wasmtime version to 19.0.0 #12011

• Improved the robustness of lua-cjson when handling unexpected input. #12904

Features

Configuration

• TLSv1.1 and lower versions are disabled by default in OpenSSL 3.x. #12420

• Introduced nginx_wasm_main_shm_kv configuration parameter, which enables Wasm filters to use the Proxy-Wasm operations get_shared_data and set_shared_data without namespaced keys. #12663

• Schema: Added a deprecation field attribute to identify deprecated fields #12686

• Added the wasm_filters configuration parameter for enabling individual filters #12843

Core

• Added events:ai:response_tokens, events:ai:prompt_tokens and events:ai:requests to the anonymous report to start counting AI usage #12924

• Improved config handling when the CP runs with the router set to the expressions flavor:

  • If mixed config is detected and a lower DP is attached to the CP, no config will be sent at all
  • If the expression is invalid on the CP, no config will be sent at all
  • If the expression is invalid on a lower DP, it will be sent to the DP and DP validation will catch this and communicate back to the CP (this could result in partial config application) #12967

• The route entity now supports the following fields when the router_flavor is expressions: methods, hosts, paths, headers, snis, sources, destinations, and regex_priority. The meaning of these fields are consistent with the traditional route entity. #12667

PDK

• Added the latencies.receive property to the log serializer #12730

Plugin

• AI Proxy now reads most prompt tuning parameters from the client, while the plugin config parameters under model_options are now just defaults. This fixes support for using the respective provider's native SDK. #12903

• AI Proxy now has a preserve option for route_type, where the requests and responses are passed directly to the upstream LLM. This is to enable compatibility with any and all models and SDKs that may be used when calling the AI services. #12903

• Prometheus: Added workspace label to Prometheus plugin metrics. #12836

• AI Proxy: Added support for streaming event-by-event responses back to the client on supported providers. #12792

• AI Prompt Guard: Increased the maximum length of regex expressions to 500 for the allow and deny parameters. #12731

• Addded support for EdDSA algorithms in JWT plugin #12726

• Added support for ES512, PS256, PS384, PS512 algorithms in JWT plugin #12638

• OpenTelemetry, Zipkin: The propagation module has been reworked. The new options allow better control over the configuration of tracing headers propagation. #12670

Default

• Added support for debugging with EmmyLuaDebugger. This feature is a tech preview and not officially supported by Kong Inc. for now. #12899

Fixes

CLI Command

• Fixed an issue where the pg_timeout was overridden to 60s even if --db-timeout was not explicitly passed in CLI arguments. #12981

Configuration

• Fixed the default value in kong.conf.default documentation from 1000 to 10000 for the upstream_keepalive_max_requests option. #12643

• Fixed an issue where an external plugin (Go, Javascript, or Python) would fail to apply a change to the plugin config via the Admin API. #12718

• Disabled usage of the Lua DNS resolver from proxy-wasm by default. #12825

• Set security level of gRPC's TLS to 0 when ssl_cipher_suite is set to old. #12613

Core

• Fixed an issue where POST /config?flatten_errors=1 could not return a proper response if the input included duplicate upstream targets. #12797

• DNS Client: Ignore a non-positive values on resolv.conf for options timeout, and use a default value of 2 seconds instead. #12640

• Updated the file permission of kong.logrotate to 644. #12629

• Fixed a problem on hybrid mode DPs, where a certificate entity configured with a vault reference may not get refreshed on time. #12868

• Fixed the missing router section for the output of the request-debugging. #12234

• Fixed an issue in the internal caching logic where mutexes could get never unlocked. #12743

• Fixed an issue where the router didn't work correctly when the route's configuration changed. #12654

• Fixed an issue where SNI-based routing didn't work using tls_passthrough and the traditional_compatible router flavor. #12681

• Fixed a bug that X-Kong-Upstream-Status didn't appear in the response headers even if it was set in the headers parameter in the kong.conf file when the response was hit and returned by the Proxy Cache plugin. #12744

• Fixed vault initialization by postponing vault reference resolving on init_worker #12554

• Fixed a bug that allowed vault secrets to refresh even when they had no TTL set. #12877

• Vault: do not use incorrect (default) workspace identifier when retrieving vault entity by prefix #12572

• Core: Fixed unexpected table nil panic in the balancer's stop_healthchecks function #12865

• Use -1 as the worker ID of privileged agent to avoid access issues. #12385

• Plugin Server: Fixed an issue where Kong failed to properly restart MessagePack-based pluginservers (used in Python and Javascript plugins, for example). #12582

• Reverted the hard-coded limitation of the ngx.read_body() API in OpenResty upstreams' new versions when downstream connections are in HTTP/2 or HTTP/3 stream modes. #12658

• Each Kong cache instance now utilizes its own cluster event channel. This approach isolates cache invalidation events and reducing the generation of unnecessary worker events. #12321

• Updated telemetry collection for AI Plugins to allow multiple plugins data to be set for the same request. #12583

PDK

• PDK: Fixed kong.request.get_forwarded_port to always return a number, which was caused by an incorrectly stored string value in ngx.ctx.host_port. #12806

• The value of latencies.kong in the log serializer payload no longer includes the response receive time, so it now has the same value as the X-Kong-Proxy-Latency response header. Response receive time is recorded in the new latencies.receive metric, so if desired, the old value can be calculated as latencies.kong + latencies.receive. Note: this also affects payloads from all logging plugins that use the log serializer: file-log, tcp-log, udp-log,http-log, syslog, and loggly, e.g. descriptions of JSON objects for the HTTP Log Plugin's log format. #12795

• Tracing: enhanced robustness of trace ID parsing #12848

Plugin

• AI-proxy-plugin: Fixed the bug that the route_type /llm/v1/chat didn't include the analytics in the responses. #12781

• ACME: Fixed an issue where the certificate was not successfully renewed during ACME renewal. #12773

• AWS-Lambda: Fixed an issue where the latency attributed to AWS Lambda API requests was counted as part of the latency in Kong. #12835

• Jwt: Fixed an issue where the plugin would fail when using invalid public keys for ES384 and ES512 algorithms. #12724

• Added WWW-Authenticate headers to all 401 responses in the Key Auth plugin. #11794 …