kong 3.8.0

Kong

Performance

Performance

• Fixed an inefficiency issue in the Luajit hashing algorithm #13240

Core

• Removed unnecessary DNS client initialization #13479

• Improved latency performance when gzipping/gunzipping large data (such as CP/DP config data). #13338

Deprecations

Default

• Debian 10, CentOS 7, and RHEL 7 reached their End of Life (EOL) dates on June 30, 2024. As of version 3.8.0.0 onward, Kong is not building installation packages or Docker images for these operating systems. Kong is no longer providing official support for any Kong version running on these systems. #13468

Dependencies

Core

• Bumped lua-resty-acme to 0.15.0 to support username/password auth with redis. #12909

• Bumped lua-resty-aws to 1.5.3 to fix a bug related to STS regional endpoint. #12846

• Bumped lua-resty-healthcheck from 3.0.1 to 3.1.0 to fix an issue that was causing high memory usage #13038

• Bumped lua-resty-lmdb to 1.4.3 to get fixes from the upstream (lmdb 0.9.33), which resolved numerous race conditions and fixed a cursor issue. #12786

• Bumped lua-resty-openssl to 1.5.1 to fix some issues including a potential use-after-free issue. #12665

• Bumped OpenResty to 1.25.3.2 to improve the performance of the LuaJIT hash computation. #12327

• Bumped PCRE2 to 10.44 to fix some bugs and tidy-up the release (nothing important) #12366

• Introduced a yieldable JSON library lua-resty-simdjson, which would improve the latency significantly. #13421

Default

• Bumped lua-protobuf 0.5.2 #12834

• Bumped LuaRocks from 3.11.0 to 3.11.1 #12662

• Bumped ngx_wasm_module to 96b4e27e10c63b07ed40ea88a91c22f23981db35 #12011

• Bumped Wasmtime version to 23.0.2 #13567

• Made the RPM package relocatable with the default prefix set to /. #13468

Features

Configuration

• Configure Wasmtime module cache when Wasm is enabled #12930

Core

• prometheus: Added ai_requests_total, ai_cost_total and ai_tokens_total metrics in the Prometheus plugin to start counting AI usage. #13148

• Added a new configuration concurrency_limit(integer, default to 1) for Queue to specify the number of delivery timers. Note that setting concurrency_limit to -1 means no limit at all, and each HTTP log entry would create an individual timer for sending. #13332

• Append gateway info to upstream Via header like 1.1 kong/3.8.0, and optionally to response Via header if it is present in the headers config of "kong.conf", like 2 kong/3.8.0, according to RFC7230 and RFC9110. #12733

• Starting from this version, a new DNS client library has been implemented and added into Kong, which is disabled by default. The new DNS client library has the following changes - Introduced global caching for DNS records across workers, significantly reducing the query load on DNS servers. - Introduced observable statistics for the new DNS client, and a new Status API /status/dns to retrieve them. - Simplified the logic and make it more standardized #12305

PDK

• Added 0 to support unlimited body size. When parameter max_allowed_file_size is 0, get_raw_body will return the entire body, but the size of this body will still be limited by Nginx's client_max_body_size. #13431

• Extend kong.request.get_body and kong.request.get_raw_body to read from buffered file #13158

• Added a new PDK module kong.telemetry and function: kong.telemetry.log to generate log entries to be reported via the OpenTelemetry plugin. #13329

Plugin

• acl: Added a new config always_use_authenticated_groups to support using authenticated groups even when an authenticated consumer already exists. #13184

• AI plugins: retrieved latency data and pushed it to logs and metrics. #13428

• Allow AI plugin to read request from buffered file #13158

• AI-proxy-plugin: Add allow_override option to allow overriding the upstream model auth parameter or header from the caller's request. #13158

• AI-proxy-plugin: Replace the lib and use cycle_aware_deep_copy for the request_table object. #13582

• Kong AI Gateway (AI Proxy and associated plugin family) now supports all AWS Bedrock "Converse API" models. #12948

• Kong AI Gateway (AI Proxy and associated plugin family) now supports the Google Gemini "chat" (generateContent) interface. #12948

• ai-proxy: Allowed mistral provider to use mistral.ai managed service by omitting upstream_url #13481

• ai-proxy: Added a new response header X-Kong-LLM-Model that displays the name of the language model used in the AI-Proxy plugin. #13472

• AI-Prompt-Guard: add match_all_roles option to allow match all roles in addition to user. #13183

• "AWS-Lambda: Added support for a configurable STS endpoint with the new configuration field aws_sts_endpoint_url. #13388

• AWS-Lambda: A new configuration field empty_arrays_mode is now added to control whether Kong should send [] empty arrays (returned by Lambda function) as [] empty arrays or {} empty objects in JSON responses.` #13084

• Added support for json_body rename in response-transformer plugin #13131

• OpenTelemetry: Added support for OpenTelemetry formatted logs. #13291

• standard-webhooks: Added standard webhooks plugin. #12757

• Request-Transformer: Fixed an issue where renamed query parameters, url-encoded body parameters, and json body parameters were not handled properly when target name is the same as the source name in the request. #13358

Admin API

• Added support for brackets syntax for map fields configuration via the Admin API #13313

Fixes

CLI Command

• Fixed an issue where some debug level error logs were not being displayed by the CLI. #13143

Configuration

• Re-enabled the Lua DNS resolver from proxy-wasm by default. #13424

Core

• Fixed an issue where luarocks-admin was not available in /usr/local/bin. #13372

• Fixed an issue where 'read' was not always passed to Postgres read-only database operations. #13530

• Deprecated shorthand fields don't take precedence over replacement fields when both are specified. #13486

• Fixed an issue where lua-nginx-module context was cleared when ngx.send_header() triggered filter_finalize openresty/lua-nginx-module#2323. #13316

• Changed the way deprecated shorthand fields are used with new fields. If the new field contains null it allows for deprecated field to overwrite it if both are present in the request. #13592

• Fixed an issue where unnecessary uninitialized variable error log is reported when 400 bad requests were received. #13201

• Fixed an issue where the URI captures are unavailable when the first capture group is absent. #13024

• Fixed an issue where the priority field can be set in a traditional mode route When 'router_flavor' is configured as 'expressions'. #13142

• Fixed an issue where setting tls_verify to false didn't override the global level proxy_ssl_verify. #13470

• Fixed an issue where the sni cache isn't invalidated when a sni is updated. #13165

• The kong.logrotate configuration file will no longer be overwritten during upgrade. When upgrading, set the environment variable DEBIAN_FRONTEND=noninteractive on Debian/Ubuntu to avoid any interactive prompts and enable fully automatic upgrades. #13348

• Fixed an issue where the Vault secret cache got refreshed during resurrect_ttl time and could not be fetched by other workers. #13561

• Error logs during Vault secret rotation are now logged at the notice level instead of warn. #13540

• Fix a bug that the host_header attribute of upstream entity can not be set correctly in requests to upstream as Host header when retries to upstream happen. #13135

• Moved internal Unix sockets to a subdirectory (sockets) of the Kong prefix. #13409

• Changed the behaviour of shorthand fields that are used to describe deprecated fields. If both fields are sent in the request and their values mismatch - the request will be rejected. #13594

• Reverted DNS client to original behaviour of ignoring ADDITIONAL SECTION in DNS responses. #13278

• Shortened names of internal Unix sockets to avoid exceeding the socket name limit. #13571

PDK

• PDK: Fixed a bug that log serializer will log upstream_status as nil in the requests that contains subrequest #12953

• Vault: Reference ending with slash when parsed should not return a key. #13538

• Fixed an issue that pdk.log.serialize() will throw an error when JSON entity set by serialize_value contains json.null #13376

Plugin

• AI-proxy-plugin: Fixed a bug where certain Azure models would return partial tokens/words when in response-streaming mode. #13000

• AI-Transformer-Plugins: Fixed a bug where cloud identity authentication …