Changelog for supported Kong AI Gateway versions.
This is the changelog for the on-prem Kong AI Gateway runtime. policies are a control plane concept. In the runtime they’re implemented as plugins, which is the terminology you’ll see in this changelog.
Release date 2026/09/30
AI Gateway: The FIPS artifact serves an explicit TLS 1.2 cipher list: four
ECDHE suites with AES-GCM. It replaces the OpenSSL FIPS alias, which resolves
to 28 suites and also admits static RSA key transport and SSLv3-era suites. A
deployment moving from the retired kong-ai-gateway-fips package that relies
on one of the dropped suites must set ssl_cipher_suite = custom and
ssl_ciphers. TLS 1.3 ciphersuites are unaffected; the global OpenSSL FIPS
configuration sets those.
AI Gateway: The FIPS artifacts are renamed to state their certification
level. The kong-ai-gateway-fips package becomes
kong-ai-gateway-fips-140-3 and the <version>-<distro>-fips image becomes
<version>-<distro>-fips-140-3. The new package replaces the old one, so an
installed FIPS deployment upgrades in place, but pinned package names and
image tags must be updated.
KONG_FIPS=on no longer generates default EdDSA JWKS keys. Use an RSA-PSS or NIST-curve ECDSA key instead.
Added a Distroless Docker image variant for Kong AI Gateway. The Distroless image ships only the gateway binary and its runtime dependencies. It has no shell, no package manager and no general-purpose userland.
Added a FIPS 140-3 variant of the Kong AI Gateway Distroless image, published
as <version>-distroless-fips-140-3 for amd64.
Added a FIPS-compliant variant of the distroless image.
ai-mcp-proxy: Added PDK support for effective requests, original request metadata in log, and pre-finalization response status and headers in body_filter.
ai-proxy: Added support for TypeSafe.ai Jev decision models, either hosted on TypeSafe or a third-party (via custom upstream URL).
Analytics: Added the W3C trace context headers (traceparent, tracestate) and, for Bedrock, SageMaker, and Vertex AI (Gemini), the inference provider’s region (ai[].meta.provider_region) to the request payload.
Enabled TLS 1.3 for the FIPS cipher suite and configured FIPS builds to use AES-based TLS 1.3 ciphersuites.
Added a new Metrics PDK (kong.metrics) that enables custom plugins to define and record metrics, with initial support integrated into the opentelemetry plugin.
AI Proxy:
Added the ability to choose whether to output OpenTelemetry span attributes and statistics in OpenInference format, or the previous OpenLLMetry format.
ai-mcp-proxy:
Added Token Vault support to resolve upstream credentials, allowing the exchange and forwarding of short-lived credentials instead of static ones.
ai-plugins:
Introduced a new filter execution ordering system so that the shared filters in AI plugins could be re-ordered. This helps bring more flexibility to the execution.
ai-proxy-advanced:
Added a passthrough route type that forwards the client’s request path and body and the upstream response bytes unchanged, while still applying provider authentication.
Added support for the OpenAI and Anthropic Skills API, with the client and the upstream provider using the same format (OpenAI-to-OpenAI, Anthropic-to-Anthropic).
Added a headroom compression provider, selected with the new
config.provider field. This is the stateful Headroom mode: the sidecar keeps the
compressed conversation on its own side and indexes that state by session_id, which the
plugin derives per conversation.
Added credential and service match types to policies, so a policy can filter on or partition by the authenticated credential ID, and on the service ID or (with key: name) the service name.
Added the client_certificate config option, so users can present a certificate entity as the mTLS client certificate when an OTLP endpoint uses HTTPS.
Required identical AI Gateway versions on control planes and data planes before allowing full or incremental configuration synchronization. Data planes with missing versions or different patch or prerelease versions were rejected.
AI Analytics:
Fixed an issue where ai.model_id were absent in Analytics
ai-a2a-proxy:
Fixed an issue where proxy_config was not applied to the final A2A upstream request.
Rejected auth.provider: token_vault at config validation time, since this plugin only implements aws_iam auth.
ai-mcp-proxy:
Fixed an issue where setting server.tag in conversion-listener mode returned an empty tool list.
Fixed an issue where modern MCP mirroring headers were forwarded to legacy upstream servers.
Fixed an issue where plugins before ai-mcp-proxy were run twice in conversion-listener mode.
ai-proxy-advanced:
Added prompt cache control mappings across OpenAI, Anthropic, and Amazon Bedrock chat formats.
Fixed a path-duplication bug on Anthropic restful routes (llm/v1/batches, llm/v1/skills) when the model used a custom upstream_url.
Fixed an issue where Gemini image generation misattributed modality tokens and omitted cache usage in responses and AI logs.
Fixed an issue where gen_ai.request.max_tokens attribute was missing from OpenTelemetry and debug-session spans.
Fixed an issue where Anthropic-compatible streaming providers like Baseten reporting prompt usage only in message_delta lost prompt and cached tokens.
Fixed an issue where Anthropic thinking.type = "disabled" was overridden by output_config.effort during cross-format conversion, keeping reasoning enabled.
Fixed an issue where an Anthropic thinking block (adaptive, enabled, or
disabled) was always converted into a reasoning_effort request parameter and forwarded to the
target model, even when that model did not support reasoning. OpenAI, Mistral, and Cohere targets
without reasoning support now have the gateway-derived value omitted, while an explicit
reasoning_effort sent by the client is still forwarded as before.
Fixed an issue where Bedrock and SageMaker assume-role credentials were not prewarmed and could trigger STS calls during balancer-phase retries.
Fixed an issue where the consistent-hashing balancer routed requests with the same hash_on_header value to different targets when multiple workers were running.
Fixed an issue where repeated cumulative usage in streaming responses inflated token counts.
Fixed an issue where xAI reasoning tokens were not folded when visible completion tokens exceeded reasoning tokens.
Fixed an issue where Anthropic streaming responses and Bedrock native-format responses did not report web search and web fetch tool usage counts in observability metrics.
Fixed an issue where Anthropic output_config.effort was ignored during cross-format conversion (including Bedrock additionalModelRequestFields), and added support for preserving max effort.
acme:
Fixed an issue where an expired fail_backoff key would keep blocking certificate issuance. Retries are now rejected only while the backoff timestamp is still in the future.
Fixed handling of OpenAI-compatible multimodal requests with image content.
Fixed an issue where, on routes where the client and the upstream use the same format, the compressor sent the original request instead of the one modified by ai-sanitizer, masking guardrails, ai-rag-injector or ai-request-transformer.
Fixed an issue where a chained upstream’s raw, provider-native response was sent to introspection and returned to clients unnormalized.
Fixed an issue where ai-sanitizer only sanitized the first Gemini response candidate, leaving additional candidates unsanitized when candidateCount was greater than one.
Fixed an issue where ai-sanitizer failed to sanitize Cohere requests that contained multimodal message content, such as image blocks alongside text.
Fixed an issue where the exit node sent a string body without a correct Content-Type. It now uses the content type that the source node declares, for example application/xml for json_to_xml output, and defaults to application/octet-stream in the request phase.
graphql-rate-limiting-advanced:
Fixed an issue where a longer fixed window was incorrectly marked as exhausted if a shorter window denied a request.
jwt:
Fixed an issue where the plugin failed to decode standard Base64
secrets that contained + or / when config.secret_is_base64 was enabled.
opa:
Fixed an issue where Kong Gateway did not send an SNI to the OPA server. It now sends opa_host as the SNI when that is a hostname; with ssl_verify = true, the certificate must include opa_host.
Fixed an issue where disabling verify_signature gave no warning, even though it also skips signature verification for bearer tokens from clients. The plugin now logs a warning when verify_signature is false and auth_methods includes bearer. It logs a notice instead when bearer is not enabled.
Fixed an issue where a callback with an invalid JARM response returned a 500 error; the plugin now rejects such callbacks with a 401 authentication failure.
Fixed an issue where metrics were rarely (or never) exported on data planes whose configuration is rebuilt more frequently than the metrics push_interval. The periodic metrics push timer is no longer cancelled and recreated on every configuration rebuild, so its push_interval countdown is preserved.
Fixed an issue where a longer fixed window was incorrectly marked as exhausted if a shorter window denied a request.
Fixed an issue where a callout that failed and then succeeded on retry still returned the earlier failed response. The plugin now returns the response from the successful retry.
Fixed an issue where a longer fixed window was incorrectly marked as exhausted if a shorter window denied a request.
AI Gateway: Fixed the RPM Obsoletes metadata of the AI Gateway packages.
kong-ai-gateway and kong-ai-gateway-fips-140-3 are parallel builds, not
successors of each other, so they now obsolete each other only below the
version being built. Without the bound an installed kong-ai-gateway had two
mutually conflicting successors and dnf upgrade could not resolve an
upgrade. The retired kong-ai-gateway-fips keeps a single unversioned
successor, kong-ai-gateway-fips-140-3, so an existing FIPS deployment
upgrades in place. The deb packages do not change.
Analytics: splunk reports now carry ai_a2a_reqs and ai_total_reqs fields, counting A2A requests and all AI Gateway traffic (inference, MCP, and A2A) respectively.
Balancer: Fixed an issue where a plugin could not override the upstream
target when the Gateway Service host was a literal IP address. The balancer
kept the IP that it derived from the Service, so the request went to the
Service host and the override was silently lost. This affected
kong.service.set_target and every plugin that replaces
ngx.ctx.balancer_data.host, for example route-transformer-advanced and
canary.
Fixed an issue where a malformed JSON document could corrupt the shared JSON
decoder of a worker. Later requests that decoded valid JSON on the same worker
then failed until the node restarted. The JWT plugin returned
Bad token; invalid JWT payload for known-good tokens.
Fixed an issue where an in-flight request that completed after its upstream target became unavailable could restore the target to the latency balancer and route subsequent requests to it.
Fixed an issue where custom_validator in schema definitions forwarded the
enclosing schema as a second argument. This changed the call signature and
could affect custom validators that declare more than one parameter. The
single-argument call signature is restored.
Fixed an issue where the SameSite attribute of the Set-Cookie header was incorrectly set to Same-Site by session-affinity (sticky-session) balancing.
On shell-free (distroless) images, the pluginserver query and start commands
now expand $KONG_PREFIX / ${KONG_PREFIX} from the environment and fail fast
with a clear error on an unterminated quote or ${, instead of passing the
literal $KONG_PREFIX to the pluginserver or building a best-effort argv.
Fixed an issue where older data planes stopped receiving configuration updates when sync v2 was unavailable by restoring automatic sync v1 fallback.
Hardened stale nginx PID detection to survive PID reuse. On Linux, kong start
now confirms a live PID actually belongs to nginx by reading /proc/<pid>/cmdline,
so a reused PID from an ungraceful exit no longer blocks a restart.
Bumped kong-pgmoon from 2.3.4.0 to 2.3.5.0, which fixes SCRAM channel binding failing to connect to a PostgreSQL server whose certificate is signed with SHA-512.
Bumped lua-resty-jq from 0.2.0 to 0.2.2.
Bumped lua-resty-simdjson from 1.2.0 to 1.3.1 (updates simdjson to 4.6.11).
Bumped OpenSSL FIPS provider from 3.0.9 to 3.1.2 for FIPS 140-3 validation
ai-mcp-proxy:
Cached Token Vault credential exchanges using Redis to reduce repeated upstream credential exchanges per request.
Improved plugin performance by removing unnecessary hash computation. Enabling the plugin now adds much less latency and CPU overhead to requests.
Release date 2026/09/22
Conditional Plugin Execution: The plugin condition field now uses
a new standardized expression language with broader operator and type
support, aligned across UI, Control Plane, and Data Plane. Refer to
the official documentation for the full syntax, supported variables,
operators, and types.
Workspace names that shadow existing top-level admin API routes are no longer allowed. If you have an existing workspace name that conflicts with a admin route, it may be impacted. Check GET /endpoints to review the reserved first-level segments.
ai-mcp-proxy:
Added config.server.cache for the ttlMs and cacheScope hints Kong emits on tools/list and server/discover, and config.server.allowed_versions to narrow the MCP protocol revisions this server accepts. allowed_versions is unset by default, meaning every revision Kong implements; when set, server/discover advertises exactly that list and a request declaring anything else is rejected with -32022. A public cache scope is rejected on a configuration whose tool list is ACL-filtered per subject.
Added propagation of the inbound W3C trace context to MCP tool call requests.
Added support for speaking MCP protocol revision 2026-07-28 to upstream MCP servers. Added config.server.upstream_protocol_version to select the revision Kong speaks upstream.
Added support for MCP protocol revision 2026-07-28. Kong answers a client at the revision it declares, resolved per request from the MCP-Protocol-Version header and the _meta protocol version. The revision brings server/discover, subscriptions/listen, resultType, ttlMs/cacheScope cache hints, HTTP status codes on protocol errors, header mirroring validation against the request body, and no sessions or standalone GET stream. 2025-03-26, 2025-06-18 and 2025-11-25 clients are unaffected.
ai-proxy-advanced:
Added handling for JSON null metadata fields in native-format analytics.
Added per-modality usage cost for text, audio, image and video tokens, configured through the pricing catalog or the new model.options *_cost_list fields.
acl:
Added allow_when/deny_when fields that evaluate CEL boolean expressions against the request context to provide more expressive access‑control policies.
Added support for reading bearer tokens from a custom header.
Added a kong workspace CLI command. kong workspace rename OLD_NAME NEW_NAME
renames a workspace (cascading the new name to RBAC role-endpoint permissions),
and kong workspace detect-admin-endpoint-conflicts lists workspaces whose names
collide with admin API URL prefixes.
Analytics: MCP analytics now carry protocol_version, the revision the client declared, and tool_list_cache_hit, whether a tools/list was answered from the gateway tool cache, alongside the JSON-RPC error code per RPC. mcp_session_id is empty from revision 2026-07-28 on, which mints no session.
Conditional Plugin Execution: Added support for conditional plugin execution through a new condition field in the plugin configuration. Plugins can now be conditionally skipped at runtime based on request attributes such as HTTP method, path, headers, query parameters, consumer, route, service, and network information. The condition expression uses the ATC expression language and is evaluated once during the collecting phase; skipped plugins are excluded from all downstream phases automatically.
Konnect analytics now propagates a custom string key/value map on the request
payload (RequestMetadata.custom). Plugins can populate it with
kong.log.set_serialize_value("custom.<key>", "<value>").
Plugin conditions: Plugin condition expressions are now type-checked at
configuration time. Expressions whose result is provably non-boolean (for
example 1 + 1, "foo", or size(x)) are rejected when the plugin is
configured, instead of failing at request time. Boolean and
statically-unknown expressions are accepted as before.
Supported plugin cloning. You can now clone existing bundled plugins, give them a new name and optionally specify a priority. This is useful when you want to have multiple instances of a plugin with different configurations running in the same request. Currently, the cloneable plugins are: openid-connect, acl, pre-function, post-function, request-transformer-advanced, request-transformer, response-transformer-advanced, response-transformer, key-auth, file-log, http-log, tcp-log, ip-restriction, route-by-header, opa, datakit.
Supported plugin streaming. You can now stream custom plugins dynamically. Refer to the documentation for more details on how to use this feature.
Required identical AI Gateway versions on control planes and data planes before allowing full or incremental configuration synchronization. Data planes with missing versions or different patch or prerelease versions were rejected.
AI Analytics:
Fixed an issue where ai.model_id were absent in Analytics.
ai-a2a-proxy:
Fixed an issue where non-A2A and oversized requests could reach upstream services without configured AWS authentication.
ai-mcp-proxy:
A request declaring a protocol revision Kong does not serve is now answered with HTTP 400 and JSON-RPC error -32022, listing the revisions Kong serves, instead of being served silently at a different revision.
Fixed an issue where AWS request signing did not read file-backed request bodies within the configured size limit.
W3C trace context sent in params._meta (traceparent, tracestate, baggage) now reaches the upstream as headers on the request Kong actually sends, in every mode. A value containing a control character is dropped instead of being written to a header.
ai-mcp-proxy/ai-a2a-proxy:
Fixed an issue where the mcp_server_id and agent_id fields were missing from the AI analytics telemetry payload unless the plugin was scoped to a gateway service.
ai-proxy:
Fixed an issue where parallel tool call results were sent to Bedrock in the wrong order, causing a 400 “Expected toolResult blocks” error.
ai-proxy-advanced:
Added video token metrics to the usage token details.
Fixed an issue where a Gemini response with JSON null token counts in usageMetadata caused an HTTP 500 on non-streaming chat requests and an empty HTTP 200 response on streaming chat requests.
Fixed an issue where adapted Anthropic responses omitted cache and reasoning usage details.
Fixed an issue where Claude Sonnet 5 and Opus 5 rejected OpenAI-format reasoning requests on Bedrock due to an unsupported thinking.type value.
Fixed an issue where provider-reported reasoning-token details were not correctly reported.
Fixed an issue where some providers would not properly respect the stream_options: include_usage flag, and return out-of-order SSE stream end frames.
Fixed an issue where xAI reasoning tokens were not folded into completion_tokens, breaking the OpenAI usage identity.
Fixed an issue where the consistent-hashing balancer routed requests with the same hash_on_header value to different targets when multiple workers were running.
Fixed empty and statistics-only SSE streams. Empty Anthropic responses no longer emit an unmatched content_block_stop, and log_statistics-only streams now track streamed response length for completion-token estimation.
Fixed multipart video generation requests to OpenAI-compatible providers leaking internal multipart metadata into JSON upstream bodies, which caused the requests to fail.
Fixed an issue where ai-sanitizer returned 500 status code when the provider was using another model, such as a claude-* model served by the gemini provider on Vertex AI.
Fixed an issue where the exit node sent a string body without a correct Content-Type. It now uses the content type that the source node declares, for example application/xml for json_to_xml output, and defaults to application/octet-stream in the request phase.
Fixed the body handling of the exit and service_request nodes when the body input is a JSON null. The nodes sent the internal Lua value as the string “userdata: NULL”. The exit node now sends no body. The service_request node now keeps the upstream request body.
jwt:
Fixed an issue where the plugin failed to decode standard Base64
secrets that contained + or / when config.secret_is_base64 was enabled.
Fixed an issue where the OAS specification cache failed to distinguish between different values of api_spec_encoded for the same specification content.
ai-semantic-prompt-guard, ai-semantic-response-guard, ai-proxy-advanced, ai-semantic-cache: Fixed vector database indexes and cached embedding records being left behind when a plugin instance was deleted.
kafka-consume, confluent-consume: Fixed an issue where the consumer group subscription declared protocol version 1 but carried the version 0 layout, so a topic-rewriting proxy rejected it.
prometheus, opentelemetry: Fixed an issue where prompt-cache token usage was missing
from observability: added per-TTL cache-write token types (e.g. cache_write_1h_tokens,
cache_write_5m_tokens) to the Prometheus ai_llm_tokens_total and OpenTelemetry
gen_ai.client.token.usage metrics, and gen_ai.usage.cache_creation.input_tokens /
gen_ai.usage.cache_read.input_tokens to OpenTelemetry traces and access logs.
Fixed an issue where an in-flight request that completed after its upstream target became unavailable could restore the target to the latency balancer and route subsequent requests to it.
Fixed an issue where custom_validator in schema definitions forwarded the
enclosing schema as a second argument. This changed the call signature and
could affect custom validators that declare more than one parameter. The
single-argument call signature is restored.
Fixed an issue where streamed custom plugins were not recognized when configured in the ordering field of plugins on Data Planes.
Fixed an issue where the priority field of a cloned plugin could not be updated while it was still referenced by plugin instances.
Fixed an issue where older data planes stopped receiving configuration updates when sync v2 was unavailable by restoring automatic sync v1 fallback.
Fixed an issue where paginated full sync could keep stale pending foreign-key references across a failed resume, causing spurious validation failures.
Fixed an issue where self-managed control planes rejected updates to a streamed plugin’s handler while the plugin was referenced by a plugin instance.
Fixed an issue where updates to a streamed plugin’s definition (e.g. handler), or to a cloned plugin’s definition (e.g. priority), were not applied on data planes when no referencing plugin instances changed. The data plane now rebuilds its plugins iterator so the updated definition takes effect, instead of continuing to execute the previous version.
Uses now cel-cpp 0.15.0 instead of cel-rust 0.11.6 for Common Expression Language backend.
Improved the configuration synchronization latency when incremental sync enabled under some circumstances.
Release date 2026/08/31
AI Proxy:
Added support for GCP Workload Identity Federation using AWS IAM to authenticate with GCP Vertex models, enabling Kong to access Google Cloud Vertex models using AWS credentials, and without managing long-lived credentials.
Add 401 JSON body like Kong key-auth plugin.
Konnect Only. Analytics: Added the OpenID Connect plugin’s credential_claim identity to Analytics events, so requests are attributed under the auth dimension in Konnect without a Kong Consumer.
ai guardrail plugins:
Fixed an issue where a JSON null field in a response from the third-party service made the plugin return 500.
ai-mcp-proxy:
Fixed an issue where gzip-compressed and malformed MCP request bodies were incorrectly rejected with HTTP 413.
ai-model-selector:
Fixed an issue where a model extracted from a body_path other than model left an unrecognized field in the request body and no standard model field, causing the upstream LLM provider to reject the request.
ai-proxy and ai-proxy-advanced:
Fixed a 500 crash on Bedrock Converser requests when a cachePoint content block immediately followed a toolResult block in the same message.
ai-proxy-advanced:
Fixed an issue where Gemini non-streaming responses that reached max_tokens reported a stop finish reason instead of length.
Fixed an issue where modern OpenAI output token limits were discarded or overridden during request normalization.
Fixed an issue where Gemini and Anthropic token usage metadata was lost in streaming responses.
Fixed a issue where the request to aws guardrail service could return 500 error duo to a failure in request signature.
Fixed an issue where a chunk lookup against an Amazon MemoryDB vector store failed with unexpected search response: no value found in result set. The MemoryDB driver now reads the FT.SEARCH fields by name instead of by position, treats the vector distance as optional, and requests as many rows as fetch_chunks_count asks for.
jwt:
Fixed an issue where the plugin failed to decode standard Base64
secrets that contained + or / when config.secret_is_base64 was enabled.
Fixed an issue where a request that authenticated but failed an authorization check (such as scopes_required) was not attributed to its consumer, consumer groups, or Kong Identity principal in logs and analytics.
Reduced per-request overhead of resource_attributes by skipping template rendering entirely for static (non-templated) fields.
kafka-upstream, kafka-log, confluent, kafka-consume, confluent-consume: Fixed a
permanent failure that started when a broker answered an ApiVersions request with an error code,
an empty API key set, or a malformed frame. The client cached that result and every later request
failed with ProduceRequest API version not negotiated; broker may be unreachable until the node
restarted, even after the broker recovered. The client now refuses an unusable ApiVersions
response, keeps the previous negotiation, and retries the negotiation for a topic whose metadata is
already cached.
Fixed an issue where an in-flight request that completed after its upstream target became unavailable could restore the target to the latency balancer and route subsequent requests to it.
Fixed an issue where immediate cosocket SSL handshake errors could be reported as subsequent socket write failures.
Konnect Only. Debugger: Fixed an issue where deep copy of the worker logs stack overflowed by replacing deep_copy with cycle_aware_deep_copy.
Fixed an issue where hybrid data planes retried unrecoverable CP connection failures and ignored Retry-After delays on 429/503 responses, preventing avoidable reconnect storms.
Clustering: Improved data plane stability when applying a large configuration sync from the control plane, reducing the chance of a worker restart while the update is being processed.
Optimized performance of clustering payload handling for version compatibility. This reduces CPU usage and transient memory pressure.
Improved the performance of listing workspaces with ?counter=true. Entity counts for the whole page are now retrieved with one grouped query per entity type instead of a separate count query per entity type per workspace, while keeping the counts exact.
Reduced memory usage of the access log queue by deferring OTLP payload conversion to export time.
Release date 2026/08/18
ai-model-selector:
Replaced the single source config field with an ordered sources array so the plugin can try multiple sources and use the model from the first one that yields a value.
ai-proxy-advanced:
Added filtering for empty Anthropic thinking blocks in request history.
usage cost now supports per-cache-TTL cache-write
pricing, context-window pricing factors, and service-tier pricing factors via
model.options (cache_write_cost_list, context_window_factor,
service_tier_factor). Anthropic (cache TTL + service tier), OpenAI, and Gemini
service tiers are collected from upstream responses.
Added support for authentication via the Kong Identity service with caching, consumer compatibility and basic analytics.
Added support for authentication via the Kong Identity service with caching, consumer compatibility and basic analytics.
Added support for Kong Identity principal lookup after token verification, enabling consumer and consumer group mapping from Kong Identity with caching and miss-behavior control.
Added a max_request_body_size configuration option that lets the plugin apply body transformations to request bodies that Nginx buffers to a temporary file (bodies larger than client_body_buffer_size). Previously such bodies were never read, so the configured body transformations were silently skipped and the original body was proxied upstream. The option defaults to -1, which preserves that behavior; set it to a positive byte limit to opt in (or 0 for unlimited, still bounded by Nginx’s client_max_body_size).
ace Added Kong Identity principal fetch after authentication, enabling consumer and consumer group mapping from the Konnect identity service.
ai-aws-guardrails, ai-azure-content-safety: Added last_message as new optional value for config.text_source.
ai guardrail plugins:
Fixed issues where ai-sanitizer plugin and ai-aws-guardrail plugin can not work properly with claude code.
ai-proxy, ai-proxy-advanced:
Fixed an issue where Gemini streaming analytics could over-report token usage. Gemini repeats its usage metadata on every stream chunk as a running request-level total, but the counts were summed across chunks instead of replaced, multiplying the reported usage by the number of chunks. Reasoning tokens were affected the most, because Gemini reports them in full on the first chunk and does not change them afterwards. A chunk that carried no usage metadata also reset the recorded output token count to zero.
ai-proxy-advanced:
Fixed a bug where a response from Anthropic could fail to decode when the client’s request advertised Brotli support, since Anthropic’s edge may then return a Brotli-encoded body that Kong’s response decompression – which only understands gzip – can’t inflate. Kong now normalizes the outgoing Accept-Encoding request header before proxying to any LLM provider: gzip, identity when the client accepts gzip, and identity otherwise, so a client that cannot inflate gzip is never handed a compressed body on the paths that pass the upstream response through untouched.
Fixed an issue where Gemini’s tool-use token usage (billed when server-side tools such as grounding, code execution, or URL context are used) was not counted in the reported token usage or cost.
Fixed an issue where signed Anthropic thinking blocks with omitted text were removed from request history.
Fixed an issue where token usage for Anthropic requests using the compaction beta was undercounted. Kong now sums usage.iterations when present instead of relying solely on the top-level input_tokens / output_tokens, which only reflect non-compaction iterations.
Fixed an issue where Anthropic-format requests could report zero usage when it targets Bedrock’s own model via conversion.
Fixed custom Azure upstream URLs to preserve query parameters and apply the configured api-version when needed.
Fixed Gemini image generation token accounting to include reasoning tokens (thoughtsTokenCount) in output_tokens and report them as output_tokens_details.reasoning_tokens. Previously the reasoning tokens were dropped, which under-reported output tokens, analytics, and calculated cost for thinking-enabled image models.
Fixed Gemini realtime (Live API) token accounting to include reasoning tokens (thoughtsTokenCount) in the reported output tokens, and to report them as output_tokens_reasoning_tokens_count. Previously the reasoning tokens were dropped, which under-reported the output and total token counts of thinking-enabled realtime sessions.
Fixed token usage statistics being silently dropped for audio/v1/audio/transcriptions
requests. Token-billed OpenAI/Azure transcription models (e.g. gpt-4o-transcribe) now report
input_tokens/output_tokens/total_tokens and the text_tokens/audio_tokens breakdown in the analytics
log when logging.log_statistics is enabled.
Fixed an issue where the plugin ignored the configured text_source option when allow_masking was enabled, masking the entire raw request body instead.
Fixed an issue where the plugin failed to inspect requests sent in a provider’s native format instead of the OpenAI-compatible format.
Fixed an issue in OpenAI chat response extraction where tool-call-only choices (without string message.content) could be treated as extractable text.
Fixed an issue where the plugin failed to set the signed access token header on the upstream request, when access_token_upstream_header (or original_access_token_upstream_header) had the same name as channel_token_request_header.
Fixed gen_ai.client.token.usage never reporting token counts for non-text-generation
AI categories (image, video, realtime, and audio transcription generation), because it only read the
legacy prompt_tokens/prompt_tokens_details analytics log fields instead of falling back to the
input_tokens/input_tokens_details fields those categories are logged under.
Fixed kong_ai_llm_tokens_total never reporting token counts for non-text-generation
AI categories (image, video, realtime, and audio transcription generation), because it only read the
legacy prompt_tokens/prompt_tokens_details analytics log fields instead of falling back to the
input_tokens/input_tokens_details fields those categories are logged under.
Fixed an issue where AI Gateway guardrail plugins’ request extractors did not correctly honor the configured text_source option.
Fixed an issue where AI Gateway guardrail plugins failed to extract prompt text from OpenAI-native requests using the input_text content type.
Core: Reduced config update latency on hybrid data planes by notifying the stream subsystem before applying the update in the HTTP subsystem, so both rebuild in parallel.
Release date 2026/07/29
ai-guardrails:
Added a rejection_mode configuration field (none, stealth, verbose) to control how blocked requests and responses are communicated to the client.
Added a shared continue_on_detection field to all guardrails to allow for non-blocking guardrail triggers.
ai-mcp-proxy:
Added JSON Schema draft 2020-12 support for input schema validation.
ai-model-selector:
Added support for extracting model aliases from request paths.
ai-proxy:
Added support for AWS SageMaker as a new AI provider.
ai-proxy-advanced:
Added a configurable pricing catalog that computes LLM usage.cost from per-(provider, model) token rates, including cache read/write rates.
Added OpenAI-format chat reasoning request and response mappings across supported AI providers.
Added support for reporting prompt cache token metrics in OpenAI-compatible format.
ai-proxy/ai-proxy-advanced:
allowed ai-proxy/ai-proxy-advanced plugins to be scoped with the ai-model entity.
Added the log_blocked_content field to allow logging prompts and responses blocked by the guardrail, and updated the continue_on_detection description to mention that block data is visible via Kong logs.
Added expected_audience to configure the expected token audience independently from resource.
Added new plugin to check LLM request/response content against NVIDIA NeMo Guardrails.
added the response_buffer_size option to support guarding streaming responses.
ai:
Fixed the Redis vector database index being dropped and recreated on every request when metadata fields were enabled.
ai-mcp-proxy:
Fixed an issue where the ACL decision cache has collision.
Fixed an issue where the MCP initialize response reported the wrong version.
Fixed an issue where non-managed MCP listeners advertised unsupported SSE streams.
ai-model-selector:
Fixed model alias extraction from the request body to support multipart/form-data requests in addition to JSON.
ai-proxy:
Fixed a confusing error message when a Bedrock native-format request uses an invalid ARN model path.
Fixed an issue where Bedrock driver could not handle OpenAI content_parts format in system messages, user/assistant messages, and array-typed tool results.
Fixed OpenAI-compatible completions requests with string array prompts.
ai-proxy-advanced:
Fixed a Lua crash in declarative schema validation when a Bedrock target had no auth block (e.g. IRSA / role-only configs), which made the entire declarative config unloadable.
Fixed an issue where the configured auth header (e.g. api-key, x-api-key) leaked the provider credential into access logs instead of being redacted.
Fixed an issue where the OpenAI developer role was not treated as a system prompt when transforming requests to Bedrock and Gemini providers.
Fixed an issue where we didn’t handle SSE event headers correctly.
Fixed an issue where balancer retries could continue reusing the last selected target after all priority peers were exhausted.
Fixed an issue where Gemini chat requests rejected OpenAI input_audio and video_url content parts.
Fixed an issue where native Bedrock request parsing dropped string message content in kong internal format, causing invalid data used by other plugins.
Fixed an issue where OpenAI content array was sent as bedrock/gemini system message which only support string.
Fixed an issue where OpenAI, Azure, and Gemini realtime upstream URLs using wss were downgraded to ws.
Fixed an issue where requests to a Gemini or Anthropic provider could fail with 401 when using the OpenAI format with a custom auth header (e.g. x-goog-api-key, x-api-key) or query-parameter auth. The original Authorization header sent by the OpenAI SDK is now cleared so it does not conflict with the configured credential.
Fixed an issue where semantic routing failed with “found target with ID
Fixed an issue where the context-management-2025-06-27 Anthropic beta flag was dropped when routing to a Bedrock target, causing Bedrock to reject requests carrying context_management with a 400 error on failover from an Anthropic target.
Fixed an issue where a malformed RSA private key in a Gemini provider’s service_account_json caused crash with SIGSEGV
Fixed Gemini service-account auth probing metadata.google.internal when a service account JSON was configured.
Fixed reuse of an expired Azure managed-identity token causing intermittent upstream 401s.
acl:
Fixed an issue where the ACL plugin returned 403 for authenticated credentials with no consumer and no groups (e.g. ACE / Dev Portal application credentials) when configured with a deny list. A group-less identity cannot match a deny list and should be allowed through.
Fixed an issue where the ACL plugin ignored a consumer’s ACL groups when include_consumer_groups was enabled and the consumer belonged to an enterprise consumer group, causing incorrect 403 denials (with allow) or incorrect access (with deny) for authenticated and anonymous consumers. The plugin now falls back to the consumer’s ACL groups when no third-party authenticated groups are present.
Fixed a JWT security vulnerability.
Fixed an issue where native Anthropic requests were forwarded in OpenAI format after prompt compression.
Fixed percent sequences in injected prompt text.
Fixed token counters being decremented on ai-semantic-cache hits.
Fixed an issue where requests transformed before ai-proxy-advanced skipped AI response normalization.
Fixed cache hits ignoring llm_format, which returned OpenAI-shaped responses to native-format (e.g. Anthropic) clients. Cached responses are now converted to the client’s llm_format for both streaming and non-streaming requests.
Fixed CVE-2026-14916 by binding the JWT algorithm to the
verification key’s type in the jwt_verify node, so a symmetric algorithm can
no longer be verified against an asymmetric key, preventing an authentication
bypass where an attacker forges tokens by using the public key as an HMAC
shared secret, under configurations where the node uses a PEM key string and
allowed_algorithms is unset (any algorithm accepted).
Fixed an issue where warn log messages did not include the plugin name, making it difficult to identify the source of blocked requests.
Fixed an issue where the plugin failed to load configuration and errored when null or nil values were passed to access_token_keyset or channel_token_keyset.
Fixed an issue where switching clients within a single request (via client_arg) failed to use the matching client’s JWK.
Fixed an issue where consumer groups could not be resolved
when the groups claim was only available from the user info endpoint, which
resulted in a 500 error.
Fixed an issue where OpenTelemetry metrics only supported integer values by adding support for floating-point values in the OTLP exporter.
A histogram’s series (its buckets, _count and _sum) is now
read as one atomic group during a scrape. Previously the exporter yielded and
flushed output between individual samples, so an observation landing mid-scrape
could bump _count/_sum after the buckets were already read, producing an
internally inconsistent histogram in a single response.
Histogram series are now emitted grouped by label set (all
buckets in ascending le order, then _count, then _sum) so the output
follows the OpenMetrics interleaving rule. Previously samples were grouped by
suffix, which caused strict consumers such as Google Managed Prometheus to
drop points.
saml:
Fixed an unreachable code path that prevented the plugin from falling
back to validating the samlp:Response-level signature when the saml:Assertion
was not individually signed. With validate_assertion_signature enabled, an
unsigned assertion inside a signed Response is now accepted (and a Response with
no valid signature on either the assertion or the root is rejected), so IdPs that
sign the Response envelope rather than the assertion no longer require signature
validation to be turned off. Relates to the Response-level fallback described in
CVE-2026-14917.
kafka-upstream, kafka-log, confluent, kafka-consume, confluent-consume: Fixed a crash
that occurred when a plugin set schema_registry.confluent.authentication.mode
to oauth2 but omitted the oauth2_client record. Previously this returned a
500 from the Admin API during validation, and once saved it also crashed at
runtime while fetching the schema registry OAuth2 token. The absent
oauth2_client is now handled and falls back to the default authentication
method, so a configuration without oauth2_client works end-to-end.
Clustering: The /status/sync endpoint now returns an empty stat object instead of null before the first sync has run, keeping the response shape consistent.
Fixed an issue on HTTP/2 connections where the request method and query were reported incorrectly, or could raise an error, when a request hit the error handler such as a 502 from an upstream connection reset.
Fixed an issue where dynamic plugin ordering (ordering) leaked into the
downstream phases (header_filter, body_filter, response, log). Dynamic
ordering now again applies only to the access phase; downstream phases execute
in static plugin-priority order.
Konnect Only. Debugger: Fixed an error that could occur under sustained HTTPS traffic.
Konnect Only. Debugger: Fixed an issue where the default key name apikey of the key-auth and key-auth-enc plugins was not redacted when captured by the Debugger. This has been resolved by adding apikey to the list of default redacted headers.
Konnect Only. Debugger: Fixed an issue where the response body of the external HTTP call httpc:request() were not captured.
Konnect Only. Debugger: Fixed an issue where instrumenting third-party HTTP client calls produced two indistinguishable kong.io.http.request spans for httpc:request_uri().
It is now traced under a dedicated kong.io.http.request_uri span, and the connect, DNS, and internal request spans it triggers are nested beneath it.
The kong.io.http.request span now also reports the http.url attribute.
PostgreSQL OAuth auth: Refined the token cache key to be derived only from the fields that identify an OAuth configuration.
router: Fixed an issue where WebSocket routes (ws/wss) returned HTTP 404 when using router_flavor=expressions due to incorrect protocol matching expressions being generated.
Fixed an issue where resetting the password of an admin or developer failed with “Old password is invalid” when the credential was created before the basic-auth hashing algorithm was upgraded from SHA1 to SHA256 (e.g. a kong_admin user created in an older version and carried over through an upgrade). The old password is now verified with the backward-compatible verification logic that supports both SHA1 and SHA256 hashed passwords.
Bumped jq from 1.8.1 to 1.8.2.
Release date 2026/07/10
ai-plugins:
Dropped deprecated schema fields slated for removal in 4.0:
http_proxy_host/http_proxy_port/https_proxy_host/https_proxy_port shorthands
in ai-llm-as-judge, ai-request-transformer, ai-response-transformer (use
proxy_config instead); llm_format, max_request_body_size, and
rules.max_request_body_size in ai-semantic-prompt-guard; llm_providers and
llm_format in ai-rate-limiting-advanced (policies is now required);
model.options.upstream_path and the preserve route_type in the shared LLM
schema (use model.options.upstream_url and a concrete route_type instead).
Removed the ai-proxy plugin from the bundled plugins list. Use ai-proxy-advanced instead.
Added data plane support for the new AI Gateway control plane. Data planes now
use JSON-RPC config sync (sync v2) only and send a validated deployment_type value in
the RPC hello payload.
AI Gateway: Added a tags field to the ai_models entity, enabling tag-based filtering on the Admin API and the /tags endpoint.
ai-a2a-proxy:
Added A2A v1.0 wire-format support alongside v0.3.
now rewrites the URL for all supportedInterfaces in the agent card.
ai-guardrail:
Add guardrail_triggered field to protobuf analytics payload.
ai-mcp-proxy, ai-mcp-oauth2:
Introduced forward-proxy support for outbound traffic configuration.
ai-mcp-proxy:
Added upstream MCP server aggregator support, allowing the plugin to aggregate tools from multiple upstream MCP servers.
Updated the default MCP protocol version to 2025-11-25 and added explicit negotiation for older clients.
ai-plugins:
Added proxy_config support to route plugin HTTP requests through a
forward proxy for ai-aws-guardrails, ai-azure-content-safety, ai-custom-guardrail,
ai-gcp-model-armor, ai-lakera-guard, ai-sanitizer, ai-prompt-compressor,
ai-rag-injector, ai-semantic-cache, ai-semantic-prompt-guard,
ai-semantic-response-guard, ai-request-transformer, ai-response-transformer,
and ai-llm-as-judge. For ai-request-transformer, ai-response-transformer, and
ai-llm-as-judge, the existing top-level http_proxy_host/http_proxy_port/
https_proxy_host/https_proxy_port fields are now deprecated in favor of
proxy_config and will be removed in 4.0.
ai-proxy:
Added OTel span attributes gen_ai.input.messages for audio speech routes and gen_ai.output.messages for audio transcription routes when log_payloads is enabled.
Added support for Kimi AI (Moonshot) - a new AI Provider.
Added support for Vercel - a new AI Provider.
Improved Cohere driver with streaming fixes, tool calling support, and usage tracking.
ai-proxy-advanced:
Added clarification for handling “Request body too large” errors.
Added embeddings support for databricks provider.
Added Gemini OpenAI-compatible logprobs mapping on chat completions.
Added new ACL matcher type authenticated_groups, which allows propagating claims and
roles from other authentication plugins into the AI Proxy Advanced per-model ACLs.
Added proxy_config support for forward proxies, including HTTP proxying, Basic authentication, and CONNECT tunneling for HTTPS upstream streaming.
Added reasoning fields mapping between Anthropic Messages and the OpenAI internal format.
Added support for image analysis request to anthropic/bedrock providers.
Added support for anthropic format chat on DeepSeek provider.
kimi:
Added support for anthropic passthrough on Kimi (Moonshot) provider.
llm:
Increase max request body size from 1MB to 8MB.
vercel:
Added support for Anthropic passthrough on Vercel provider.
Added the opt-in response header to expose the computed judge score to clients. The header name defaults to X-Kong-LLM-Accuracy-Score and is configurable via score_header_name.
Added calendar window type. Fixed fetch drift in rate limiting windows.
ai:
Fixed an issue where non-200 responses from Bedrock embeddings API were not properly handled, leading to incorrect feedback to the client.
ai-a2a-proxy:
Reassembled SSE data: events that span multiple body_filter
chunks and dropped oversized events safely, preventing sse_last_event type
errors that crashed the request on large agent responses.
ai-advanced-proxy:
Fixed an issue where we never stored response model in streaming path. It always fallback to the request model
ai-guardrail:
Fixed an issue where latency metrics were missing in the Prometheus output.
ai-guardrails:
Fixed an issue where multiple guardrail plugins can not function together.
ai-mcp-proxy:
Fixed an issue where empty JSON arrays in MCP server responses were rewritten to empty objects when the plugin re-encoded the body for ACL list filtering.
Fixed an issue where raw non-200 upstream responses triggered misleading MCP body parse warnings.
Fixed an issue where WWW-Authenticate: Bearer error=”insufficient_scope” header was not emitted.
Fixed an issue where internal unix-socket subrequests lost the original client IP address, causing IP-aware plugins like ip-restriction to reject legitimate requests.
Fixed an issue where we didn’t propagate errors on secret_to_jwk calls.
Fixed an issue where, since 3.14, call tools converted from API could fail when Kong used a self-signed certificate.
Fixed an issue where converted HTTPS MCP tool calls lost the original forwarded port on the internal TLS Unix socket.
Fixed an issue where tool id might be repeated.
Fixed an issue where we didn’t allow arbitrary tool path in conversion-listener mode.
ai-proxy:
Fixed an issue where responses with unsupported content types could be returned with an incorrect gzip header.
Fixed an issue where log_payloads logged binary data for audio routes, the plugin now logs only the request for speech and only the response for transcription/translation routes.
Fixed Azure AI Foundry v1 API support to not require deployment-specific fields when upstream_url is configured.
Fixed Gemini driver dropping Gemini-native fields (e.g. cachedContent, safetySettings) and Vertex AI-only fields (e.g. labels) during OpenAI-to-Gemini request transformation.
Fixed role matching in message extraction and formatting to be case-insensitive, and added a nil-safety check for messages.
Fixed an issue where options.upstream_url was not respected in native mode.
ai-proxy-advanced:
Fixed an issue where native-format requests using a model alias were incorrectly proxying to upstream model.
Fixed an issue where full-sync reconfigure reset balancer state even when plugin configs were unchanged.
Fixed an issue where concurrent worker processes could race to initialize the semantic routing vectorDB index, causing “Index already exists” errors on startup or config reload.
Fixed an issue where driver transformers returned errors or stream metadata in the wrong return position.
Fixed an issue where Vercel Anthropic-format requests did not include the configured model in the upstream body.
Fixed an issue where DeepSeek, Vercel, and Kimi Anthropic count-token requests were proxied to chat endpoints.
Fixed an issue where OpenAI-compatible Anthropic chat requests only preserved the last system message.
Fixed an issue where Anthropic streaming finish reasons are not mapped in OpenAI to Anthropic conversion.
Fixed an issue where the Anthropic driver dropped the top_p, top_k, and stop parameters when translating OpenAI-format requests. The driver now also omits temperature, top_p, and top_k for models that reject them (Claude Opus 4.7, Opus 4.8, and Fable), preventing upstream 400 errors.
Fixed an issue where output_config was rejected by Vertex AI in Anthropic-native requests.
Fixed an issue where cache_creation_input_tokens and cache_read_input_tokens were excluded from prompt token counts, causing undercounting when Anthropic prompt caching was active.
Fixed an issue where configured model name may never be used for Azure provider.
Fixed an issue where we didn’t support Azure GA version of Realtime API.
Fixed an issue where OpenAI-format chat reasoning requests were not mapped consistently across Anthropic, Gemini, Bedrock and more providers.
Fixed an issue where system prompt of Claude Code was truncated when doing non-passthrough proxy.
Fixed an issue where we didn’t support anthropic format for databricks provider.
Fixed an issue where we didn’t use the huggingface’s token usage if available.
Fixed an issue where unsafe model names could construct upstream AI provider paths.
Fixed an issue where we didn’t collect the model name in OpenAI streaming response from Azure.
Fixed an issue where unsafe batch id could cause upstream AI provider path traversal.
Fixed an issue where unsafe model name in native format adaptors could cause upstream AI provider path traversal.
Fixed an issue where dashscope replied 500 to inference request.
Fixed an issue where the xAI driver nested reasoning_effort under reasoning.effort and did not normalize reasoning_content in responses.
Fixed an issue where stream_options was forwarded to Databricks upstreams, causing a 400 error since Databricks does not support this field.
Fixed an issue where GenAI spans were not finished sometimes.
Fixed an issue where observability errors occurred when gpt-image-1.5 returned image token usage details.
Fixed an issue where Azure OpenAI authentication failed during load balancer failover due to token refresh attempts in balancer_by_lua. Tokens are now pre-fetched in the access phase.
Fixed an issue where cache_control in Bedrock Anthropic format requests using ARN model IDs was lost.
Fixed an issue where Bedrock native ConverseStream requests using ARN model IDs could fail while handling streamed responses.
Fixed an issue where some Claude Code MCP tools did not correctly handle empty ‘requires’ array.
Fixed Azure OpenAI responses support in deployment style.
Allowed streaming of responses when guarding_mode was set to INPUT with allow_masking enabled.
Fixed a crash (HTTP 500) when azure_use_managed_identity is enabled.
Fixed a bug where the plugin returned HTTP 500 when the LLM response content was empty. Empty content now skips the content-safety check and passes through.
Fixed response guard sending the entire JSON response body to Azure Content Safety instead of just the assistant message content, which caused false positives when response metadata fields matched blocklist entries.
Fixed an issue where token introspection crashed when client_auth was set to private_key_jwt and client_jwk was provided as a JSON string.
Fixed an issue where downstream scope-based ACL evaluation used claims from the inbound token instead of the exchanged token when token exchange was enabled.
Fixed an issue where token-related 401 responses omitted the protected resource metadata URL when token was given.
Fixed an issue where token exchange actor tokens were not sourced correctly from token_exchange.request, ensuring correct forwarding of actor tokens configured in headers or plugin config.
Fixed an issue where token_exchange.cache.enabled = false was ignored and exchanged tokens were still cached because the cache toggle incorrectly read token_exchange.cache.ttl instead of token_exchange.cache.enabled.
Fixed an issue where the plugin corrupted native-format requests (gemini, anthropic, bedrock, cohere, huggingface) by forwarding an OpenAI-shaped body upstream instead of the original native body shape.
Emitted the documented X-AI-RateLimit-* headers on 429 responses from policies that partition by provider or model.
Fixed an issue where model or provider matchers without partition_by were skipped, causing rate limits to be missed.
Fixed policy integration with ai-proxy
for single-target and multi-target AI proxy routes.
Fixed an issue where runtime template placeholders (e.g. $(uri_captures.*)) in config.llm.model.* fields were not interpolated.
Fixed an issue where unsafe model name could cause upstream AI provider path traversal.
Fixed an issue where runtime template placeholders (e.g. $(uri_captures.*)) in config.llm.model.* fields were not interpolated.
Fixed an issue where the AI sanitizer plugin could not parse the request body correctly.
Fixed an issue where the input field for the llm/v1/responses route was not recognized.
Fixed an issue where max_request_body_size and llm_format were not marked as deprecated.
Fixed an issue where the plugin failed to populate Redis with rule documents due to using worker ID gating instead of worker mutex for vectordb operations.
Fixed an issue where the redirect_uri parameter was sent to the token endpoint for all grant types. It is now included only for the authorization_code grant, as required by RFC 6749.
Fix the race condition where the balancer tries array gets cleared before the asynchronous timer thread can safely encode it.
ai-semantic-prompt-guard, ai-semantic-response-guard: Fixed an issue where full-sync reconfigure rebuilt semantic vectorDB indexes even when the plugin configuration was unchanged.
Fixed AI Proxy Advanced Gemini failover handling when a target sets upstream_url to ngx.null, avoiding an empty trailing query string in the computed upstream URI.
Fixed an issue where when Postgres strategy is used for session storage, concurrent authentication requests could result in race condition and session creation collisions.
Applied upstream nginx security patches for CVE-2026-40701, CVE-2026-40460, CVE-2026-42934, CVE-2026-42946, and CVE-2026-42945.
Applied upstream nginx security patches for limiting the number of maximum headers (CVE-2026-49975).
debugger: Fixed an issue where response body content capture consumed streaming response chunks.
Fixed an issue where AI proxy plugins rejected output_cost: 0 in schema validation, preventing users from configuring models that have no output token cost.
Fixed an issue where anonymous reports omitted model usage when one provider used multiple models.
Fixed an issue where cluster mutex did not timeout immediately with no_wait = true when node level mutex is being held by another worker.
Increased the default proxy_ssl_verify_depth and lua_ssl_verify_depth from 1 to 5.
Bumped OpenSSL from 3.5.6 to 3.5.7.
ai:
Removed unused redis connection when setting up Redis vectordb.