Merge branch 'master' into ad-retries-port

changelog/3.8.0/kong-manager/a11y-improvements.yml

@@ -0,0 +1,2 @@
+message: Improved accessibility in Kong Manager.
+type: feature

changelog/3.8.0/kong-manager/resizable-entity-lists.yml

@@ -0,0 +1,2 @@
+message: Enhanced entity lists so that you can resize or hide list columns.
+type: feature

changelog/3.8.0/kong-manager/sni-field-in-certificate-form.yml

@@ -0,0 +1,3 @@
+message: Added an SNIs field to the certificate form.
+type: feature
+githubs: [264]

changelog/3.8.0/kong-manager/ui-improvements.yml

@@ -0,0 +1,18 @@
+message: Improved the user experience in Kong Manager by fixing various UI-related issues.
+type: bugfix
+githubs:
+  - 232
+  - 233
+  - 234
+  - 237
+  - 238
+  - 240
+  - 244
+  - 250
+  - 252
+  - 255
+  - 257
+  - 263
+  - 264
+  - 267
+  - 272

changelog/3.8.0/kong/add-ai-data-latency.yml

@@ -0,0 +1,3 @@
+message: "AI plugins: Latency data is now pushed to logs and metrics."
+type: feature
+scope: "Plugin"

changelog/3.8.0/kong/add-ai-data-prometheus.yml

@@ -0,0 +1,3 @@
+message: "**prometheus**: Added `ai_requests_total`, `ai_cost_total` and `ai_tokens_total` metrics in the Prometheus plugin to start counting AI usage."
+type: feature
+scope: Plugins

changelog/3.8.0/kong/ai-plugin-read-file.yml

@@ -0,0 +1,5 @@
+message: >
+  **AI-proxy-plugin**: Added the `allow_override` option to allow overriding
+  the upstream model auth parameter or header from the caller's request.
+type: feature
+scope: "Plugin"

changelog/3.8.0/kong/ai-proxy-azure-streaming.yml

@@ -0,0 +1,5 @@
+message: >
+  **AI-proxy**: Fixed an issue where certain Azure models would return partial tokens/words
+  when in response-streaming mode.
+scope: Plugin
+type: bugfix

changelog/unreleased/kong/ai-proxy-cloud-identity-transformer-plugins.yml → changelog/3.8.0/kong/ai-proxy-cloud-identity-transformer-plugins.yml

@@ -1,5 +1,5 @@
-message: |
-  **AI-Transformer-Plugins**: Fixed a bug where cloud identity authentication 
+message: >
+  **AI Transformer plugins**: Fixed an issue where Cloud Identity authentication
   was not used in `ai-request-transformer` and `ai-response-transformer` plugins.
 scope: Plugin
 type: bugfix

changelog/3.8.0/kong/ai-proxy-fix-model-parameter.yml

@@ -0,0 +1,5 @@
+message: |
+  **AI-proxy**: Fixed an issue where Cohere and Anthropic providers didn't read the `model` parameter properly
+  from the caller's request body.
+scope: Plugin
+type: bugfix

changelog/3.8.0/kong/ai-proxy-fix-nil-response-token-count.yml

@@ -0,0 +1,4 @@
+message: |
+  **AI-proxy**: Fixed an issue where using OpenAI Function inference requests would log a request error, and then hang until timeout.
+scope: Plugin
+type: bugfix

changelog/3.8.0/kong/ai-proxy-fix-sending-own-model.yml

@@ -0,0 +1,5 @@
+message: |
+  **AI-proxy**: Fixed an issue where AI Proxy would still allow callers to specify their own model,
+  ignoring the plugin-configured model name.
+scope: Plugin
+type: bugfix

changelog/3.8.0/kong/ai-proxy-fix-tuning-parameter-precedence.yml

@@ -0,0 +1,5 @@
+message: |
+  **AI-proxy**: Fixed an issue where AI Proxy would not take precedence of the
+  plugin's configured model tuning options over those in the user's LLM request.
+scope: Plugin
+type: bugfix

changelog/3.8.0/kong/ai-proxy-mistral-ai.yml

@@ -0,0 +1,4 @@
+message: >
+  **ai-proxy**: The Mistral provider can now use mistral.ai-managed services by omitting the `upstream_url`.
+type: feature
+scope: Plugin

changelog/3.8.0/kong/ai-proxy-model-header.yml

@@ -0,0 +1,4 @@
+message: >
+  **ai-proxy**: Added the new response header `X-Kong-LLM-Model`, which displays the name of the language model used in the AI Proxy plugin.
+type: feature
+scope: Plugin

changelog/3.8.0/kong/ai-proxy-proper-model-assignment.yml

@@ -0,0 +1,5 @@
+message: |
+  **AI-proxy**: Fixed an issue where setting OpenAI SDK model parameter "null" caused analytics
+  to not be written to the logging plugin(s).
+scope: Plugin
+type: bugfix

changelog/unreleased/kong/bump-lua-resty-aws.yml → changelog/3.8.0/kong/bump-lua-resty-aws.yml

@@ -1,3 +1,3 @@
-message: "Bumped lua-resty-aws to 1.5.3 to fix a bug related to STS regional endpoint."
+message: "Bumped lua-resty-aws to 1.5.3 to fix a bug related to the STS regional endpoint."
 type: dependency
 scope: Core

changelog/3.8.0/kong/bump-lua-resty-healthcheck.yml

@@ -0,0 +1,3 @@
+message: "Bumped lua-resty-healthcheck from 3.0.1 to 3.1.0 to reduce active healthcheck timer usage."
+type: dependency
+scope: Core

changelog/3.8.0/kong/bump-pcre.yml

@@ -0,0 +1,3 @@
+message: "Bumped PCRE2 to 10.44 to fix some bugs and tidy up the release."
+type: dependency
+scope: Core

changelog/3.8.0/kong/feat-ai-prompt-guard-all-roles.yml

@@ -0,0 +1,4 @@
+message: >
+  **AI-Prompt-Guard**: Added the `match_all_roles` option to allow matching all roles in addition to `user`.
+type: feature
+scope: Plugin

changelog/3.8.0/kong/feat-aws-lambda-decode-empty-array.yml

@@ -0,0 +1,6 @@
+message: >
+    **AWS-Lambda**: Added the configuration field `empty_arrays_mode` to
+    control whether Kong should send `[]` empty arrays (returned by Lambda function)
+    as `[]` empty arrays or `{}` empty objects in JSON responses.
+type: feature
+scope: Plugin

changelog/unreleased/kong/feat-queue-concurrency-limit.yml → changelog/3.8.0/kong/feat-queue-concurrency-limit.yml

@@ -1,5 +1,5 @@
 message: |
-  Added a new configuration `concurrency_limit`(integer, default to 1) for Queue to specify the number of delivery timers.
+  Added the new configuration parameter `concurrency_limit` (integer, defaults to 1), which lets you specify the number of delivery timers in the queue.
   Note that setting `concurrency_limit` to `-1` means no limit at all, and each HTTP log entry would create an individual timer for sending.
 type: feature
 scope: Core

changelog/3.8.0/kong/feat-response-transformer-json-rename.yml

@@ -0,0 +1,4 @@
+message: |
+  **response-transformer**: Added support for `json_body` rename.
+type: feature
+scope: Plugin

changelog/3.8.0/kong/feat-via.yml

@@ -0,0 +1,6 @@
+message: |
+  Kong Gateway now appends gateway info to the upstream `Via` header in the format `1.1 kong/3.8.0`, and optionally to the
+  response `Via` header if it is present in the `headers` config of `kong.conf`, in the format `2 kong/3.8.0`.
+  This follows standards defined in RFC7230 and RFC9110.
+type: feature
+scope: Core

changelog/3.8.0/kong/fix-acme-misleading-deprecation-logs.yml

@@ -0,0 +1,5 @@
+message: >
+  **ACME**: Fixed an issue where the DP would report that deprecated
+  config fields were used when configuration was pushed from the CP.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-ai-gzip-content.yml

@@ -0,0 +1,4 @@
+message: |
+   **AI-Proxy**: Fixed issue when response was gzipped even if the client didn't accept the format.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-ai-metrics-prometheus-compat.yml

@@ -0,0 +1,4 @@
+message: >
+  **Prometheus**: Fixed an issue where CP/DP compatibility check was missing for the new configuration field `ai_metrics`.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-ai-plugin-no-consumer.yml

@@ -0,0 +1,5 @@
+message: >
+  Fixed an issue where certain AI plugins couldn't be applied per consumer or per service.
+type: bugfix
+scope: Plugin
+

changelog/3.8.0/kong/fix-ai-prompt-guard-order.yml

@@ -0,0 +1,5 @@
+message: >
+  **AI-Prompt-Guard**: Fixed an issue which occurred when `allow_all_conversation_history`
+  was set to false, and caused the first user request to be selected instead of the last one.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-ai-proxy-shared-state.yml

@@ -0,0 +1,4 @@
+message: >
+  **AI-Proxy**: Resolved an issue where the object constructor would set data on the class instead of the instance.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-aws-lambda-empty-array-mutli-value.yml

@@ -0,0 +1,5 @@
+message: >
+  **AWS-Lambda**: Fixed an issue where the plugin didn't work with multiValueHeaders
+  defined in proxy integration and legacy `empty_arrays_mode`.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-aws-lambda-gateway-compat-version-field.yml

@@ -0,0 +1,5 @@
+message: >
+  **AWS-Lambda**: Fixed an issue where the `version` field wasn't
+  set in the request payload when `awsgateway_compatible` was enabled.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-clustering-forward-proxy-authentication.yml

@@ -0,0 +1,6 @@
+message: >
+  Fixed an issue where hybrid mode wasn't working
+  if the forward proxy password contained the special character `#`.
+  Note that the `proxy_server` configuration parameter still needs to be url-encoded.
+type: bugfix
+scope: Clustering

changelog/3.8.0/kong/fix-cors-wildcard.yml

@@ -0,0 +1,5 @@
+message: >
+  **CORS**: Fixed an issue where the `Access-Control-Allow-Origin` header
+  was not sent when `conf.origins` had multiple entries but included `*`.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-deprecate-shorthands-precedence.yml

@@ -0,0 +1,5 @@
+message: >
+  Fixed an issue with deprecated shorthand fields so that
+  they don't take precedence over replacement fields when both are specified.
+type: bugfix
+scope: Core

changelog/3.8.0/kong/fix-filter-finalize-in-send-header-clear-context.yml

@@ -0,0 +1,6 @@
+message: >
+  Fixed an issue where `lua-nginx-module` context was cleared when `ngx.send_header()`
+  triggered `filter_finalize`.
+  [openresty/lua-nginx-module#2323](https://github.com/openresty/lua-nginx-module/pull/2323).
+type: bugfix
+scope: Core

changelog/3.8.0/kong/fix-for-null-aware-shorthand.yml

@@ -0,0 +1,5 @@
+message: >
+  Changed the way deprecated shorthand fields are used with new fields.
+  If the new field contains null, it allows for deprecated field to overwrite it if both are present in the request.
+type: bugfix
+scope: Core

changelog/3.8.0/kong/fix-http-log-host-header.yml

@@ -0,0 +1,6 @@
+message: >
+  **HTTP-Log**: Fixed an issue where the plugin didn't include
+  port information in the HTTP host header when sending requests to the log server.
+type: bugfix
+scope: Plugin
+

changelog/3.8.0/kong/fix-log-upstream-status-nil-subrequest.yml

@@ -0,0 +1,4 @@
+message: |
+  **PDK**: Fixed an issue where the log serializer logged `upstream_status` as nil in the requests that contained subrequests.
+type: bugfix
+scope: PDK

changelog/3.8.0/kong/fix-multi-modal.yml

@@ -0,0 +1,4 @@
+message: >
+  **AI Plugins**: Fixed an issue where multi-modal inputs weren't properly validated and calculated.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-otel-migrations-exception.yml

@@ -0,0 +1,4 @@
+message: >
+  **OpenTelemetry:** Fixed an issue where migration failed when upgrading from below version 3.3 to 3.7.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-propagation-remove-redundant-warnings.yml

@@ -0,0 +1,4 @@
+message: >
+  **OpenTelemetry and Zipkin**: Removed redundant deprecation warnings.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-realm-compat-changes-basic-auth.yml

@@ -0,0 +1,5 @@
+message: >
+  **Basic-Auth**: Fixed an issue where the realm field
+  wasn't recognized for older Kong Gateway versions (before 3.6).
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-realm-compat-changes-key-auth.yml

@@ -0,0 +1,5 @@
+message: >
+  **Key-Auth**: Fixed an issue where the realm field wasn't
+  recognized for older Kong Gateway versions (before 3.7).
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-reports-uninitialized-variable-in-400.yml

@@ -0,0 +1,4 @@
+message: |
+  Fixed an issue where an unnecessary uninitialized variable error log was reported when 400 bad requests were received.
+type: bugfix
+scope: Core

changelog/3.8.0/kong/fix-request-size-limiting-with-chunked-transfer-encoding-and-no-content-length.yml

@@ -0,0 +1,5 @@
+message: >
+  **Request Size Limiting**: Fixed an issue where the body size
+  didn't get checked when the request body was buffered to a temporary file.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-request-transformer-uri-replace.yml

@@ -0,0 +1,4 @@
+message: |
+  Fixed an issue where the URI captures were unavailable when the first capture group was absent.
+type: bugfix
+scope: Core

changelog/3.8.0/kong/fix-response-rl-misleading-deprecation-logs.yml

@@ -0,0 +1,6 @@
+message: >
+  **Response-RateLimiting**: Fixed an issue where the DP would
+  report that deprecated config fields were used
+  when configuration was pushed from the CP.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-rl-misleading-deprecation-logs.yml

@@ -0,0 +1,6 @@
+message: >
+  **Rate-Limiting**: Fixed an issue where the DP would
+  report that deprecated config fields were used
+  when configuration was pushed from the CP.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/fix-route-set-priority-with-others.yml

@@ -0,0 +1,5 @@
+message: >
+  Fixed an issue where the priority field could be set in a traditional mode route
+  when `router_flavor` was configured as `expressions`.
+type: bugfix
+scope: Core

changelog/3.8.0/kong/fix-sni-cache-invalidate.yml

@@ -0,0 +1,4 @@
+message: |
+  Fixed an issue where the SNI cache wasn't invalidated when an SNI was updated.
+type: bugfix
+scope: Core

changelog/3.8.0/kong/fix-type-of-logrotate.yml

@@ -0,0 +1,6 @@
+message: >
+    The `kong.logrotate` configuration file will no longer be overwritten during upgrade.
+    When upgrading, set the environment variable `DEBIAN_FRONTEND=noninteractive` on Debian/Ubuntu
+    to avoid any interactive prompts and enable fully automatic upgrades.
+type: bugfix
+scope: Core

changelog/3.8.0/kong/fix-vault-reference-parsing-endslash.yml

@@ -0,0 +1,4 @@
+message: |
+   **Vault**: References ending with a slash, when parsed, will no longer return a key.
+type: bugfix
+scope: PDK

changelog/3.8.0/kong/fix-vault-secret-rotation-log-level.yml

@@ -0,0 +1,3 @@
+message: Error logs produced during Vault secret rotation are now logged at the `notice` level instead of `warn`.
+type: bugfix
+scope: Core

changelog/3.8.0/kong/hmac_www_authenticate.yml

@@ -0,0 +1,4 @@
+message: >
+  **hmac-auth**: Added WWW-Authenticate headers to 401 responses.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/host_header.yml

@@ -0,0 +1,5 @@
+message: >
+  Fixed an issue where the `host_header` attribute of the upstream entity
+  wouldn't be set correctly as a Host header in requests to the upstream during connection retries.
+scope: Core
+type: bugfix

changelog/3.8.0/kong/jwt_www_authenticate.yml

@@ -0,0 +1,4 @@
+message: >
+  **jwt**: Added WWW-Authenticate headers to 401 responses.
+type: bugfix
+scope: Plugin

changelog/3.8.0/kong/ldap_www_authenticate.yml

@@ -0,0 +1,4 @@
+message: >
+  **ldap-auth**: Added WWW-Authenticate headers to all 401 responses.
+type: bugfix
+scope: Plugin

changelog/unreleased/kong/migration_of_ai_proxy_plugin.yml → changelog/3.8.0/kong/migration_of_ai_proxy_plugin.yml

@@ -1,5 +1,5 @@
-message: |
-  **AI-proxy**: A configuration validation is added to prevent from enabling `log_statistics` upon
+message: >
+  **AI-proxy**: Added a configuration validation to prevent `log_statistics` from being enabled upon
   providers not supporting statistics. Accordingly, the default of `log_statistics` is changed from
   `true` to `false`, and a database migration is added as well for disabling `log_statistics` if it
   has already been enabled upon unsupported providers.

changelog/3.8.0/kong/oauth2_www_authenticate.yml

@@ -0,0 +1,5 @@
+message: >
+  **OAuth2**: Added WWW-Authenticate headers to all 401 responses and realm option.
+type: bugfix
+scope: Plugin
+

changelog/3.8.0/kong/pdk-log-error.yml

@@ -0,0 +1,5 @@
+message: >
+  Fixed an issue where `pdk.log.serialize()` threw an error
+  when the JSON entity set by `serialize_value` contained `json.null`.
+type: bugfix
+scope: PDK

changelog/3.8.0/kong/pdk-read-file.yml

@@ -0,0 +1,3 @@
+message: "Extended `kong.request.get_body` and `kong.request.get_raw_body` to read from buffered files."
+type: feature
+scope: "PDK"

changelog/unreleased/kong/pdk-telemetry-log.yml → changelog/3.8.0/kong/pdk-telemetry-log.yml

@@ -1,5 +1,5 @@
 message: |
-  Added a new PDK module `kong.telemetry` and function: `kong.telemetry.log`
+  Added a new PDK module `kong.telemetry` and the function `kong.telemetry.log`
   to generate log entries to be reported via the OpenTelemetry plugin.
 type: feature
 scope: PDK

changelog/3.8.0/kong/plugins-add-standard-webhooks.yml

@@ -0,0 +1,4 @@
+message: |
+  **standard-webhooks**: Added standard webhooks plugin.
+type: feature
+scope: Plugin

changelog/3.8.0/kong/refactor_dns_client.yml

@@ -0,0 +1,13 @@
+message: >
+  Starting from this version, a new DNS client library has been implemented and added into Kong.
+  This library is disabled by default, and can be enabled by setting the `new_dns_client` parameter to `on`.
+
+  The new DNS client library provides the following:
+
+   - Global caching for DNS records across workers, significantly reducing the query load on DNS servers.
+
+   - Observable statistics for the new DNS client, and a new Status API `/status/dns` to retrieve them.
+
+   - Simplified and standardized logic.
+type: feature
+scope: Core

changelog/unreleased/kong/reject-config-on-deprecated-fields-mismatch.yml → changelog/3.8.0/kong/reject-config-on-deprecated-fields-mismatch.yml

@@ -1,5 +1,5 @@
-message: |
+message: >
   Changed the behaviour of shorthand fields that are used to describe deprecated fields. If
-  both fields are sent in the request and their values mismatch - the request will be rejected.
+  both fields are sent in the request and their values mismatch, the request will be rejected.
 type: bugfix
 scope: Core

changelog/3.8.0/kong/remove_eol_debian_rhel.yml

@@ -0,0 +1,2 @@
+message: Debian 10 and RHEL 7 reached their End of Life (EOL) dates on June 30, 2024. As of version 3.8.0.0 onward, Kong is not building installation packages or Docker images for these operating systems. Kong is no longer providing official support for any Kong version running on these systems.
+type: deprecation