API7 Gateway Release Notes
Review the latest updates, features, improvements, and bug fixes for each version of API7 Gateway in release notes.
Every release has its own page. 118 releases, by release line, newest line first.
Chart and application version correspondence
A Helm chart version and the API7 Gateway application (image) version it deploys are independent numbering schemes — the chart version is not the product version. This has tripped up upgrade planning before: for example, control-plane chart 3.10.10 deploys application version 3.10.7, not "3.10.10." The pairs below are the ones documented and verified in the upgrade guides; they are not a complete history of every chart release.
| Component | Chart version | Application (image) version |
|---|---|---|
Control plane (api7/api7ee3) | 0.17.37 | v3.8.23 |
Control plane (api7/api7ee3) | 3.9.9 | v3.9.20 |
Control plane (api7/api7ee3) | 3.10.10 | v3.10.7 |
Data plane (api7/gateway) | 0.2.40 | 3.8.23 |
Data plane (api7/gateway) | 3.9.12 | 3.9.20 |
Data plane (api7/gateway) | 3.10.15 | 3.10.7 |
Chart 0.2.40 and 0.17.37 default to older image tags (3.8.21) when a release does not pin an explicit image, so always record the actual running image tag from the cluster rather than assuming it matches the chart version. For chart values, plugin attributes, and the full set of Helm-configurable fields, see the Helm Chart reference. For the verified upgrade paths that use these pairs, see Upgrade Compatibility Matrix and Choose an LTS Upgrade Path. For behavior changes that matter when planning an upgrade but are easy to miss inside a single patch release's notes, see Upgrade History Highlights.
| Version | Date | Summary |
|---|---|---|
| 3.10.7 | 2026-09-08 | Basic Auth — A basic auth password can no longer be empty. |
| 3.10.6 | 2026-08-25 | Custom plugins are managed per gateway group |
| 3.10.5 | 2026-08-11 | Alibaba Cloud Logging (SLS) — The plugin now verifies the TLS certificate of the log server. |
| 3.10.4 | 2026-07-27 | max_req_body_bytes and max_resp_body_bytes are now validated as integers of at least 1 in the ClickHouse Logger, Elasticsearch Logger, File Logger, Loggly, Loki Logger, SkyWalking Logger |
| 3.10.3 | 2026-07-14 | Several Data Plane shared memory (lua_shared_dict) defaults were raised, so a 3.10.3 gateway reserves about 365 MiB more shared memory at startup than 3.10.2 with the default configuration: |
| 3.10.2 | 2026-06-29 | The Control Plane now encrypts additional credential-bearing plugin fields at rest. |
| 3.10.1 | 2026-06-15 | JWT Auth — jwt-auth now verifies the token's exp (expiration) and nbf (not-before) claims by default. |
| 3.10.0 | 2026-06-01 | HMAC Auth — The hmac-auth plugin now defaults signed_headers to ["date"]. |
| 3.9.20 | 2026-09-03 | Basic Auth — A basic auth password can no longer be empty. |
| 3.9.19 | 2026-08-26 | The gateway has always overwritten X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port and cleared Forwarded for requests from peers it does not trust. |
| 3.9.18 | 2026-08-12 | Alibaba Cloud Logging (SLS) — The plugin now verifies the TLS certificate of the log server. |
| 3.9.17 | 2026-07-28 | max_req_body_bytes and max_resp_body_bytes are now validated as integers of at least 1 in the ClickHouse Logger, Elasticsearch Logger, File Logger, Loggly, Loki Logger, SkyWalking Logger |
| 3.9.16 | 2026-07-10 | The 3.9.16 Helm chart raises several Data Plane shared memory (lua_shared_dict) defaults, so a Helm-deployed gateway reserves about 365 MiB more shared memory at startup than the previous chart: |
| 3.9.15 | 2026-06-22 | This release adds new plugin configuration fields: log_format_extra on the logger plugins and Redis session storage (session.storage and session.redis) for openid-connect. |
| 3.9.14 | 2026-06-15 | JWT Auth — jwt-auth now verifies the token's exp (expiration) and nbf (not-before) claims by default. |
| 3.9.13 | 2026-05-22 | CAS Auth — The cas-auth plugin now requires a cookie.secret value of at least 32 characters. |
| 3.9.12 | 2026-05-08 | AI Proxy — Added support for the AWS Bedrock provider using the Converse API. |
| 3.9.11 | 2026-04-30 | This version extends secret references ($secret://, $env://) to work with all plugins centrally. |
| 3.9.10 | 2026-04-22 | OpenAPI to MCP — The OpenAPI2MCP service is no longer bundled inside the gateway image. |
| 3.9.9 | 2026-04-10 | Upstream labels are now persisted and returned correctly via the API. |
| 3.9.8 | 2026-04-07 | Limit Count — The sync_interval (Redis delayed sync) feature has been removed from the limit-count plugin and is now available exclusively in the Limit Count Advanced plugin. |
| 3.9.7 | 2026-03-25 | The Control Plane now encrypts additional credential-bearing plugin fields at rest. |
| 3.9.6 | 2026-03-09 | Error Log Collect — Added a new plugin to support centralized error log collection. |
| 3.9.5 | 2026-02-14 | Feishu Auth — Added a new Feishu authentication plugin based on the OAuth 2.0 Authorization Code flow, supporting integration with internal business services in the workbench. |
| 3.9.4 | 2026-02-03 | After disabling SCIM, users can delete historical SCIM accounts synchronized from the IdP in API7. |
| 3.9.3 | 2026-01-26 | AI Request Rewrite — Supported two new providers: Gemini, Vertex AI. |
| 3.9.2 | 2026-01-19 | OpenID Connect — The session.secret field is now required when bearer_only is false (the default). |
| 3.9.1 | 2026-01-08 | Fixed issue: "Developers" created in older versions of the Developer Portal could not be deleted. |
| 3.9.0 | 2026-01-06 | Newly Redesigned Developer Portal — The Developer Portal has been completely redesigned. |
| 3.8.23 | 2026-02-03 | Supports uploading OpenAPI 3.1.0 and 3.1.1 files. |
| 3.8.22 | 2026-01-19 | Limit Count — Fixed issue: The rate limiting counter was shared when the same rate-limiting configuration was applied across multiple consumers (introduced in 3.8.5). |
| 3.8.21 | 2025-12-23 | gRPC Web — Supported enabling the plugin on routes that use non-wildcard paths. |
| 3.8.20 | 2025-12-11 | OpenAPI to MCP — Fixed issue: Variables in base_url were not resolved correctly. |
| 3.8.19 | 2025-12-09 | OpenAPI to MCP — Supported using variable syntax in base_url. |
| 3.8.18 | 2025-11-25 | To support creating multiple Portal instances, the portal-auth plugin of the data plane has been upgraded. |
| 3.8.17 | 2025-11-10 | Limit Conn — Supported variable syntax in the conn and burst fields. |
| 3.8.16 | 2025-10-28 | Kafka Logger — Supported SCRAM-SHA-512 in SASL mechanism. |
| 3.8.15 | 2025-10-13 | Lago — Introduced new plugin. |
| 3.8.14 | 2025-09-25 | Fixed issue: Upstream reference error when configuring multiple services with duplicate backends in Ingress Controller v2.0.6. |
| 3.8.13 | 2025-09-23 | OpenAPI to MCP — Introduced new plugin. |
| 3.8.12 | 2025-09-17 | Fixed issue: Users with policies scoped by service_label could not edit the corresponding services or service templates. |
| 3.8.11 | 2025-08-25 | AI Request Rewrite — Introduced new plugin. |
| 3.8.10 | 2025-08-25 | SOAP — Introduced new plugin. |
| 3.8.9 | 2025-08-11 | JWT Auth — Added store_in_ctx parameter to store validated JWT object in request context. |
| 3.8.8 | 2025-07-28 | Supported Consul service discovery deduplication and node sorting. |
| 3.8.7 | 2025-07-17 | Limit Count Advanced — Added support for Redis Sentinel mode. |
| 3.8.6 | 2025-06-27 | Elasticsearch Logger — Added support for Elasticsearch 9.0.2. |
| 3.8.5 | 2025-06-16 | Added route URI information to alert messages for status code-related alert events. |
| 3.8.4 | 2025-06-11 | Optimized the performance of large table data migration during control plane upgrades. |
| 3.8.3 | 2025-06-04 | Automatically inserted _meta into the schemas of custom plugins. |
| 3.8.2 | 2025-05-19 | AI Proxy Multi — Added retry logic for 429/5xx response codes to improve request success rate. |
| 3.8.1 | 2025-05-07 | Limit Count Advanced — Added automatic fallback to local shared dict when Redis is unavailable, preventing request failures during Redis outages. |
| 3.8.0 | 2025-04-22 | AI Proxy — Implemented new identifier fields logging and summaries for collecting LLM request and response content. |
| 3.7.8 | 2025-06-16 | Fixed issue: Route plugin updates in services mistakenly override existing plugins. |
| 3.7.7 | 2025-06-11 | Optimized the performance of large table data migration during control plane upgrades. |
| 3.7.6 | 2025-06-02 | Fixed issue: Kubernetes service discovery experiences performance issues with a high number of upstream nodes. |
| 3.7.5 | 2025-05-19 | Fixed issue: Failed to update basic information of published services. |
| 3.7.4 | 2025-04-30 | Specified the validity period of the gateway instance certificate when adding a gateway instance. |
| 3.7.3 | 2025-04-22 | Fixed issue: High database CPU utilization when using large scale of consumers. |
| 3.7.2 | 2025-03-24 | OpenTelemetry — Fixed issue: A 404 response on the dynamic route /v2/:customerNumber results in an empty reported path. |
| 3.7.1 | 2025-03-14 | OpenID Connect — Fixed issue: Cannot configuring verify issuer. |
| 3.7.0 | 2025-03-10 | Reference Secrets in Kubernetes Secret: The secret provider now supports Kubernetes secrets. |
| 3.6.1 | 2025-03-14 | Limit Count Advanced — Fixed issue: Intermittently experiences 500 errors during load testing. |
| 3.6.0 | 2025-02-26 | Removed service runtime configurations in service templates, for better template reuse across gateway groups. |
| 3.5.5 | 2025-03-14 | Limit Count Advanced — Fixed issue: Intermittently experiences 500 errors during load testing. |
| 3.5.4 | 2025-03-07 | Elasticsearch Logger — Fixed issue: The plugin cannot configuring the index to dynamically send data based on the current date in the plugin. |
| 3.5.3 | 2025-02-18 | Fixed issue: Alert email subject cannot contain variables. |
| 3.5.2 | 2025-02-18 | Fixed issue: Failed to enable the Log Rotate plugin. |
| 3.5.1 | 2025-02-06 | OpenTelemetry — Fixed issue: Cannot reporting request.url as route.url when the plugin reports dynamic routes /v2/:customerNumber. |
| 3.5.0 | 2025-01-27 | Multiple Upstreams in a Service: For advanced scenarios such as canary deployments, blue-green deployments, or managing multiple clusters, a service can now utilize multiple upstreams. |
| 3.4.2 | 2025-02-18 | List all stream routes in a published service on a gateway group — Fixed issue: Response error. |
| 3.4.1 | 2025-01-14 | Fixed issue: Configuring access_log_format in DP and setting access_log_format_escape to json, the result will append an extra request_id. |
| 3.4.0 | 2025-01-07 | SNI Management: Introduced SNI as a new mechanism for managing TLS and mTLS authentication and certificate matching. |
| 3.3.4 | 2025-02-18 | List all stream routes in a published service on a gateway group — Fixed issue: Response error. |
| 3.3.3 | 2025-01-14 | Fixed issue: Configuring access_log_format in DP and setting access_log_format_escape to json, the result will append an extra request_id. |
| 3.3.2 | 2024-12-24 | Fixed issue: Dashboard failed to start when upgrading from 3.2.16.2 or older version to 3.3.1 and higher version. |
| 3.3.1 | 2024-12-19 | Fixed issue: Plugins running in the rewrite phase will be executed repeatedly after hitting a consumer. |
| 3.3.0 | 2024-12-17 | Refactored an expiration and elimination mechanism in the data plane. |
| 3.2.16.7 | 2024-12-13 | Fixed issue: The DP Manager had entered an infinite loop when it received truncated Prometheus metrics. |
| 3.2.16.6 | 2024-11-25 | The JWT Auth plugin supported key_claim_name. |
| 3.2.16.5 | 2024-11-21 | Added multipart content type to body transformer. |
| 3.2.16.4.1 | 2024-12-09 | Fixed issue: The DP Manager had entered an infinite loop when it received truncated Prometheus metrics. |
| 3.2.16.4 | 2024-11-01 | Alert policies can send notification through webhook and email at the same time by utilizing the new Contact Points. |
| 3.2.16.3 | 2024-10-21 | A secret object is a piece of sensitive information that needs to be protected from unauthorized access |
| 3.2.16.2 | 2024-10-11 | Fixed the issue where plugin configuration updates in Consumer were not taking effect. |
| 3.2.16.1 | 2024-10-04 | Improved Developer Portal(Beta) performance. |
| 3.2.16.0 | 2024-09-30 | This is a breaking change. |
| 3.2.15.2.1 | 2024-12-09 | Fixed issue: The DP Manager had entered an infinite loop when it received truncated Prometheus metrics. |
| 3.2.15.2 | 2024-09-19 | Adjusted the attach-consumer-label plugin to execute in the before_proxy phase. |
| 3.2.15.1 | 2024-09-18 | Fixed issue: Using token to get instance_token returns 401. |
| 3.2.15.0 | 2024-09-14 | This is a breaking change. |
| 3.2.14.6 | 2024-08-28 | Standardized ARM installation packages are available since version 3.2.14.6. |
| 3.2.14.5.1 | 2024-12-09 | Fixed issue: The DP Manager had entered an infinite loop when it received truncated Prometheus metrics. |
| 3.2.14.5 | 2024-08-20 | Fixed a body validation bug in the response-rewrite plugin when body_base64 is set to false. |
| 3.2.14.4.1 | 2024-12-09 | Fixed issue: The DP Manager had entered an infinite loop when it received truncated Prometheus metrics. |
| 3.2.14.4 | 2024-08-14 | API7 Gateway offers granular control over request handling by enabling the configuration of distinct upstream timeouts for individual routes |
| 3.2.14.3 | 2024-08-06 | Supported referencing $env in SSL Certificates. |
| 3.2.14.2 | 2024-07-30 | Fixed UI error for viewing Ingress Controller routes on the Dashboard. |
| 3.2.14.1 | 2024-07-22 | Simply import your OpenAPI specification directly into a gateway group to have your new service and all its routes ready. |
| 3.2.14.0 | 2024-07-08 | This is a breaking change. |
| 3.2.13.0 | 2024-06-19 | The service template API has been migrated to the "/api/services/template" path prefix. |
| 3.2.12.0 | 2024-05-24 | The "service status" field has been changed from "0: enabled, 1: disabled" to "0: disabled, 1: enabled". |
| 3.2.11.8 | 2024-06-26 | Reduced API latency by minimizing etcd calls. |
| 3.2.11.7 | 2024-06-24 | Improve API performance. |
| 3.2.11.6 | 2024-06-24 | Large data sets no longer cause etcd range API error. |
| 3.2.11.5 | 2024-06-18 | The ssl_verify configuration now works fine for the Login Option OIDC and LDAP protocols. |
| 3.2.11.4 | 2024-06-07 | Protect sensitive fields within the login options related to API. |
| 3.2.11.3 | 2024-05-20 | etcd watch can pass SNI correctly. |
| 3.2.11.2 | 2024-05-20 | Labels can be up to 64 characters long and include spaces. |
| 3.2.11.1 | 2024-05-08 | This automated role mapping eliminates the need for manual role assignment by Super Admins. |
| 3.2.10.1 | 2024-04-28 | API7 Enterprise now supports MySQL 5.7. |
| 3.2.10.0 | 2024-04-22 | Tokens are bound to specific users and share the same permissions. |
| 3.2.9.5 | 2024-04-16 | API7 Enterprise now supports mutual TLS (mTLS) authentication between the gateway and upstream services. |
| 3.2.9.4 | 2024-04-07 | Fixed the issue that occurs when the maximum number of CPU cores is reached. |
| 3.2.9.3 | 2024-04-03 | You can store sensitive data securely in your Vault. |
| 3.2.9.2 | 2024-04-01 | API7 Enterprise supports Single Sign-On (SSO) with SAML implementations. |
| 3.2.9.1 | 2024-03-19 | API7 Enterprise now allows you to build custom plugins to add extra functionalities and manage API traffic with custom flow. |
| 3.2.8.1 | 2024-02-08 | API7 Enterprise uses service discovery to automatically detect available upstream services, keeping their addresses in a database (called a service registry). |
Archived release lines
The following release lines are no longer in active support. Upgrade to a supported release as described in the Version Support Policy.