Upgrade History Highlights
Behavior changes from individual API7 Gateway patch releases that matter when planning an upgrade, collected in one place instead of scattered across 118 release-note pages.
API7 Gateway publishes one page per release — 118 of them at last count, in Release Notes. Reading every page in full before an upgrade doesn't scale, but several patch-level changes affect configuration compatibility or client-visible behavior in ways that are easy to miss if you only read the release notes for your source and target version. This page collects those changes, each one verified against its own release notes page, so you can scan it before deciding whether a specific release note deserves a closer read.
This page is not a substitute for the Upgrade Compatibility Matrix, which covers the two verified LTS-to-LTS routes and the release lines that changed API7 Gateway's data model. The items below are smaller in scope — plugin field requirements, reference syntax, and configuration additions — and can matter on a patch or adjacent-minor upgrade that the LTS matrix doesn't cover.
Plugin and configuration behavior changes
| Release | Change | Action for an upgrade that crosses this release |
|---|---|---|
| 3.2.14.3 | SSL certificates can reference $env:// to pull a value from an environment variable instead of storing it inline. | No action required to upgrade past it; adopt it going forward if certificates are currently stored inline. |
| 3.2.14.4 | Routes can override the upstream-side timeout individually, instead of inheriting only the upstream's own timeout. | No action required; this is an additive capability. |
| 3.2.16.6 | The JWT Auth plugin supports key_claim_name, for tokens that carry the key ID under a non-default claim. | No action required unless you need non-default claim names; existing JWT Auth configurations are unaffected. |
| 3.8.3 | Custom plugin schemas automatically gain an injected _meta field. | No action required to upgrade past it. If tooling generates or diffs custom-plugin schemas outside the Dashboard, confirm it tolerates the added field. |
| 3.8.17 | The limit-conn plugin's conn and burst fields, and several other rate-limiting plugins' equivalent fields, accept variable syntax instead of only static numbers. | No action required; existing static values keep working. |
| 3.8.19 | The ai-rate-limiting plugin requires a policy field on the next create or update. Existing stored configurations keep running with no policy set, but any update without one is rejected. | Before or during upgrade, add an explicit policy (for example policy: local) to ai-rate-limiting configurations that automation might later update, so that update does not unexpectedly fail. |
| 3.8.16 | SSL certificates support wildcard SNI matching, so one certificate can cover multiple subdomains instead of requiring a certificate per SNI. | No action required; adopt it going forward to reduce certificate sprawl if useful. |
| 3.9.10 | The OpenAPI2MCP service is no longer bundled inside the gateway image — it moved to a separate sidecar container (api7/openapi-to-mcp), shrinking the gateway image by about 150 MB. | Any deployment using the openapi-to-mcp or mcp-tools-acl plugins must deploy the sidecar before or during the upgrade (openapiToMcp.enabled=true in the gateway Helm chart, or the sidecar container in the same network namespace under Docker Compose). Without it, those plugins stop working after the upgrade. |
Related
- Release Notes — the full, authoritative per-release detail this page summarizes from.
- Upgrade Compatibility Matrix — verified LTS-to-LTS routes, known upgrade blockers, and the release lines that changed the data model.
- Plan an API7 Gateway Upgrade — the general upgrade mechanics this page assumes.